Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 06:12
Static task
static1
Behavioral task
behavioral1
Sample
c01ed28282861c64c111d5f7d82d7d59_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
c01ed28282861c64c111d5f7d82d7d59_JaffaCakes118.exe
-
Size
337KB
-
MD5
c01ed28282861c64c111d5f7d82d7d59
-
SHA1
503912d7b071ad737435b4643584c9275d71c660
-
SHA256
ba035935071e8273e8e1a3ca9a1d6760a5729b5f8d6abd8cec203ec9c31f1e3b
-
SHA512
f93551058e41394f86ed47f18981fdf412703ca7bb20296953ba52566995ae08807cb53a4343dba842ad5ab0f8973be6ac9609e2384db33de93c1cb15e8a56c2
-
SSDEEP
6144:jSBLT/md6cavIzW+jT0SPM0OT3v/MjYRAtZ6yTsaMDSjLF:js/S6cH1T0sMDbk8aMymD
Malware Config
Extracted
nanocore
1.2.2.0
185.227.83.51:2019
abujafirms.ddns.net:2019
38bf781e-b7d8-473f-9d3b-d158d61dbf9a
-
activate_away_mode
true
-
backup_connection_host
abujafirms.ddns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2018-01-29T00:57:38.184134936Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
2019
-
default_group
Bestfoods 19
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
38bf781e-b7d8-473f-9d3b-d158d61dbf9a
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
185.227.83.51
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4116 Google.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAS Monitor = "C:\\Program Files (x86)\\NAS Monitor\\nasmon.exe" regasm.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google-Map = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Google-Map.txt | cmd" reg.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA regasm.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4116 set thread context of 2520 4116 Google.exe 93 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\NAS Monitor\nasmon.exe regasm.exe File opened for modification C:\Program Files (x86)\NAS Monitor\nasmon.exe regasm.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c01ed28282861c64c111d5f7d82d7d59_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2520 regasm.exe 2520 regasm.exe 2520 regasm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2520 regasm.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3380 c01ed28282861c64c111d5f7d82d7d59_JaffaCakes118.exe Token: SeDebugPrivilege 4116 Google.exe Token: SeDebugPrivilege 2520 regasm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3380 wrote to memory of 4820 3380 c01ed28282861c64c111d5f7d82d7d59_JaffaCakes118.exe 86 PID 3380 wrote to memory of 4820 3380 c01ed28282861c64c111d5f7d82d7d59_JaffaCakes118.exe 86 PID 3380 wrote to memory of 4820 3380 c01ed28282861c64c111d5f7d82d7d59_JaffaCakes118.exe 86 PID 4820 wrote to memory of 4116 4820 cmd.exe 89 PID 4820 wrote to memory of 4116 4820 cmd.exe 89 PID 4820 wrote to memory of 4116 4820 cmd.exe 89 PID 4116 wrote to memory of 748 4116 Google.exe 90 PID 4116 wrote to memory of 748 4116 Google.exe 90 PID 4116 wrote to memory of 748 4116 Google.exe 90 PID 748 wrote to memory of 2808 748 cmd.exe 92 PID 748 wrote to memory of 2808 748 cmd.exe 92 PID 748 wrote to memory of 2808 748 cmd.exe 92 PID 4116 wrote to memory of 2520 4116 Google.exe 93 PID 4116 wrote to memory of 2520 4116 Google.exe 93 PID 4116 wrote to memory of 2520 4116 Google.exe 93 PID 4116 wrote to memory of 2520 4116 Google.exe 93 PID 4116 wrote to memory of 2520 4116 Google.exe 93 PID 4116 wrote to memory of 2520 4116 Google.exe 93 PID 4116 wrote to memory of 2520 4116 Google.exe 93 PID 4116 wrote to memory of 2520 4116 Google.exe 93 PID 4116 wrote to memory of 3376 4116 Google.exe 94 PID 4116 wrote to memory of 3376 4116 Google.exe 94 PID 4116 wrote to memory of 3376 4116 Google.exe 94 PID 3376 wrote to memory of 3188 3376 cmd.exe 96 PID 3376 wrote to memory of 3188 3376 cmd.exe 96 PID 3376 wrote to memory of 3188 3376 cmd.exe 96 PID 4116 wrote to memory of 2132 4116 Google.exe 100 PID 4116 wrote to memory of 2132 4116 Google.exe 100 PID 4116 wrote to memory of 2132 4116 Google.exe 100 PID 2132 wrote to memory of 1692 2132 cmd.exe 102 PID 2132 wrote to memory of 1692 2132 cmd.exe 102 PID 2132 wrote to memory of 1692 2132 cmd.exe 102 PID 4116 wrote to memory of 852 4116 Google.exe 103 PID 4116 wrote to memory of 852 4116 Google.exe 103 PID 4116 wrote to memory of 852 4116 Google.exe 103 PID 852 wrote to memory of 4952 852 cmd.exe 105 PID 852 wrote to memory of 4952 852 cmd.exe 105 PID 852 wrote to memory of 4952 852 cmd.exe 105 PID 4116 wrote to memory of 2560 4116 Google.exe 106 PID 4116 wrote to memory of 2560 4116 Google.exe 106 PID 4116 wrote to memory of 2560 4116 Google.exe 106 PID 2560 wrote to memory of 4452 2560 cmd.exe 108 PID 2560 wrote to memory of 4452 2560 cmd.exe 108 PID 2560 wrote to memory of 4452 2560 cmd.exe 108 PID 4116 wrote to memory of 3996 4116 Google.exe 112 PID 4116 wrote to memory of 3996 4116 Google.exe 112 PID 4116 wrote to memory of 3996 4116 Google.exe 112 PID 3996 wrote to memory of 1964 3996 cmd.exe 115 PID 3996 wrote to memory of 1964 3996 cmd.exe 115 PID 3996 wrote to memory of 1964 3996 cmd.exe 115 PID 4116 wrote to memory of 2320 4116 Google.exe 116 PID 4116 wrote to memory of 2320 4116 Google.exe 116 PID 4116 wrote to memory of 2320 4116 Google.exe 116 PID 2320 wrote to memory of 4420 2320 cmd.exe 118 PID 2320 wrote to memory of 4420 2320 cmd.exe 118 PID 2320 wrote to memory of 4420 2320 cmd.exe 118 PID 4116 wrote to memory of 4124 4116 Google.exe 120 PID 4116 wrote to memory of 4124 4116 Google.exe 120 PID 4116 wrote to memory of 4124 4116 Google.exe 120 PID 4124 wrote to memory of 4520 4124 cmd.exe 122 PID 4124 wrote to memory of 4520 4124 cmd.exe 122 PID 4124 wrote to memory of 4520 4124 cmd.exe 122 PID 4116 wrote to memory of 4280 4116 Google.exe 125 PID 4116 wrote to memory of 4280 4116 Google.exe 125
Processes
-
C:\Users\Admin\AppData\Local\Temp\c01ed28282861c64c111d5f7d82d7d59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c01ed28282861c64c111d5f7d82d7d59_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\cmd.exe"cmd"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\Pictures\Google.exe"C:\Users\Admin\Pictures\Google.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:2808
-
-
-
C:\Windows\Microsoft.net\Framework\v2.0.50727\regasm.exe"C:\Users\Admin\Pictures\Google.exe"4⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2520
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- System Location Discovery: System Language Discovery
PID:3188
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1692
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4952
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:4452
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1964
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:4420
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:4520
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:4280
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:3924
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:2412 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- System Location Discovery: System Language Discovery
PID:3796
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:672
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2528
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:1464
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:872
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:2184
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:3648
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:1504
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3512
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:1972 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:4864
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:4444
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:5104
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:2800
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵PID:4380
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:2560 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- System Location Discovery: System Language Discovery
PID:1152
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:4240 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:1132
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:2112 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:2420
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:4316 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵PID:2852
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:1756 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:2824
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:1924
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2148
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:3596 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:672
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:5080
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4564
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:3472
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:2792
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:3664
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:3876
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:3224 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:396
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:3048 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:2088
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:3376
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:796
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:4132
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:2560
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:1308
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵PID:4604
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:100 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2680
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:60 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:1892
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:3680 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:1168
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:2528 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:4492
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:672
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5024
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:3312 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:1020
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:4304 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:736
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:4048
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2612
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:2768 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵PID:1576
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:4180 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:208
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:3628
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4372
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:1132
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:4988
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:1972 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:1764
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:3980 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:2416
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:4748
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:212
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:4576
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3504
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:3008 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- System Location Discovery: System Language Discovery
PID:1568
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:4488
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3100
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:872
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3924
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:1168 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3596
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:1376 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:3004
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:2768 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4420
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:2804
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1504
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:2308
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3632
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:2956 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:3852
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:1904
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3504
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:5056 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵PID:1552
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:508
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵PID:2148
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:2412
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵PID:2044
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:4928
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:460
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:2860 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:1064
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:3400
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1128
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:3312
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:4304
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:3100 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4240
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:3376
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:5072
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:4992
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:4548
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:4000 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4784
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:4968
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:1256
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵
- System Location Discovery: System Language Discovery
PID:4692 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1628
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:1616
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:4964
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:4520
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
PID:2804
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"4⤵PID:740
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Google-Map" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Google-Map.txt" | cmd"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:400
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD5cd7e91b74b8c2bb60485364345bd6be5
SHA1a04eb69c5e4bd654ce59db616bd2530ad2c5b452
SHA256ca61e8695a149934c352c3bbf50044ebd1aadd6cdfdf89ac551bf373f88c955a
SHA512142fa89b968887b974c289492ae39a1fdc31e981678877f1b107999bcfefb02832855ed5533edaa59deb7f0e753d0a8a0b292a7bcb217753f85758ada7ab93d6
-
Filesize
337KB
MD5c01ed28282861c64c111d5f7d82d7d59
SHA1503912d7b071ad737435b4643584c9275d71c660
SHA256ba035935071e8273e8e1a3ca9a1d6760a5729b5f8d6abd8cec203ec9c31f1e3b
SHA512f93551058e41394f86ed47f18981fdf412703ca7bb20296953ba52566995ae08807cb53a4343dba842ad5ab0f8973be6ac9609e2384db33de93c1cb15e8a56c2