619c4de8ca2ab491a7d2507f336983434c5d003792794aa1cc04719e93b21623

Analysis

max time kernel
132s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe
Size

53KB
MD5

b1cce33ae6c2bb12b0419542130f7b4a
SHA1

4de465ed697f110b01143e1de930ee12b6504656
SHA256

619c4de8ca2ab491a7d2507f336983434c5d003792794aa1cc04719e93b21623
SHA512

359ef30f697c3c6cbea44b0dc3a74f5fc929f28af7d85318e5b8cc367f32a8afb9b9e81d0350e0d007e434200257172503eeaf23cf70aa93002901c5cea63b32
SSDEEP

1536:DISr7PZWFsglcJ4fc4m/b7Cfb7unp9sx0:DF/ZGsgWSSDwip9s6

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe:*:Enabled:Microsoft Windows Update Platform"	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\system32\drivers\etc\hosts	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CmdWindows = "C:\\WINDOWS\\win32cmd.exe"	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 6 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	xcopy.exe
File created	C:\WINDOWS\autorun.inf	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\autorun.inf	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe
File created	F:\autorun.inf	xcopy.exe
File opened for modification	F:\autorun.inf	xcopy.exe
File created	C:\autorun.inf	xcopy.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Progra~1\Skype\Toolbars\Shared\Poker.porno.dll.exe	cmd.exe
File created	C:\Progra~1\Skype\Toolbars\Shared\Porno.game.dll.exe	cmd.exe
File created	C:\Progra~1\Skype\Toolbars\Shared\Skype.hacking.dll.exe	cmd.exe
File created	C:\Progra~1\Skype\Toolbars\Shared\Mini.forsage.dll.exe	cmd.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File created	C:\Windows\win32cmd.exe	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe
File created	C:\Windows\files\ICQ.hacking.exe	cmd.exe
File opened for modification	C:\Windows\files\ICQ.hacking.exe	cmd.exe
File created	C:\Windows\files\invisible_IP.exe	cmd.exe
File created	C:\Windows\files\My.Porno.Video.avi.exe	cmd.exe
File created	C:\WINDOWS\autorun.inf	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\autorun.inf	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe
File created	C:\WINDOWS\system32.vbs	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe
File opened for modification	C:\Windows\files\My.Porno.Video.avi.exe	cmd.exe
File opened for modification	C:\Windows\files\hotmail_hacker.exe	cmd.exe
File created	C:\Windows\files\msn_crack.exe	cmd.exe
File created	C:\Windows\files\Lesbi.Games2.mpg.exe	cmd.exe
File created	C:\Windows\files\hotmail_hacker.exe	cmd.exe
File opened for modification	C:\Windows\files\Russian.Girls.avi.exe	cmd.exe
File opened for modification	C:\Windows\files\msn_crack.exe	cmd.exe
File opened for modification	C:\WINDOWS\win32cmd.exe	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe
File created	C:\Windows\multihosts.exe	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe
File created	C:\Windows\files\Russian.Girls.avi.exe	cmd.exe
File opened for modification	C:\Windows\files\Lesbi.Games.mpg.exe	cmd.exe
File opened for modification	C:\Windows\files\Lesbi.Games2.mpg.exe	cmd.exe
File opened for modification	C:\Windows\files\invisible_IP.exe	cmd.exe
File opened for modification	C:\WINDOWS\system32.vbs	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe
File opened for modification	C:\Windows\win32cmd.exe	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe
File created	C:\Windows\files\Lesbi.Games.mpg.exe	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4304	4496	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 33 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe
4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 5096	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	86
PID 4496 wrote to memory of 5096	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	86
PID 4496 wrote to memory of 5096	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	86
PID 4496 wrote to memory of 4112	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	87
PID 4496 wrote to memory of 4112	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	87
PID 4496 wrote to memory of 4112	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	87
PID 4496 wrote to memory of 3288	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	88
PID 4496 wrote to memory of 3288	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	88
PID 4496 wrote to memory of 3288	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	88
PID 4496 wrote to memory of 2448	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	89
PID 4496 wrote to memory of 2448	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	89
PID 4496 wrote to memory of 2448	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	89
PID 4496 wrote to memory of 3920	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	90
PID 4496 wrote to memory of 3920	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	90
PID 4496 wrote to memory of 3920	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	90
PID 4496 wrote to memory of 3540	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	91
PID 4496 wrote to memory of 3540	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	91
PID 4496 wrote to memory of 3540	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	91
PID 4496 wrote to memory of 4488	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	92
PID 4496 wrote to memory of 4488	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	92
PID 4496 wrote to memory of 4488	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	92
PID 4496 wrote to memory of 224	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	93
PID 4496 wrote to memory of 224	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	93
PID 4496 wrote to memory of 224	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	93
PID 4496 wrote to memory of 3984	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	94
PID 4496 wrote to memory of 3984	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	94
PID 4496 wrote to memory of 3984	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	94
PID 4496 wrote to memory of 2956	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	95
PID 4496 wrote to memory of 2956	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	95
PID 4496 wrote to memory of 2956	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	95
PID 4496 wrote to memory of 3448	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	96
PID 4496 wrote to memory of 3448	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	96
PID 4496 wrote to memory of 3448	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	96
PID 4496 wrote to memory of 4120	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	100
PID 4496 wrote to memory of 4120	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	100
PID 4496 wrote to memory of 4120	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	100
PID 4496 wrote to memory of 1328	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	101
PID 4496 wrote to memory of 1328	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	101
PID 4496 wrote to memory of 1328	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	101
PID 4496 wrote to memory of 3960	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	102
PID 4496 wrote to memory of 3960	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	102
PID 4496 wrote to memory of 3960	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	102
PID 4496 wrote to memory of 4668	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	104
PID 4496 wrote to memory of 4668	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	104
PID 4496 wrote to memory of 4668	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	104
PID 4496 wrote to memory of 4088	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	105
PID 4496 wrote to memory of 4088	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	105
PID 4496 wrote to memory of 4088	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	105
PID 4496 wrote to memory of 4356	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	106
PID 4496 wrote to memory of 4356	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	106
PID 4496 wrote to memory of 4356	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	106
PID 4496 wrote to memory of 880	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	107
PID 4496 wrote to memory of 880	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	107
PID 4496 wrote to memory of 880	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	107
PID 4496 wrote to memory of 2104	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	108
PID 4496 wrote to memory of 2104	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	108
PID 4496 wrote to memory of 2104	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	108
PID 4496 wrote to memory of 4004	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	109
PID 4496 wrote to memory of 4004	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	109
PID 4496 wrote to memory of 4004	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	109
PID 4496 wrote to memory of 1316	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	111
PID 4496 wrote to memory of 1316	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	111
PID 4496 wrote to memory of 1316	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	111
PID 4496 wrote to memory of 4256	4496	b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe	112

C:\Users\Admin\AppData\Local\Temp\b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b1cce33ae6c2bb12b0419542130f7b4a_JaffaCakes118.exe"
1⤵
- Modifies firewall policy service
- Drops file in Drivers directory
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\win32cmd.exe C:\win32cmd.exe
  2⤵
  PID:5096
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    PID:1008
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\win32cmd.exe C:\win32cmd.exe
    3⤵
    - Enumerates system info in registry
    PID:1956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\win32cmd.exe D:\win32cmd.exe
  2⤵
  PID:4112
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    PID:5200
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\win32cmd.exe D:\win32cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:1956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\win32cmd.exe E:\win32cmd.exe
  2⤵
  PID:3288
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4636
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\win32cmd.exe E:\win32cmd.exe
    3⤵
    - Enumerates system info in registry
    PID:5168
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\win32cmd.exe F:\win32cmd.exe
  2⤵
  PID:2448
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3636
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\win32cmd.exe F:\win32cmd.exe
    3⤵
    - Enumerates system info in registry
    PID:4016
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\win32cmd.exe G:\win32cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3920
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5896
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\win32cmd.exe G:\win32cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:5952
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\win32cmd.exe H:\win32cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3540
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    PID:1008
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\win32cmd.exe H:\win32cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:964
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\win32cmd.exe I:\win32cmd.exe
  2⤵
  PID:4488
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5188
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\win32cmd.exe I:\win32cmd.exe
    3⤵
    - Enumerates system info in registry
    PID:5196
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\win32cmd.exe J:\win32cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:224
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:868
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\win32cmd.exe J:\win32cmd.exe
    3⤵
    - Enumerates system info in registry
    PID:3292
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\win32cmd.exe K:\win32cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    PID:5144
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\win32cmd.exe K:\win32cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:2376
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\win32cmd.exe L:\win32cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2956
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    PID:2004
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\win32cmd.exe L:\win32cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:2532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\win32cmd.exe M:\win32cmd.exe
  2⤵
  PID:3448
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5920
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\win32cmd.exe M:\win32cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:5960
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\autorun.inf C:\autorun.inf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4120
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    PID:2028
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\autorun.inf C:\autorun.inf
    3⤵
    - Drops autorun.inf file
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:452
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\autorun.inf D:\autorun.inf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1328
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    PID:5240
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\autorun.inf D:\autorun.inf
    3⤵
    - Enumerates system info in registry
    PID:5248
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\autorun.inf E:\autorun.inf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    PID:5448
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\autorun.inf E:\autorun.inf
    3⤵
    - Enumerates system info in registry
    PID:5468
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\autorun.inf F:\autorun.inf
  2⤵
  PID:4668
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5988
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\autorun.inf F:\autorun.inf
    3⤵
    - Drops autorun.inf file
    - Enumerates system info in registry
    PID:6000
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\autorun.inf G:\autorun.inf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4088
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    PID:6080
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\autorun.inf G:\autorun.inf
    3⤵
    - Enumerates system info in registry
    PID:6088
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\autorun.inf H:\autorun.inf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4356
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6012
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\autorun.inf H:\autorun.inf
    3⤵
    - Enumerates system info in registry
    PID:6020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\autorun.inf I:\autorun.inf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:880
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5480
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\autorun.inf I:\autorun.inf
    3⤵
    - Enumerates system info in registry
    PID:5488
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\autorun.inf J:\autorun.inf
  2⤵
  PID:2104
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5140
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\autorun.inf J:\autorun.inf
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:2960
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\autorun.inf K:\autorun.inf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4004
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5924
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\autorun.inf K:\autorun.inf
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:5936
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\autorun.inf L:\autorun.inf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1316
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5128
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\autorun.inf L:\autorun.inf
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:1548
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\autorun.inf M:\autorun.inf
  2⤵
  PID:4256
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5576
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\autorun.inf M:\autorun.inf
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:5584
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\system32.vbs C:\system32.vbs
  2⤵
  - System Location Discovery: System Language Discovery
  PID:232
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5164
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\system32.vbs C:\system32.vbs
    3⤵
    - Enumerates system info in registry
    PID:224
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\system32.vbs D:\system32.vbs
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3516
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5904
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\system32.vbs D:\system32.vbs
    3⤵
    - Enumerates system info in registry
    PID:5912
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\system32.vbs E:\system32.vbs
  2⤵
  PID:4968
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5520
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\system32.vbs E:\system32.vbs
    3⤵
    - Enumerates system info in registry
    PID:5528
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\system32.vbs F:\system32.vbs
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1532
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    PID:5284
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\system32.vbs F:\system32.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:5292
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\system32.vbs G:\system32.vbs
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4428
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    PID:448
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\system32.vbs G:\system32.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:2532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\system32.vbs H:\system32.vbs
  2⤵
  PID:4808
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    PID:5384
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\system32.vbs H:\system32.vbs
    3⤵
    - Enumerates system info in registry
    PID:5392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\system32.vbs I:\system32.vbs
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4092
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5972
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\system32.vbs I:\system32.vbs
    3⤵
    - Enumerates system info in registry
    PID:5980
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\system32.vbs J:\system32.vbs
  2⤵
  PID:4392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5644
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\system32.vbs J:\system32.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:5656
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\system32.vbs K:\system32.vbs
  2⤵
  PID:4404
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5884
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\system32.vbs K:\system32.vbs
    3⤵
    - Enumerates system info in registry
    PID:5944
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\system32.vbs L:\system32.vbs
  2⤵
  PID:3732
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5608
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\system32.vbs L:\system32.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:5672
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ECHO F |XCOPY.EXE /h %windir%\system32.vbs M:\system32.vbs
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1084
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ECHO F "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5840
- - C:\Windows\SysWOW64\xcopy.exe
    XCOPY.EXE /h C:\Windows\system32.vbs M:\system32.vbs
    3⤵
    - Enumerates system info in registry
    PID:5864
- C:\Windows\SysWOW64\cmd.exe
  cmd /c copy %windir%\multihosts.exe C:\Progra~1\Skype\Toolbars\Shared\Mini.forsage.dll.exe
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:804
- C:\Windows\SysWOW64\cmd.exe
  cmd /c copy %windir%\multihosts.exe C:\Progra~1\Skype\Toolbars\Shared\Porno.game.dll.exe
  2⤵
  - Drops file in Program Files directory
  PID:4268
- C:\Windows\SysWOW64\cmd.exe
  cmd /c copy %windir%\multihosts.exe C:\Progra~1\Skype\Toolbars\Shared\Poker.porno.dll.exe
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:1544
- C:\Windows\SysWOW64\cmd.exe
  cmd /c copy %windir%\multihosts.exe C:\Progra~1\Skype\Toolbars\Shared\Skype.hacking.dll.exe
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2112
- C:\Windows\SysWOW64\cmd.exe
  cmd /c copy %windir%\multihosts.exe C:\shared\ICQ.hacking.exe
  2⤵
  PID:1572
- C:\Windows\SysWOW64\cmd.exe
  cmd /c copy %windir%\multihosts.exe C:\Windows\files\ICQ.hacking.exe
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2108
- C:\Windows\SysWOW64\cmd.exe
  cmd /c copy %windir%\multihosts.exe C:\Windows\files\invisible_IP.exe
  2⤵
  - Drops file in Windows directory
  PID:5056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c copy %windir%\multihosts.exe C:\Windows\files\msn_crack.exe
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:960
- C:\Windows\SysWOW64\cmd.exe
  cmd /c copy %windir%\multihosts.exe C:\Windows\files\hotmail_hacker.exe
  2⤵
  - Drops file in Windows directory
  PID:2280
- C:\Windows\SysWOW64\cmd.exe
  cmd /c copy %windir%\multihosts.exe C:\Windows\files\My.Porno.Video.avi.exe
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1364
- C:\Windows\SysWOW64\cmd.exe
  cmd /c copy %windir%\multihosts.exe C:\Windows\files\Lesbi.Games.mpg.exe
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:884
- C:\Windows\SysWOW64\cmd.exe
  cmd /c copy %windir%\multihosts.exe C:\Windows\files\Lesbi.Games2.mpg.exe
  2⤵
  - Drops file in Windows directory
  PID:4984
- C:\Windows\SysWOW64\cmd.exe
  cmd /c copy %windir%\multihosts.exe C:\Windows\files\Russian.Girls.avi.exe
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 232
  2⤵
  - Program crash
  PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4496 -ip 4496
1⤵
PID:1052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win32cmd.exe

Filesize
53KB

MD5
b1cce33ae6c2bb12b0419542130f7b4a

SHA1
4de465ed697f110b01143e1de930ee12b6504656

SHA256
619c4de8ca2ab491a7d2507f336983434c5d003792794aa1cc04719e93b21623

SHA512
359ef30f697c3c6cbea44b0dc3a74f5fc929f28af7d85318e5b8cc367f32a8afb9b9e81d0350e0d007e434200257172503eeaf23cf70aa93002901c5cea63b32

Download Submit
F:\autorun.inf

Filesize
38B

MD5
5998e8ea224090b1cf5abbb31132d56f

SHA1
e9ef8320a3543240b67ac07be6dcad049178b089

SHA256
3f8c937e116c7abae3e642d77a546dbaa748c8245c734224651ff602701c47b2

SHA512
fc8b95a5803bd719073c09425654e5fc94152b0f001b7b93e44326458229113b3b4b0aec2b2a52b45fd0a34936ca34bd79a9d3339a33b6500a2262956ac96a7b

Download Submit
F:\system32.vbs

Filesize
103B

MD5
bac3f912e3f603cc77d5afb78ee1c8b6

SHA1
247622f9efeab2ec66e88e56b6cd01cce1c1242a

SHA256
f898cc2565ca550af7916569ba790001d2013118b90246ba6c53c78a4795058b

SHA512
95e4752dbb0816313fd6785a5061f55b9adbea49170ac6d3071f473d5936f4d85ac86032dd06be55f9ac89be14490077e4d0c02f52e17bf8d708439d5caf5ac4

Download Submit