Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2024, 01:35 UTC

General

  • Target

    eed2b07dc29cacc5efdbcb5c906cc0b7_JaffaCakes118.exe

  • Size

    1.5MB

  • MD5

    eed2b07dc29cacc5efdbcb5c906cc0b7

  • SHA1

    d8726acf98453cedb2d375d41208b75d8cef1bc5

  • SHA256

    b78ee414def93b1da1d1a0deeaf777bdb0592fbebf9e88fc12ced30b0963fb3a

  • SHA512

    e357b5d291a7887375b27bb7fa36d5bb318e3e02eb737a90248cdc497496cdb349dbd4cc892c0b71a7e3df071aa7c23adcf51f72942bb0e561b46aaf2aecc5da

  • SSDEEP

    24576:Uuha75BvTeZJ8NI8kRd3XRon66+6Uvay6V8ezETKwD:biA8kyxn8UETND

Malware Config

Signatures

  • Disables service(s) 3 TTPs
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Blocks application from running via registry modification 17 IoCs

    Adds application to list of disallowed applications.

  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 20 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 31 IoCs
  • Drops file in Windows directory 10 IoCs
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Time Discovery 1 TTPs 6 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

  • Runs net.exe
  • Runs regedit.exe 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eed2b07dc29cacc5efdbcb5c906cc0b7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eed2b07dc29cacc5efdbcb5c906cc0b7_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1908
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Windows\system32\Option.bat
      2⤵
        PID:1976
      • C:\Windows\SysWOW64\net.exe
        net.exe start schedule /y
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1924
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 start schedule /y
          3⤵
            PID:2332
        • C:\Windows\SysWOW64\At.exe
          At.exe 1:38:14 AM C:\Windows\Help\HelpCat.exe
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2844
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c at 1:37:16 AM C:\Windows\Sysinf.bat
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2856
          • C:\Windows\SysWOW64\at.exe
            at 1:37:16 AM C:\Windows\Sysinf.bat
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2308
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c at 1:40:16 AM C:\Windows\Sysinf.bat
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2880
          • C:\Windows\SysWOW64\at.exe
            at 1:40:16 AM C:\Windows\Sysinf.bat
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2744
        • C:\Windows\SysWOW64\net.exe
          net.exe stop wscsvc /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3004
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop wscsvc /y
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2924
        • C:\Windows\SysWOW64\net.exe
          net.exe stop sharedaccess /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2896
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop sharedaccess /y
            3⤵
              PID:2804
          • C:\Windows\SysWOW64\net.exe
            net.exe stop wuauserv /y
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2988
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop wuauserv /y
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2668
          • C:\Windows\SysWOW64\net.exe
            net.exe stop srservice /y
            2⤵
              PID:2772
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop srservice /y
                3⤵
                • System Location Discovery: System Language Discovery
                PID:676
            • C:\Windows\SysWOW64\net.exe
              net.exe stop 360timeprot /y
              2⤵
              • System Location Discovery: System Language Discovery
              • System Time Discovery
              PID:2620
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop 360timeprot /y
                3⤵
                • System Time Discovery
                PID:1472
            • C:\Windows\SysWOW64\sc.exe
              C:\Windows\system32\sc.exe config srservice start= disabled
              2⤵
              • Launches sc.exe
              PID:3064
            • C:\Windows\SysWOW64\sc.exe
              C:\Windows\system32\sc.exe config SharedAccess start= disabled
              2⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:2180
            • C:\Windows\SysWOW64\sc.exe
              C:\Windows\system32\sc.exe config wscsvc start= disabled
              2⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:664
            • C:\Windows\SysWOW64\sc.exe
              C:\Windows\system32\sc.exe config srservice start= disabled
              2⤵
              • Launches sc.exe
              PID:1792
            • C:\Windows\SysWOW64\regedit.exe
              regedit.exe /s C:\Windows\regedt32.sys
              2⤵
              • Modifies visibility of file extensions in Explorer
              • Blocks application from running via registry modification
              • Event Triggered Execution: Image File Execution Options Injection
              • System Location Discovery: System Language Discovery
              • Runs regedit.exe
              PID:2840
            • C:\Windows\SysWOW64\reg.exe
              C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
              2⤵
              • System Location Discovery: System Language Discovery
              PID:780
            • C:\Windows\SysWOW64\reg.exe
              C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
              2⤵
              • System Location Discovery: System Language Discovery
              PID:636
            • C:\Windows\system\KavUpda.exe
              C:\Windows\system\KavUpda.exe
              2⤵
              • Executes dropped EXE
              • Drops autorun.inf file
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:1636
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c C:\Windows\system32\Option.bat
                3⤵
                  PID:2836
                • C:\Windows\SysWOW64\net.exe
                  net.exe start schedule /y
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:1388
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 start schedule /y
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:2940
                • C:\Windows\SysWOW64\At.exe
                  At.exe 1:38:17 AM C:\Windows\Help\HelpCat.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:2948
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c at 1:37:19 AM C:\Windows\Sysinf.bat
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:3048
                  • C:\Windows\SysWOW64\at.exe
                    at 1:37:19 AM C:\Windows\Sysinf.bat
                    4⤵
                      PID:1996
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c at 1:40:19 AM C:\Windows\Sysinf.bat
                    3⤵
                      PID:2112
                      • C:\Windows\SysWOW64\at.exe
                        at 1:40:19 AM C:\Windows\Sysinf.bat
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:800
                    • C:\Windows\SysWOW64\net.exe
                      net.exe stop wscsvc /y
                      3⤵
                        PID:2084
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 stop wscsvc /y
                          4⤵
                            PID:696
                        • C:\Windows\SysWOW64\net.exe
                          net.exe stop sharedaccess /y
                          3⤵
                            PID:2544
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 stop sharedaccess /y
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:356
                          • C:\Windows\SysWOW64\net.exe
                            net.exe stop wuauserv /y
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:2148
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 stop wuauserv /y
                              4⤵
                                PID:1528
                            • C:\Windows\SysWOW64\net.exe
                              net.exe stop srservice /y
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:2708
                              • C:\Windows\SysWOW64\net1.exe
                                C:\Windows\system32\net1 stop srservice /y
                                4⤵
                                  PID:2172
                              • C:\Windows\SysWOW64\net.exe
                                net.exe stop 360timeprot /y
                                3⤵
                                • System Time Discovery
                                PID:1316
                                • C:\Windows\SysWOW64\net1.exe
                                  C:\Windows\system32\net1 stop 360timeprot /y
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  • System Time Discovery
                                  PID:1496
                              • C:\Windows\SysWOW64\sc.exe
                                C:\Windows\system32\sc.exe config srservice start= disabled
                                3⤵
                                • Launches sc.exe
                                • System Location Discovery: System Language Discovery
                                PID:1492
                              • C:\Windows\SysWOW64\sc.exe
                                C:\Windows\system32\sc.exe config SharedAccess start= disabled
                                3⤵
                                • Launches sc.exe
                                • System Location Discovery: System Language Discovery
                                PID:1640
                              • C:\Windows\SysWOW64\sc.exe
                                C:\Windows\system32\sc.exe config wscsvc start= disabled
                                3⤵
                                • Launches sc.exe
                                • System Location Discovery: System Language Discovery
                                PID:1684
                              • C:\Windows\SysWOW64\sc.exe
                                C:\Windows\system32\sc.exe config srservice start= disabled
                                3⤵
                                • Launches sc.exe
                                PID:1796
                              • C:\Windows\SysWOW64\reg.exe
                                C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
                                3⤵
                                  PID:3000
                                • C:\Windows\SysWOW64\reg.exe
                                  C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:1688
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:1652
                                  • C:\Windows\SysWOW64\attrib.exe
                                    attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                    4⤵
                                    • Views/modifies file attributes
                                    PID:1052
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c rmdir F:\Autorun.inf /s /q
                                  3⤵
                                    PID:2492
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:1852
                                    • C:\Windows\SysWOW64\attrib.exe
                                      attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                      4⤵
                                      • Views/modifies file attributes
                                      PID:2724
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd /c rmdir C:\Autorun.inf /s /q
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:1284
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                    3⤵
                                      PID:1244
                                      • C:\Windows\SysWOW64\attrib.exe
                                        attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                        4⤵
                                        • Views/modifies file attributes
                                        PID:2880
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd /c rmdir F:\Autorun.inf /s /q
                                      3⤵
                                        PID:2656
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                        3⤵
                                          PID:596
                                          • C:\Windows\SysWOW64\attrib.exe
                                            attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            • Views/modifies file attributes
                                            PID:1804
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd /c rmdir C:\Autorun.inf /s /q
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:764
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1812
                                          • C:\Windows\SysWOW64\attrib.exe
                                            attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                            4⤵
                                            • Views/modifies file attributes
                                            PID:2100
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd /c rmdir F:\Autorun.inf /s /q
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1196
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                          3⤵
                                            PID:2960
                                            • C:\Windows\SysWOW64\attrib.exe
                                              attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                              4⤵
                                              • System Location Discovery: System Language Discovery
                                              • Views/modifies file attributes
                                              PID:1328
                                          • C:\Windows\SysWOW64\cmd.exe
                                            cmd /c rmdir C:\Autorun.inf /s /q
                                            3⤵
                                              PID:1152
                                            • C:\Windows\SysWOW64\cmd.exe
                                              cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:1048
                                              • C:\Windows\SysWOW64\attrib.exe
                                                attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                4⤵
                                                • System Location Discovery: System Language Discovery
                                                • Views/modifies file attributes
                                                PID:784
                                            • C:\Windows\SysWOW64\cmd.exe
                                              cmd /c rmdir F:\Autorun.inf /s /q
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:2292
                                            • C:\Windows\SysWOW64\cmd.exe
                                              cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:944
                                              • C:\Windows\SysWOW64\attrib.exe
                                                attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                4⤵
                                                • System Location Discovery: System Language Discovery
                                                • Views/modifies file attributes
                                                PID:612
                                            • C:\Windows\SysWOW64\cmd.exe
                                              cmd /c rmdir C:\Autorun.inf /s /q
                                              3⤵
                                                PID:2956
                                              • C:\Windows\SysWOW64\cmd.exe
                                                cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                3⤵
                                                  PID:2148
                                                  • C:\Windows\SysWOW64\attrib.exe
                                                    attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Views/modifies file attributes
                                                    PID:1692
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  cmd /c rmdir F:\Autorun.inf /s /q
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:444
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:3000
                                                  • C:\Windows\SysWOW64\attrib.exe
                                                    attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Views/modifies file attributes
                                                    PID:2288
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  cmd /c rmdir C:\Autorun.inf /s /q
                                                  3⤵
                                                    PID:840
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                    3⤵
                                                      PID:2724
                                                      • C:\Windows\SysWOW64\attrib.exe
                                                        attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                        4⤵
                                                        • Views/modifies file attributes
                                                        PID:2988
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      cmd /c rmdir F:\Autorun.inf /s /q
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:1984
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2620
                                                      • C:\Windows\SysWOW64\attrib.exe
                                                        attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Views/modifies file attributes
                                                        PID:304
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      cmd /c rmdir C:\Autorun.inf /s /q
                                                      3⤵
                                                        PID:3060
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                        3⤵
                                                          PID:2636
                                                          • C:\Windows\SysWOW64\attrib.exe
                                                            attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                            4⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Views/modifies file attributes
                                                            PID:2312
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          cmd /c rmdir F:\Autorun.inf /s /q
                                                          3⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2308
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                          3⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2820
                                                          • C:\Windows\SysWOW64\attrib.exe
                                                            attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                            4⤵
                                                            • Views/modifies file attributes
                                                            PID:2692
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          cmd /c rmdir C:\Autorun.inf /s /q
                                                          3⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2352
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                          3⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2184
                                                          • C:\Windows\SysWOW64\attrib.exe
                                                            attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                            4⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Views/modifies file attributes
                                                            PID:1684
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          cmd /c rmdir F:\Autorun.inf /s /q
                                                          3⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2484
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                          3⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:1372
                                                          • C:\Windows\SysWOW64\attrib.exe
                                                            attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                            4⤵
                                                            • Views/modifies file attributes
                                                            PID:3056
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          cmd /c rmdir C:\Autorun.inf /s /q
                                                          3⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2136
                                                      • C:\Windows\SysWOW64\net.exe
                                                        net.exe stop wscsvc /y
                                                        2⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2096
                                                        • C:\Windows\SysWOW64\net1.exe
                                                          C:\Windows\system32\net1 stop wscsvc /y
                                                          3⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:1156
                                                      • C:\Windows\SysWOW64\net.exe
                                                        net.exe stop sharedaccess /y
                                                        2⤵
                                                          PID:2104
                                                          • C:\Windows\SysWOW64\net1.exe
                                                            C:\Windows\system32\net1 stop sharedaccess /y
                                                            3⤵
                                                              PID:2000
                                                          • C:\Windows\SysWOW64\net.exe
                                                            net.exe stop wuauserv /y
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:584
                                                            • C:\Windows\SysWOW64\net1.exe
                                                              C:\Windows\system32\net1 stop wuauserv /y
                                                              3⤵
                                                                PID:984
                                                            • C:\Windows\SysWOW64\net.exe
                                                              net.exe stop srservice /y
                                                              2⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2116
                                                              • C:\Windows\SysWOW64\net1.exe
                                                                C:\Windows\system32\net1 stop srservice /y
                                                                3⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:2336
                                                            • C:\Windows\SysWOW64\net.exe
                                                              net.exe stop 360timeprot /y
                                                              2⤵
                                                              • System Time Discovery
                                                              PID:1600
                                                              • C:\Windows\SysWOW64\net1.exe
                                                                C:\Windows\system32\net1 stop 360timeprot /y
                                                                3⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • System Time Discovery
                                                                PID:2428
                                                          • C:\Windows\system32\taskeng.exe
                                                            taskeng.exe {76BA0E85-ED19-415C-A95C-22B4C3F45584} S-1-5-18:NT AUTHORITY\System:Service:
                                                            1⤵
                                                              PID:484

                                                            Network

                                                            MITRE ATT&CK Enterprise v15

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • C:\Windows\SysWOW64\Option.bat

                                                              Filesize

                                                              82B

                                                              MD5

                                                              3f7fbd2eb34892646e93fd5e6e343512

                                                              SHA1

                                                              265ac1061b54f62350fb7a5f57e566454d013a66

                                                              SHA256

                                                              e75e8d9bfc7a2876d908305186c3656e9de2a4af7f6927ccc6d8c812645abbc7

                                                              SHA512

                                                              53d40eb2f05a23464fbf06193868e7cb30cf0df3da53586a75123fb2c37b29cdddda287ce134809d16a559d87fb20aee0e8add22d396fcb7a55f9a753739b140

                                                            • C:\Windows\Sysinf.bat

                                                              Filesize

                                                              460B

                                                              MD5

                                                              7db3d565d6ddbe65a8b0e093910e7dcd

                                                              SHA1

                                                              d4804e6180c6e74ba79d3343f2f2ccb15e502f12

                                                              SHA256

                                                              a2778cb87fd88c7508ffd506a8ff8d58d0ffc02156f846956e5e99c6cb3d2f3f

                                                              SHA512

                                                              0b3d1d0f44feba9dd78903ff77fdeaea834d930990a86641fb2e4ce04da280d33f6bee0ae0b1320e4070cbe20824062e45b52e5cad797c5985d8e31dce1ef82b

                                                            • C:\Windows\regedt32.sys

                                                              Filesize

                                                              2KB

                                                              MD5

                                                              e7d7ec66bd61fac3843c98650b0c68f6

                                                              SHA1

                                                              a15ae06e1be51038863650746368a71024539bac

                                                              SHA256

                                                              6475d5ecc14fea090774be55723d2d52b7ec7670527a7dbd61edf28c77944cb8

                                                              SHA512

                                                              ac9e9893f5a0af03957731445f63279085f164e9a968d706a99d13012e4459314a7ccc32dc48f62379d69e21a0953c13543c9ded38b5ad5fbc346aa442af1ae6

                                                            • C:\Windows\system\KavUpda.exe

                                                              Filesize

                                                              1.5MB

                                                              MD5

                                                              eed2b07dc29cacc5efdbcb5c906cc0b7

                                                              SHA1

                                                              d8726acf98453cedb2d375d41208b75d8cef1bc5

                                                              SHA256

                                                              b78ee414def93b1da1d1a0deeaf777bdb0592fbebf9e88fc12ced30b0963fb3a

                                                              SHA512

                                                              e357b5d291a7887375b27bb7fa36d5bb318e3e02eb737a90248cdc497496cdb349dbd4cc892c0b71a7e3df071aa7c23adcf51f72942bb0e561b46aaf2aecc5da

                                                            • F:\Autorun.inf

                                                              Filesize

                                                              237B

                                                              MD5

                                                              94bcd02c5afd5918b4446345e7a5ded9

                                                              SHA1

                                                              79839238e84be225132e1382fae6333dfc4906a1

                                                              SHA256

                                                              5d9f41e4f886926dae2ed8a57807708110d3c6964ab462be21462bff0088d9a1

                                                              SHA512

                                                              149f6bd49fc3b62fa5f41666bfb3a58060514eec1b61c6aa1ac4c75417c840b028e701eb5533460eb00e2fee8543379564bc47d7477264771d81b99a0caab500

                                                            • memory/1908-0-0x0000000000400000-0x0000000000436000-memory.dmp

                                                              Filesize

                                                              216KB

                                                            We care about your privacy.

                                                            This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.