Analysis
-
max time kernel
135s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
17-08-2024 19:20
General
-
Target
a3cdde4d17de1505f31cf6df00caf1ad_JaffaCakes118.exe
-
Size
71KB
-
MD5
a3cdde4d17de1505f31cf6df00caf1ad
-
SHA1
2b39f4bf2a70ca0ca57f280cf07c2c835a3663e6
-
SHA256
94a2ec7f9b4a6dca1d1c4f33a2c3bcc6d3f667867c37b03e11f3d07ec78e7f90
-
SHA512
0b7c25e0a3f73aef5bbc369c8f71dbfe5f1f5ec0ad797b5bf53a9034441d7cad6053d3f2b2bfae372cbeaa51016ae7e35ab13d39144087ba7f471f96c63d123a
-
SSDEEP
768:+Lz1vSXs4nsmGEx8wf0jKaH/crbPMZlHSuJKtmG387GUUQB6WDbi6aefhejSXf0P:+Lzws4mExBqEIHTJKESqni6aicSXRK
Score
8/10
Malware Config
Signatures
-
Disables RegEdit via registry modification 51 IoCs
-
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Drops file in Drivers directory 51 IoCs
-
Checks computer location settings 2 TTPs 51 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 64 IoCs
-
Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 51 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 64 IoCs
-
Suspicious use of SetThreadContext 52 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Modifies data under HKEY_USERS 18 IoCs
-
Modifies registry class 51 IoCs
-
Suspicious use of AdjustPrivilegeToken 57 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3cdde4d17de1505f31cf6df00caf1ad_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a3cdde4d17de1505f31cf6df00caf1ad_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a3cdde4d17de1505f31cf6df00caf1ad_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a3cdde4d17de1505f31cf6df00caf1ad_JaffaCakes118.exe"2⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"4⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"6⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"8⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"10⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"12⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"14⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"16⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"18⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"20⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"22⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"24⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"26⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"28⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"30⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"32⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"34⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"36⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"38⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"40⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"42⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"44⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"46⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"48⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"50⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"52⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"54⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"56⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"58⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"60⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"62⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"63⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"64⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"65⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"66⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"67⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"68⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"69⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"70⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"71⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"72⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"73⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"74⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"75⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"76⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"77⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"78⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"79⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"80⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"81⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"82⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"83⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"84⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"85⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"86⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"87⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"88⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"89⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"90⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"91⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"92⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"93⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"94⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"95⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"96⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"97⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"98⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"99⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"100⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"101⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"102⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\system32\symsnreg.exe"103⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\symsnreg.exe"C:\Windows\SysWOW64\symsnreg.exe"104⤵
-
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip101⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com101⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"101⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"101⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul101⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip99⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com99⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"99⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"99⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul99⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip97⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com97⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"97⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"97⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul97⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip95⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com95⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"95⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"95⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul95⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip93⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com93⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"93⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"93⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul93⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip91⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV192⤵
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com91⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"91⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"91⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul91⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip89⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com89⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"89⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"89⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul89⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip87⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com87⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"87⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"87⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul87⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip85⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com85⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"85⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"85⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul85⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip83⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com83⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"83⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"83⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul83⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip81⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com81⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"81⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"81⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul81⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip79⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com79⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"79⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"79⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul79⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip77⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com77⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"77⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"77⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul77⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip75⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com75⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"75⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"75⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul75⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip73⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com73⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"73⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"73⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul73⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip71⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com71⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"71⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"71⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul71⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip69⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com69⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"69⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"69⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul69⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip67⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com67⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"67⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"67⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul67⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip65⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com65⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"65⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"65⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul65⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip63⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com63⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"63⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"63⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul63⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip61⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com61⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"61⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"61⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul61⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip59⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com59⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"59⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"59⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul59⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip57⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com57⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"57⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"57⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul57⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip55⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com55⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"55⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"55⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul55⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip53⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com53⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"53⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"53⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul53⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip51⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com51⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV152⤵
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"51⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"51⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul51⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip49⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com49⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"49⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"49⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul49⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip47⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com47⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"47⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"47⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul47⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip45⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com45⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"45⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"45⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul45⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip43⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com43⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"43⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"43⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul43⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip41⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com41⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"41⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"41⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul41⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip39⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com39⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"39⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"39⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul39⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip37⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com37⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"37⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"37⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul37⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip35⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com35⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"35⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"35⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul35⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip33⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com33⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"33⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"33⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul33⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip31⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com31⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"31⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"31⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul31⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip29⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com29⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"29⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"29⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul29⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip27⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com27⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"27⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"27⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul27⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip25⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com25⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"25⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"25⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul25⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip23⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com23⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"23⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"23⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul23⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip21⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com21⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"21⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"21⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul21⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip19⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com19⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"19⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"19⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul19⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip17⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com17⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"17⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"17⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul17⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip15⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com15⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"15⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"15⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul15⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip13⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com13⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"13⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"13⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul13⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip11⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com11⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"11⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"11⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul11⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip9⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com9⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"9⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"9⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul9⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip7⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com7⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"7⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"7⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul7⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip5⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com5⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"5⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\symsnreg.exe > nul5⤵
-
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.zip3⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q *.com3⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.zip"3⤵
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C del /F /S /Q "%HOMEPATH%\My Documents\My Recieved Files\*.com"3⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A3CDDE~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Impair Defenses
1Safe Mode Boot
1Indicator Removal
1File Deletion
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD5a3cdde4d17de1505f31cf6df00caf1ad
SHA12b39f4bf2a70ca0ca57f280cf07c2c835a3663e6
SHA25694a2ec7f9b4a6dca1d1c4f33a2c3bcc6d3f667867c37b03e11f3d07ec78e7f90
SHA5120b7c25e0a3f73aef5bbc369c8f71dbfe5f1f5ec0ad797b5bf53a9034441d7cad6053d3f2b2bfae372cbeaa51016ae7e35ab13d39144087ba7f471f96c63d123a
-
Filesize
8KB
MD5a7301e28065d05b884ca76c1bb28f716
SHA1d95ffd2c1a3d01d016c6c344e025e206a254af23
SHA256b61f5f810df3304ce4c0c9cd73f5a55e5815f94cd968a398542cd5de0b626e55
SHA512db570978b7264e12648c39c853f6e3697692a7175edcb27f5b268492fb0c0d31b04f4dfa40bc4373e9cddb4d7e771d15512c13f7bf17c91843562c0de71d2d07
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB