a2be7fd93e2ee72e5513fb9738770ff721fc1eda63a73601529f7c88142ae8ec

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10-08-2024 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe
Size

28KB
MD5

8649931b7b4dc33c2f8099a5b938aae0
SHA1

a3e767448e1d5b956cada9300a4df91f8a2cfea6
SHA256

a2be7fd93e2ee72e5513fb9738770ff721fc1eda63a73601529f7c88142ae8ec
SHA512

93ec2d16782abea21a6fdc2244e6dc7bb6d042b37906d69e88e077cd6af0fc04a2ef8429fbbab402dd7a47b894ad8e2112cda08622bcfe4a3d9bea76c05774e1
SSDEEP

384:/TwYrqgrAF1YtEEH+17X+4iJhjxqAt8oAdNBV1BV+Z46TklDp4hxFIg:/10mE6+VuzJ5wyAlV7V+i6T6uF

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe"	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\AUTORUN.INF	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe
File opened for modification	C:\AUTORUN.INF	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe
File created	F:\AUTORUN.INF	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe
File opened for modification	F:\AUTORUN.INF	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\cmd.exe	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe
File created	\??\c:\windows\SysWOW64\regedit.bat	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\regedit.bat	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2732	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	30
PID 2724 wrote to memory of 2732	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	30
PID 2724 wrote to memory of 2732	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	30
PID 2724 wrote to memory of 2732	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	30
PID 2724 wrote to memory of 2528	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	32
PID 2724 wrote to memory of 2528	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	32
PID 2724 wrote to memory of 2528	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	32
PID 2724 wrote to memory of 2528	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	32
PID 2724 wrote to memory of 2720	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	34
PID 2724 wrote to memory of 2720	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	34
PID 2724 wrote to memory of 2720	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	34
PID 2724 wrote to memory of 2720	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	34
PID 2724 wrote to memory of 2520	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	36
PID 2724 wrote to memory of 2520	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	36
PID 2724 wrote to memory of 2520	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	36
PID 2724 wrote to memory of 2520	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	36
PID 2724 wrote to memory of 2620	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	38
PID 2724 wrote to memory of 2620	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	38
PID 2724 wrote to memory of 2620	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	38
PID 2724 wrote to memory of 2620	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	38
PID 2724 wrote to memory of 2964	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	40
PID 2724 wrote to memory of 2964	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	40
PID 2724 wrote to memory of 2964	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	40
PID 2724 wrote to memory of 2964	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	40
PID 2724 wrote to memory of 2188	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	42
PID 2724 wrote to memory of 2188	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	42
PID 2724 wrote to memory of 2188	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	42
PID 2724 wrote to memory of 2188	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	42
PID 2724 wrote to memory of 264	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	44
PID 2724 wrote to memory of 264	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	44
PID 2724 wrote to memory of 264	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	44
PID 2724 wrote to memory of 264	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	44
PID 2724 wrote to memory of 1412	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	46
PID 2724 wrote to memory of 1412	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	46
PID 2724 wrote to memory of 1412	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	46
PID 2724 wrote to memory of 1412	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	46
PID 2724 wrote to memory of 1576	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	48
PID 2724 wrote to memory of 1576	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	48
PID 2724 wrote to memory of 1576	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	48
PID 2724 wrote to memory of 1576	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	48
PID 2724 wrote to memory of 840	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	50
PID 2724 wrote to memory of 840	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	50
PID 2724 wrote to memory of 840	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	50
PID 2724 wrote to memory of 840	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	50
PID 2724 wrote to memory of 2948	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	52
PID 2724 wrote to memory of 2948	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	52
PID 2724 wrote to memory of 2948	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	52
PID 2724 wrote to memory of 2948	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	52
PID 2724 wrote to memory of 1564	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	54
PID 2724 wrote to memory of 1564	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	54
PID 2724 wrote to memory of 1564	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	54
PID 2724 wrote to memory of 1564	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	54
PID 2724 wrote to memory of 2368	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	56
PID 2724 wrote to memory of 2368	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	56
PID 2724 wrote to memory of 2368	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	56
PID 2724 wrote to memory of 2368	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	56
PID 2724 wrote to memory of 2364	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	58
PID 2724 wrote to memory of 2364	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	58
PID 2724 wrote to memory of 2364	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	58
PID 2724 wrote to memory of 2364	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	58
PID 2724 wrote to memory of 2568	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	60
PID 2724 wrote to memory of 2568	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	60
PID 2724 wrote to memory of 2568	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	60
PID 2724 wrote to memory of 2568	2724	8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe	60

C:\Users\Admin\AppData\Local\Temp\8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8649931b7b4dc33c2f8099a5b938aae0_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2732
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2528
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2720
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2520
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2964
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2188
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:264
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1412
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1576
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:840
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2948
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1564
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2368
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2364
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2568
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1856
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1940
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2488
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1660
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1204
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2600
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2740
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1724
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2352
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2088
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:3016
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1716
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2692
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:336
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2480
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:912
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2912
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1104
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2280
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1304
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1980
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:948
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1216
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1864
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:764
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:3056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2424
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2112
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1604
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1876
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2676
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2416
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:880
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1740
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1520
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1528
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2616
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2168
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2960
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2528
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2516
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2552
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2124
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:596
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:592
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2824
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2852
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3044
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2096
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1780
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2008
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1572
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2060
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1496
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1840
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1968
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2400
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1624
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1688
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2880
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2104
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2996
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2252
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1676
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:816
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2468
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:404
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:296
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1952
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1304
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1256
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1312
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1788
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1600
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1652
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:624
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1720
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2284
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2444
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1928
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1472
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3040
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2452
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2644
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2624
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2848
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2732
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2812
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2680
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2496
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2940
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2188
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:780
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1300
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2328
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2820
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2948
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:3060
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2012
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1580
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1564
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2196
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1408
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2268
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2324
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1268
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2560
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1844
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2040
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2832
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:852
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2868
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1916
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1588
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:3024
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:336
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2480
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1644
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1124
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:348
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:2160
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  PID:1224
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:928
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\regedit.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\regedit.bat

Filesize
47B

MD5
7912e1992b7d70cec75b206af93d71c0

SHA1
35b235d1a4764e19fa4f37f7a95cd339436a79d0

SHA256
19fb4b62c097917a13ad39e915b661560b0bf4b5578b128b4cb26ad886e5fba5

SHA512
337058d6fab71ec09397849af6ff759b80578186fd19fe8f51fc19a62d19b75b2357566c38d2858e9584ec8e34c82e112c08979a0f8f87466c6c61aa1e0c2f19

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads