metasploit | 472fac578dddaa8cf6c5cae4c56f0a2b0a4a263d932412214d827def7c18d6b2

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2024 06:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
Size

115KB
MD5

c1514cda928c116fc02829b3f6e22a81
SHA1

0a600ad91728d2c0b32eba2ad216af7249d13b90
SHA256

472fac578dddaa8cf6c5cae4c56f0a2b0a4a263d932412214d827def7c18d6b2
SHA512

40fa43101b46574f3bdd0db5e16e1732b4a298df8c8a9af1eede61039c442f955f4a0c256aa33cb044751d15d2a33c43c1b144c727a67a59450d9c0bd35391d5
SSDEEP

3072:nf8wNOO5/bHoUYmxF44UkbZEvoARVeGAaxkjy+:nn5dn4rkWgqVeYxkj

Score

10^/10

metasploit backdoor discovery evasion trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Modifies firewall policy service 3 TTPs 64 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	uninstall_.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\uninstall_.exe = "uninstall_.exe:*:Enabled:SYSTEM"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	uninstall_.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Fonts\uninstall_.exe = "C:\\Windows\\Fonts\\uninstall_.exe:*:enabled:@shell32.dll,-1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	uninstall_.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\uninstall_.exe = "uninstall_.exe:*:Enabled:SYSTEM"	uninstall_.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	uninstall_.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	uninstall_.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	uninstall_.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\uninstall_.exe = "uninstall_.exe:*:Enabled:SYSTEM"	uninstall_.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	uninstall_.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	uninstall_.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Fonts\uninstall_.exe = "C:\\Windows\\Fonts\\uninstall_.exe:*:enabled:@shell32.dll,-1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	uninstall_.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	uninstall_.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	uninstall_.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	uninstall_.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	uninstall_.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	uninstall_.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	uninstall_.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\uninstall_.exe = "uninstall_.exe:*:Enabled:SYSTEM"	uninstall_.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\uninstall_.exe = "uninstall_.exe:*:Enabled:SYSTEM"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	uninstall_.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\uninstall_.exe = "uninstall_.exe:*:Enabled:SYSTEM"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	uninstall_.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	uninstall_.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	uninstall_.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Fonts\uninstall_.exe = "C:\\Windows\\Fonts\\uninstall_.exe:*:enabled:@shell32.dll,-1"	uninstall_.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Fonts\uninstall_.exe = "C:\\Windows\\Fonts\\uninstall_.exe:*:enabled:@shell32.dll,-1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	uninstall_.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\uninstall_.exe = "uninstall_.exe:*:Enabled:SYSTEM"	uninstall_.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	uninstall_.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DoNotAllowExceptions = "0"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	uninstall_.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Fonts\uninstall_.exe = "C:\\Windows\\Fonts\\uninstall_.exe:*:enabled:@shell32.dll,-1"	uninstall_.exe

Windows security bypass 2 TTPs 64 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	uninstall_.exe

Deletes itself 1 IoCs

pid	Process
1756	uninstall_.exe

Executes dropped EXE 43 IoCs

pid	Process
1756	uninstall_.exe
3172	uninstall_.exe
3956	uninstall_.exe
1140	uninstall_.exe
4496	uninstall_.exe
3824	uninstall_.exe
3732	uninstall_.exe
3524	uninstall_.exe
4152	uninstall_.exe
3896	uninstall_.exe
2900	uninstall_.exe
3084	uninstall_.exe
812	uninstall_.exe
868	uninstall_.exe
1164	uninstall_.exe
4356	uninstall_.exe
1876	uninstall_.exe
2708	uninstall_.exe
4620	uninstall_.exe
928	uninstall_.exe
2104	uninstall_.exe
4472	uninstall_.exe
4788	uninstall_.exe
1520	uninstall_.exe
3464	uninstall_.exe
2348	uninstall_.exe
4972	uninstall_.exe
3288	uninstall_.exe
780	uninstall_.exe
1068	uninstall_.exe
3176	uninstall_.exe
4892	uninstall_.exe
2460	uninstall_.exe
1052	uninstall_.exe
2636	uninstall_.exe
1484	uninstall_.exe
1128	uninstall_.exe
3324	uninstall_.exe
2372	uninstall_.exe
864	uninstall_.exe
4196	uninstall_.exe
2780	uninstall_.exe
2324	uninstall_.exe

Windows security modification 2 TTPs 64 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uninstall_.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\SysWOW64\NETSH.EXE	uninstall_.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\uninstall_.exe	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
File opened for modification	C:\Windows\Fonts\uninstall_.exe	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 44 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	uninstall_.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	uninstall_.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	uninstall_.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MaxConnectionsPer1_0Server = "65534"	uninstall_.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	uninstall_.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	uninstall_.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MaxConnectionsPerServer = "65534"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	uninstall_.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	uninstall_.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	uninstall_.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	uninstall_.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MaxConnectionsPerServer = "65534"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	uninstall_.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MaxConnectionsPerServer = "65534"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	uninstall_.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	uninstall_.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MaxConnectionsPer1_0Server = "65534"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MaxConnectionsPerServer = "65534"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	uninstall_.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MaxConnectionsPer1_0Server = "65534"	uninstall_.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MaxConnectionsPerServer = "65534"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MaxConnectionsPer1_0Server = "65534"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	uninstall_.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MaxConnectionsPerServer = "65534"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	uninstall_.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	uninstall_.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	uninstall_.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	uninstall_.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1756	uninstall_.exe
1756	uninstall_.exe
3172	uninstall_.exe
3172	uninstall_.exe
3956	uninstall_.exe
3956	uninstall_.exe
1140	uninstall_.exe
1140	uninstall_.exe
4496	uninstall_.exe
4496	uninstall_.exe
3824	uninstall_.exe
3824	uninstall_.exe
3732	uninstall_.exe
3732	uninstall_.exe
3524	uninstall_.exe
3524	uninstall_.exe
4152	uninstall_.exe
4152	uninstall_.exe
3896	uninstall_.exe
3896	uninstall_.exe
2900	uninstall_.exe
2900	uninstall_.exe
3084	uninstall_.exe
3084	uninstall_.exe
812	uninstall_.exe
812	uninstall_.exe
868	uninstall_.exe
868	uninstall_.exe
1164	uninstall_.exe
1164	uninstall_.exe
4356	uninstall_.exe
4356	uninstall_.exe
1876	uninstall_.exe
1876	uninstall_.exe
2708	uninstall_.exe
2708	uninstall_.exe
4620	uninstall_.exe
4620	uninstall_.exe
2104	uninstall_.exe
2104	uninstall_.exe
4472	uninstall_.exe
4472	uninstall_.exe
4788	uninstall_.exe
4788	uninstall_.exe
1520	uninstall_.exe
1520	uninstall_.exe
3464	uninstall_.exe
3464	uninstall_.exe
2348	uninstall_.exe
2348	uninstall_.exe
4972	uninstall_.exe
4972	uninstall_.exe
3288	uninstall_.exe
3288	uninstall_.exe
780	uninstall_.exe
780	uninstall_.exe
1068	uninstall_.exe
1068	uninstall_.exe
3176	uninstall_.exe
3176	uninstall_.exe
4892	uninstall_.exe
4892	uninstall_.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
Token: 33	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
Token: SeDebugPrivilege	1756	uninstall_.exe
Token: 33	1756	uninstall_.exe
Token: SeIncBasePriorityPrivilege	1756	uninstall_.exe
Token: SeBackupPrivilege	1756	uninstall_.exe
Token: SeSecurityPrivilege	1756	uninstall_.exe
Token: SeSecurityPrivilege	1756	uninstall_.exe
Token: SeBackupPrivilege	1756	uninstall_.exe
Token: SeSecurityPrivilege	1756	uninstall_.exe
Token: SeBackupPrivilege	1756	uninstall_.exe
Token: SeSecurityPrivilege	1756	uninstall_.exe
Token: SeTakeOwnershipPrivilege	1756	uninstall_.exe
Token: SeRestorePrivilege	1756	uninstall_.exe
Token: SeBackupPrivilege	1756	uninstall_.exe
Token: SeChangeNotifyPrivilege	1756	uninstall_.exe
Token: SeDebugPrivilege	3172	uninstall_.exe
Token: 33	3172	uninstall_.exe
Token: SeIncBasePriorityPrivilege	3172	uninstall_.exe
Token: SeBackupPrivilege	3172	uninstall_.exe
Token: SeSecurityPrivilege	3172	uninstall_.exe
Token: SeSecurityPrivilege	3172	uninstall_.exe
Token: SeBackupPrivilege	3172	uninstall_.exe
Token: SeSecurityPrivilege	3172	uninstall_.exe
Token: SeBackupPrivilege	3172	uninstall_.exe
Token: SeSecurityPrivilege	3172	uninstall_.exe
Token: SeDebugPrivilege	3956	uninstall_.exe
Token: 33	3956	uninstall_.exe
Token: SeIncBasePriorityPrivilege	3956	uninstall_.exe
Token: SeBackupPrivilege	3956	uninstall_.exe
Token: SeSecurityPrivilege	3956	uninstall_.exe
Token: SeSecurityPrivilege	3956	uninstall_.exe
Token: SeBackupPrivilege	3956	uninstall_.exe
Token: SeSecurityPrivilege	3956	uninstall_.exe
Token: SeBackupPrivilege	3956	uninstall_.exe
Token: SeSecurityPrivilege	3956	uninstall_.exe
Token: SeDebugPrivilege	1140	uninstall_.exe
Token: 33	1140	uninstall_.exe
Token: SeIncBasePriorityPrivilege	1140	uninstall_.exe
Token: SeBackupPrivilege	1140	uninstall_.exe
Token: SeSecurityPrivilege	1140	uninstall_.exe
Token: SeSecurityPrivilege	1140	uninstall_.exe
Token: SeBackupPrivilege	1140	uninstall_.exe
Token: SeSecurityPrivilege	1140	uninstall_.exe
Token: SeBackupPrivilege	1140	uninstall_.exe
Token: SeSecurityPrivilege	1140	uninstall_.exe
Token: SeDebugPrivilege	4496	uninstall_.exe
Token: 33	4496	uninstall_.exe
Token: SeIncBasePriorityPrivilege	4496	uninstall_.exe
Token: SeBackupPrivilege	4496	uninstall_.exe
Token: SeSecurityPrivilege	4496	uninstall_.exe
Token: SeSecurityPrivilege	4496	uninstall_.exe
Token: SeBackupPrivilege	4496	uninstall_.exe
Token: SeSecurityPrivilege	4496	uninstall_.exe
Token: SeBackupPrivilege	4496	uninstall_.exe
Token: SeSecurityPrivilege	4496	uninstall_.exe
Token: SeDebugPrivilege	3824	uninstall_.exe
Token: 33	3824	uninstall_.exe
Token: SeIncBasePriorityPrivilege	3824	uninstall_.exe
Token: SeBackupPrivilege	3824	uninstall_.exe
Token: SeSecurityPrivilege	3824	uninstall_.exe
Token: SeSecurityPrivilege	3824	uninstall_.exe
Token: SeBackupPrivilege	3824	uninstall_.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 616	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	5
PID 1520 wrote to memory of 616	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	5
PID 1520 wrote to memory of 616	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	5
PID 1520 wrote to memory of 616	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	5
PID 1520 wrote to memory of 616	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	5
PID 1520 wrote to memory of 616	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	5
PID 1520 wrote to memory of 676	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	7
PID 1520 wrote to memory of 676	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	7
PID 1520 wrote to memory of 676	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	7
PID 1520 wrote to memory of 676	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	7
PID 1520 wrote to memory of 676	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	7
PID 1520 wrote to memory of 676	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	7
PID 1520 wrote to memory of 788	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	8
PID 1520 wrote to memory of 788	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	8
PID 1520 wrote to memory of 788	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	8
PID 1520 wrote to memory of 788	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	8
PID 1520 wrote to memory of 788	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	8
PID 1520 wrote to memory of 788	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	8
PID 1520 wrote to memory of 796	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	9
PID 1520 wrote to memory of 796	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	9
PID 1520 wrote to memory of 796	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	9
PID 1520 wrote to memory of 796	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	9
PID 1520 wrote to memory of 796	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	9
PID 1520 wrote to memory of 796	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	9
PID 1520 wrote to memory of 804	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	10
PID 1520 wrote to memory of 804	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	10
PID 1520 wrote to memory of 804	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	10
PID 1520 wrote to memory of 804	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	10
PID 1520 wrote to memory of 804	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	10
PID 1520 wrote to memory of 804	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	10
PID 1520 wrote to memory of 908	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	11
PID 1520 wrote to memory of 908	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	11
PID 1520 wrote to memory of 908	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	11
PID 1520 wrote to memory of 908	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	11
PID 1520 wrote to memory of 908	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	11
PID 1520 wrote to memory of 908	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	11
PID 1520 wrote to memory of 960	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	12
PID 1520 wrote to memory of 960	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	12
PID 1520 wrote to memory of 960	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	12
PID 1520 wrote to memory of 960	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	12
PID 1520 wrote to memory of 960	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	12
PID 1520 wrote to memory of 960	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	12
PID 1520 wrote to memory of 336	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	13
PID 1520 wrote to memory of 336	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	13
PID 1520 wrote to memory of 336	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	13
PID 1520 wrote to memory of 336	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	13
PID 1520 wrote to memory of 336	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	13
PID 1520 wrote to memory of 336	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	13
PID 1520 wrote to memory of 468	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	14
PID 1520 wrote to memory of 468	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	14
PID 1520 wrote to memory of 468	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	14
PID 1520 wrote to memory of 468	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	14
PID 1520 wrote to memory of 468	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	14
PID 1520 wrote to memory of 468	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	14
PID 1520 wrote to memory of 1004	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	15
PID 1520 wrote to memory of 1004	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	15
PID 1520 wrote to memory of 1004	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	15
PID 1520 wrote to memory of 1004	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	15
PID 1520 wrote to memory of 1004	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	15
PID 1520 wrote to memory of 1004	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	15
PID 1520 wrote to memory of 1032	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	16
PID 1520 wrote to memory of 1032	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	16
PID 1520 wrote to memory of 1032	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	16
PID 1520 wrote to memory of 1032	1520	c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe	16

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:796
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:336

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:804
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:3096
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3828
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3924
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4012
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:2956
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3716
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:920
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:2024
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:4032
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:2668
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
  2⤵
  PID:2324
- C:\Windows\System32\mousocoreworker.exe
  C:\Windows\System32\mousocoreworker.exe -Embedding
  2⤵
  PID:1472
- C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
  C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
  2⤵
  PID:2992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:468

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1188
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2848
- C:\Windows\system32\MusNotification.exe
  C:\Windows\system32\MusNotification.exe
  2⤵
  PID:208

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1460
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1880

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1664

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2108

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2204

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2732

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3444

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3532
- C:\Users\Admin\AppData\Local\Temp\c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c1514cda928c116fc02829b3f6e22a81_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:716

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2500

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:3312

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1756

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 98476fcc82135db6bbb5401e5e0cc711 fIK50KVngUOuyMvbEtpGYA.0.1.0.0.0
1⤵
PID:4896
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:4984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:2080

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3172

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:4296

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:400

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1140

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4496

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3824

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3732

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3524

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4152

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3896

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2900

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3084

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:812

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:868

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1164

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4356

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1876

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2708

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4620

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:928

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2104

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4472

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Windows security bypass
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4788

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1520

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3464

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2348

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4972

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3288

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:780

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1068

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3176

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4892

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2460

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1052

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2636

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
PID:1484

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1128

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3324

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2372

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Windows security bypass
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:864

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4196

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2780

C:\Windows\Fonts\uninstall_.exe
"C:\Windows\Fonts\uninstall_.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Fonts\uninstall_.exe

Filesize
115KB

MD5
c1514cda928c116fc02829b3f6e22a81

SHA1
0a600ad91728d2c0b32eba2ad216af7249d13b90

SHA256
472fac578dddaa8cf6c5cae4c56f0a2b0a4a263d932412214d827def7c18d6b2

SHA512
40fa43101b46574f3bdd0db5e16e1732b4a298df8c8a9af1eede61039c442f955f4a0c256aa33cb044751d15d2a33c43c1b144c727a67a59450d9c0bd35391d5

Download Submit
memory/812-109-0x0000000000400000-0x000000000089BFFF-memory.dmp

Filesize
4.6MB

Download
memory/868-117-0x0000000000400000-0x000000000089BFFF-memory.dmp

Filesize
4.6MB

Download
memory/928-167-0x0000000000400000-0x000000000089BFFF-memory.dmp

Filesize
4.6MB

Download
memory/1140-33-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/1140-34-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/1140-35-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/1140-39-0x0000000000400000-0x000000000089BFFF-memory.dmp

Filesize
4.6MB

Download
memory/1140-36-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/1164-126-0x0000000000400000-0x000000000089BFFF-memory.dmp

Filesize
4.6MB

Download
memory/1520-1-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/1520-3-0x0000000077583000-0x0000000077584000-memory.dmp

Filesize
4KB

Download
memory/1520-14-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Filesize
48KB

Download
memory/1520-18-0x0000000000400000-0x000000000089BFFF-memory.dmp

Filesize
4.6MB

Download
memory/1520-0-0x0000000000400000-0x000000000089BFFF-memory.dmp

Filesize
4.6MB

Download
memory/1520-2-0x0000000077582000-0x0000000077583000-memory.dmp

Filesize
4KB

Download
memory/1520-13-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Filesize
48KB

Download
memory/1520-12-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Filesize
48KB

Download
memory/1520-5-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/1520-4-0x00000000026F0000-0x00000000026F2000-memory.dmp

Filesize
8KB

Download
memory/1520-16-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/1756-19-0x0000000000400000-0x000000000089BFFF-memory.dmp

Filesize
4.6MB

Download
memory/1756-11-0x0000000000400000-0x000000000089BFFF-memory.dmp

Filesize
4.6MB

Download
memory/1876-145-0x0000000000400000-0x000000000089BFFF-memory.dmp

Filesize
4.6MB

Download
memory/2708-152-0x0000000000400000-0x000000000089BFFF-memory.dmp

Filesize
4.6MB

Download
memory/2900-93-0x0000000000400000-0x000000000089BFFF-memory.dmp

Filesize
4.6MB

Download
memory/2900-87-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/3084-102-0x0000000000400000-0x000000000089BFFF-memory.dmp

Filesize
4.6MB

Download
memory/3172-22-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/3172-23-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/3172-21-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/3172-25-0x0000000000400000-0x000000000089BFFF-memory.dmp

Filesize
4.6MB

Download
memory/3524-67-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/3524-72-0x0000000000400000-0x000000000089BFFF-memory.dmp

Filesize
4.6MB

Download
memory/3524-69-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/3524-68-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/3524-66-0x0000000000400000-0x000000000089BFFF-memory.dmp

Filesize
4.6MB

Download
memory/3732-57-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/3732-58-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/3732-64-0x0000000000400000-0x000000000089BFFF-memory.dmp

Filesize
4.6MB

Download
memory/3732-60-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/3732-61-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/3824-50-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/3824-55-0x0000000000400000-0x000000000089BFFF-memory.dmp

Filesize
4.6MB

Download
memory/3824-52-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/3824-51-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/3824-49-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/3896-83-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/3896-80-0x0000000000400000-0x000000000089BFFF-memory.dmp

Filesize
4.6MB

Download
memory/3896-82-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/3896-81-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/3896-85-0x0000000000400000-0x000000000089BFFF-memory.dmp

Filesize
4.6MB

Download
memory/3956-27-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/3956-28-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/3956-31-0x0000000000400000-0x000000000089BFFF-memory.dmp

Filesize
4.6MB

Download
memory/3956-30-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/4152-75-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/4152-78-0x0000000000400000-0x000000000089BFFF-memory.dmp

Filesize
4.6MB

Download
memory/4152-76-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/4152-74-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/4356-136-0x0000000000400000-0x000000000089BFFF-memory.dmp

Filesize
4.6MB

Download
memory/4496-45-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/4496-44-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/4496-43-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/4496-42-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/4496-41-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/4496-47-0x0000000000400000-0x000000000089BFFF-memory.dmp

Filesize
4.6MB

Download
memory/4620-160-0x0000000000400000-0x000000000089BFFF-memory.dmp

Filesize
4.6MB

Download