Analysis
- max time kernel
111s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
04/01/2025, 03:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe
Resource
win7-20240903-en
windows7-x64
33 signatures
150 seconds
General
- Target JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe
- Size 655KB
- Sample250104-d71ehszjf1
- SHA256 88b5032a6bd8cd331d31f2315b0f2636f0cb4be330f6b7972874144b3468ab9c
- MD5 776698a8c0cb8acc387d55f7eb4bd074
- SHA1 50ed8d16c40f54875db047bd34767ccdae0f45a1
- SHA512 228d4128c1412f038892f8e552865f6a29c0986f5a619da7f0b4766e269d89cc9947ec33fd6ce4e91566cf319975a4217ed84a03bb2cdad388449a0b8e0c4dc5
- SSDEEP 12288:/ESqJwbBEE+tOirc2xwlqXs4zUmvycM6xgNyJ6DsZuhEP60dIIFazZyun23:/EdYj+jrc21lz/VnxgAJxuOCciZzE
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Cycbot family
- Detects Cycbot payload 6 IoCs
Cycbot is a backdoor and trojan written in C++.
resource yara_rule behavioral2/memory/1132-86-0x0000000000400000-0x0000000000469000-memory.dmp family_cycbot behavioral2/memory/4504-92-0x0000000000400000-0x0000000000469000-memory.dmp family_cycbot behavioral2/memory/1652-162-0x0000000000400000-0x0000000000469000-memory.dmp family_cycbot behavioral2/memory/4504-164-0x0000000000400000-0x0000000000469000-memory.dmp family_cycbot behavioral2/memory/4504-247-0x0000000000400000-0x0000000000469000-memory.dmp family_cycbot behavioral2/memory/4504-301-0x0000000000400000-0x0000000000469000-memory.dmp family_cycbot - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "3" behost.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" R07924.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qeuer.exe - Pony family
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 9 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Disables taskbar notifications via registry modification
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation R07924.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe - Executes dropped EXE 9 IoCs
pid Process 2008 R07924.exe 3756 qeuer.exe 3376 aehost.exe 4504 behost.exe 1608 cehost.exe 3644 dehost.exe 1132 behost.exe 1652 behost.exe 2312 947B.tmp - Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /h" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /c" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /U" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /k" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /b" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /T" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /Y" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /F" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /I" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /K" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /q" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /i" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /o" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /Q" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /S" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /A" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /E" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /P" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /N" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /l" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /G" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /u" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /d" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /Z" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /J" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /C" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /e" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /B" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /w" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /W" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /r" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /t" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /v" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /O" qeuer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\E51.exe = "C:\\Program Files (x86)\\LP\\D3AC\\E51.exe" behost.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /L" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /p" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /a" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /f" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /X" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /y" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /m" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /s" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /R" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /n" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /H" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /D" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /j" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /r" R07924.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /V" qeuer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeuer = "C:\\Users\\Admin\\qeuer.exe /M" qeuer.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 18 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe - Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 3292 tasklist.exe 3620 tasklist.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3508 set thread context of 4732 3508 JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe 82 PID 1608 set thread context of 4356 1608 cehost.exe 103 -
resource yara_rule behavioral2/memory/4732-1-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4732-4-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4732-0-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4732-7-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4732-6-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4732-53-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/1132-86-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral2/memory/4504-92-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral2/memory/1652-162-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral2/memory/4504-164-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral2/memory/4504-247-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral2/memory/4732-287-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4504-301-0x0000000000400000-0x0000000000469000-memory.dmp upx - Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\LP\D3AC\E51.exe behost.exe File opened for modification C:\Program Files (x86)\LP\D3AC\947B.tmp behost.exe File opened for modification C:\Program Files (x86)\LP\D3AC\E51.exe behost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aehost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language behost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 947B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language R07924.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qeuer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dehost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cehost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4050598569-1597076380-177084960-1000\{29F757D4-4B94-4EB8-808F-524A59E7C3C5} explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4050598569-1597076380-177084960-1000\{7D2BF9A8-C7DF-4DA1-A828-76926CB0B19C} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4050598569-1597076380-177084960-1000\{FE68A205-4418-4962-ABFE-8BC1388CF9B1} explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4050598569-1597076380-177084960-1000\{19E4FF67-8820-4D0A-9873-C8B92909153D} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4050598569-1597076380-177084960-1000\{F8AC3526-68AC-4F26-9F46-F21612D74895} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4050598569-1597076380-177084960-1000\{AB8AB17B-9B48-41C7-937A-7DC80A3FD6E9} explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4050598569-1597076380-177084960-1000\{2EEC41AC-9525-46B6-BDC4-EB003576AF7A} explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2008 R07924.exe 2008 R07924.exe 2008 R07924.exe 2008 R07924.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe 3756 qeuer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3292 tasklist.exe Token: SeSecurityPrivilege 2164 msiexec.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeDebugPrivilege 3620 tasklist.exe Token: SeShutdownPrivilege 3740 explorer.exe Token: SeCreatePagefilePrivilege 3740 explorer.exe Token: SeShutdownPrivilege 3740 explorer.exe Token: SeCreatePagefilePrivilege 3740 explorer.exe Token: SeShutdownPrivilege 3740 explorer.exe Token: SeCreatePagefilePrivilege 3740 explorer.exe Token: SeShutdownPrivilege 3740 explorer.exe Token: SeCreatePagefilePrivilege 3740 explorer.exe Token: SeShutdownPrivilege 3740 explorer.exe Token: SeCreatePagefilePrivilege 3740 explorer.exe Token: SeShutdownPrivilege 3740 explorer.exe Token: SeCreatePagefilePrivilege 3740 explorer.exe Token: SeShutdownPrivilege 3740 explorer.exe Token: SeCreatePagefilePrivilege 3740 explorer.exe Token: SeShutdownPrivilege 3740 explorer.exe Token: SeCreatePagefilePrivilege 3740 explorer.exe Token: SeShutdownPrivilege 3740 explorer.exe Token: SeCreatePagefilePrivilege 3740 explorer.exe Token: SeShutdownPrivilege 3740 explorer.exe Token: SeCreatePagefilePrivilege 3740 explorer.exe Token: SeShutdownPrivilege 3740 explorer.exe Token: SeCreatePagefilePrivilege 3740 explorer.exe Token: SeShutdownPrivilege 3740 explorer.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 3348 explorer.exe 3348 explorer.exe 3348 explorer.exe 3348 explorer.exe 3348 explorer.exe 3348 explorer.exe 3348 explorer.exe 3348 explorer.exe 3348 explorer.exe 3348 explorer.exe 3348 explorer.exe 3348 explorer.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 3740 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 4236 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 3348 explorer.exe 3348 explorer.exe 3348 explorer.exe 3348 explorer.exe 3348 explorer.exe 3348 explorer.exe 3348 explorer.exe 3348 explorer.exe 3348 explorer.exe 3348 explorer.exe 3348 explorer.exe 3348 explorer.exe 3348 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4732 JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe 2008 R07924.exe 3756 qeuer.exe 3644 dehost.exe 4476 StartMenuExperienceHost.exe 4300 StartMenuExperienceHost.exe 3532 StartMenuExperienceHost.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3508 wrote to memory of 4732 3508 JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe 82 PID 3508 wrote to memory of 4732 3508 JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe 82 PID 3508 wrote to memory of 4732 3508 JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe 82 PID 3508 wrote to memory of 4732 3508 JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe 82 PID 3508 wrote to memory of 4732 3508 JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe 82 PID 3508 wrote to memory of 4732 3508 JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe 82 PID 3508 wrote to memory of 4732 3508 JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe 82 PID 3508 wrote to memory of 4732 3508 JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe 82 PID 4732 wrote to memory of 2008 4732 JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe 83 PID 4732 wrote to memory of 2008 4732 JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe 83 PID 4732 wrote to memory of 2008 4732 JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe 83 PID 2008 wrote to memory of 3756 2008 R07924.exe 88 PID 2008 wrote to memory of 3756 2008 R07924.exe 88 PID 2008 wrote to memory of 3756 2008 R07924.exe 88 PID 2008 wrote to memory of 3100 2008 R07924.exe 89 PID 2008 wrote to memory of 3100 2008 R07924.exe 89 PID 2008 wrote to memory of 3100 2008 R07924.exe 89 PID 3100 wrote to memory of 3292 3100 cmd.exe 91 PID 3100 wrote to memory of 3292 3100 cmd.exe 91 PID 3100 wrote to memory of 3292 3100 cmd.exe 91 PID 4732 wrote to memory of 3376 4732 JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe 92 PID 4732 wrote to memory of 3376 4732 JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe 92 PID 4732 wrote to memory of 3376 4732 JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe 92 PID 4732 wrote to memory of 4504 4732 JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe 98 PID 4732 wrote to memory of 4504 4732 JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe 98 PID 4732 wrote to memory of 4504 4732 JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe 98 PID 4732 wrote to memory of 1608 4732 JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe 102 PID 4732 wrote to memory of 1608 4732 JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe 102 PID 4732 wrote to memory of 1608 4732 JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe 102 PID 1608 wrote to memory of 4356 1608 cehost.exe 103 PID 1608 wrote to memory of 4356 1608 cehost.exe 103 PID 1608 wrote to memory of 4356 1608 cehost.exe 103 PID 4732 wrote to memory of 3644 4732 JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe 104 PID 4732 wrote to memory of 3644 4732 JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe 104 PID 4732 wrote to memory of 3644 4732 JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe 104 PID 4504 wrote to memory of 1132 4504 behost.exe 105 PID 4504 wrote to memory of 1132 4504 behost.exe 105 PID 4504 wrote to memory of 1132 4504 behost.exe 105 PID 4504 wrote to memory of 1652 4504 behost.exe 106 PID 4504 wrote to memory of 1652 4504 behost.exe 106 PID 4504 wrote to memory of 1652 4504 behost.exe 106 PID 4504 wrote to memory of 2312 4504 behost.exe 107 PID 4504 wrote to memory of 2312 4504 behost.exe 107 PID 4504 wrote to memory of 2312 4504 behost.exe 107 PID 4732 wrote to memory of 2664 4732 JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe 112 PID 4732 wrote to memory of 2664 4732 JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe 112 PID 4732 wrote to memory of 2664 4732 JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe 112 PID 2664 wrote to memory of 3620 2664 cmd.exe 114 PID 2664 wrote to memory of 3620 2664 cmd.exe 114 PID 2664 wrote to memory of 3620 2664 cmd.exe 114 PID 3756 wrote to memory of 3620 3756 qeuer.exe 114 PID 3756 wrote to memory of 3620 3756 qeuer.exe 114 PID 3756 wrote to memory of 3620 3756 qeuer.exe 114 PID 3756 wrote to memory of 3620 3756 qeuer.exe 114 PID 3756 wrote to memory of 3620 3756 qeuer.exe 114 PID 3756 wrote to memory of 3620 3756 qeuer.exe 114 PID 3756 wrote to memory of 3620 3756 qeuer.exe 114 PID 3756 wrote to memory of 3620 3756 qeuer.exe 114 PID 3756 wrote to memory of 3620 3756 qeuer.exe 114 PID 3756 wrote to memory of 3620 3756 qeuer.exe 114 PID 3756 wrote to memory of 3620 3756 qeuer.exe 114 PID 3756 wrote to memory of 3620 3756 qeuer.exe 114 PID 3756 wrote to memory of 3620 3756 qeuer.exe 114 PID 3756 wrote to memory of 3620 3756 qeuer.exe 114 - System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer behost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" behost.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exeJaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\R07924.exeC:\Users\Admin\R07924.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\qeuer.exe"C:\Users\Admin\qeuer.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3756
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del R07924.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3292
-
-
-
-
C:\Users\Admin\aehost.exeC:\Users\Admin\aehost.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3376
-
-
C:\Users\Admin\behost.exeC:\Users\Admin\behost.exe3⤵
- Modifies security service
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4504 -
C:\Users\Admin\behost.exeC:\Users\Admin\behost.exe startC:\Users\Admin\AppData\Roaming\CB3D3\8EED3.exe%C:\Users\Admin\AppData\Roaming\CB3D34⤵
- Executes dropped EXE
PID:1132
-
-
C:\Users\Admin\behost.exeC:\Users\Admin\behost.exe startC:\Program Files (x86)\D32EF\lvvm.exe%C:\Program Files (x86)\D32EF4⤵
- Executes dropped EXE
PID:1652
-
-
C:\Program Files (x86)\LP\D3AC\947B.tmp"C:\Program Files (x86)\LP\D3AC\947B.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2312
-
-
-
C:\Users\Admin\cehost.exeC:\Users\Admin\cehost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\explorer.exe00000208*4⤵PID:4356
-
-
-
C:\Users\Admin\dehost.exeC:\Users\Admin\dehost.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3644
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del JaffaCakes118_776698a8c0cb8acc387d55f7eb4bd074.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3620
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2164
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3712
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4476
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3740
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4300
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4236
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1504
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3348
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3532
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:4312
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:5008
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:4840
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:2968
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:468
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3312
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4724
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2540
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4164
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4412
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:432
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4664
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2320
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1724
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2668
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1016
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4716
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1504
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3708
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
5Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\LP\D3AC\947B.tmp
- Size 104KB
- SHA256 50a9af2fe05dd06d6ff825bcf2106b64385e7fdf9a06a0a18ac187c4a057503a
- MD5 0cb09d0443d2eda312058ae1a2fa83c2
- SHA1 1888844fcab4269a5c08b5cf122b100e8abb3cb0
- SHA512 93bfdc4d14a7ba7cce25d0a83faa29e0efa7932f3024aa82fcc1d606cb9a65e0ebd91942ad9992ce787f639df1748fde9599cb9b676245a17a8198064df2e24c
- SSDEEP 1536:aiNoPz/GlMJZBe1E+OOYBw6IyIuI+KVHt7+Rw/uCH9zvw8WoEWMARz4cYNOO:4zFBIEVJa6IyIbr37+ROuBtoRT1u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
- Size 471B
- SHA256 6c621b7d6851feb47063398dc23ad01876dd3e2f7efee5523d409e30f77b1e31
- MD5 a37f9f425b9fbc2d29863365a9602196
- SHA1 168930427a9d4deba1fea68766382e0ae04f3697
- SHA512 9b15218a1fb24909f8f0a44a460b08dbf2d947bf1b384c3460318b970cd68528b7dd0392c3e5606aac9c58a62a9165b1db8e9ff413bd91e25972fb878abff8d8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
- Size 412B
- SHA256 0b8fcd64f27d846593531ca7e4c47813c6e4ebf9de46d6f3d20b8804e2c5baca
- MD5 fba39623ca50951d449b1a6285ded5b6
- SHA1 ac64423bf51d9cc307ed2991964558c50d672b65
- SHA512 94fe192b5bb45a6613a5081a6a1d6cbe5e75a2e85c8d15249676f3c080ce6ea359695e584f95c43b77f133b0e16c18a614ba4b57e15f7f08b7b797d7f4254bf9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\CB3D3\32EF.B3D
- Size 996B
- SHA256 72aaca2cbdd947bb5d55a8e5186d823ade75166b1d746e060927321b88c6cd06
- MD5 bb21ac487ba2bfb3c8c6bcc0f51f8f2a
- SHA1 559346f562e6f4d1f02acbfd37889cfe9ab4beb3
- SHA512 9243789c7d01ad2f1da81264e331c5a93e5519bb35d044e50428e6877974ed1a3528ec233db5ae499e15272c6e571532f07df682f1cc7ad8a541265c0a0efa68
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\CB3D3\32EF.B3D
- Size 1KB
- SHA256 13fa8b6291a5e09bba4cb29fd107c2a9e77ccc1186e98634c2b08cc92ad97393
- MD5 1fff4bdb8d5cb5d6632c5bf61faff10b
- SHA1 6c15c60f3ab9785db7ee76b0aec9c85ca8957f52
- SHA512 f85556235a09152db9a545f0eebeb125541c33c6cc436f1cdf2ab7784cf8c16ae103e8ddc20b3468259a53c84a8653df9d0683397d4c8e48851a1f05e7e82458
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\CB3D3\32EF.B3D
- Size 1KB
- SHA256 0e39b97956cd2c2e91d137d004a9b729e68017d5b6940e042a5028fcd0081b3b
- MD5 3f0e5aac5b77395e20cfb16938f7374e
- SHA1 81e4eef0b80abf97df57bf9c49a84114c66a3b9b
- SHA512 4a870246bd6776545ad0fe896ccef7bcb8db83d604e8f92985366bc7eceb947fbe87718a818b779e5df5ecadc238d5269035c44531d1d52eed2dc0b4231bd047
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\CB3D3\32EF.B3D
- Size 600B
- SHA256 b663faee00a9e34128b1750d4210609a11f752a45e5e9419a03b59fc7fc8b8fc
- MD5 6487156b8eddb8822e9b20b1ada5723d
- SHA1 5723c3bf3b5536a35217c14ded48cd4565412167
- SHA512 13fed954a69038a8a286d056e360e64ea82dfdcbddcd381cdf49f84a85707728f7fc4a4e238a239c4c244a6bf0b2e7645dd1de18b616c494485d771a2359c19d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\R07924.exe
- Size 188KB
- SHA256 e38564871dc5952e2d1d22d51e312e3064cf84df95c0420021153cb5c264adcf
- MD5 4f9c5823c5d1255ded151b01c0a58e15
- SHA1 2f7018a9211472ddfa5d2f09629bf90adce4676c
- SHA512 b5518effbf476d9486a5ddaa65c937e97b10470d533f8e0c9af30956868c032f6bdb524d13a004e4a0d19e9a88b5f3f11ee82e5602b1175092fb36a9959d40ca
- SSDEEP 3072:Q4oXAKunUbD4LdWKnvmb7/D26105nFeziUq6fNMUoZEA6YMSiWo7TI5Oa+EhFVjc:QzA9n0xKnvmb7/D261CnFeziUq6fNoZ6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\aehost.exe
- Size 129KB
- SHA256 8b1c13bb2e95f71ed75d8fca7aeefc556ecd377d5d4f6c544d77ac8f74255ca5
- MD5 e2b1704acdf48221cd9be91bae3546c5
- SHA1 f53a59b62276f58cf8689768f747e16f53dbd341
- SHA512 1b3d8baa981851a79c4f12f3ea2a4d197b3439e76ca723acd578acabd731310d6eeb3a4567a10d48f45192ae9c4cd732eca04c0a7fffa636e7bd364ed1357b53
- SSDEEP 3072:pGAvz74nYfRSa5o3Zw7nyN2E+49Tj1p6of1tOjO/9ZcF:XvzcnSq3ZwbBEE+tOikF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\behost.exe
- Size 279KB
- SHA256 b315e97fff3561563da4dcf7283636f42eef9ebaf422506e01f03716d4877b02
- MD5 2a583120a51178ee5f8bc2727faaa73e
- SHA1 91296d42eeddb285aeea28f5139cadda10f21df7
- SHA512 003e11b916256091486311881a06286d532a9940d75977a44afa3c116277a0f490505e9b4053f56846fb6d1d7584d7748f622bc9cae088af93820452027dac8b
- SSDEEP 6144:pVErFNRuFTSKNdxy7T7BQaCnSVFNIiLxNqG1f/oKt:p2PRUuKUT6JSB1xdJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\cehost.exe
- Size 145KB
- SHA256 8b40a882fde5ef3df2ec3112142b654c949adf7f559bc1912ad9d08ebb17c257
- MD5 56be9270582de0986c72139ea218e121
- SHA1 d33b8a2127ccf6b6f42a0c0f266136a376def18c
- SHA512 dcee7d3d16e19e5a36a386d097c171ed7761ad4fc626b5d523b9c33f952fa24da733c56fcb8ff440894c3672c468d04cecc001ae9a680a9607347a5f517e6023
- SSDEEP 3072:ijEkv6J2sdFWZ3Il67O7CX1hC1oKIhZ5F/b++xzTN4e53Eyfs6sM:jl2sTWSU7O7CPcGZrbtxzT153E8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\dehost.exe
- Size 24KB
- SHA256 400cb530f1489c46ada1dedc35b51cb53e8174f5cdda0d086ef593c135e0f216
- MD5 7cda5863b933988b7bd1d0c8035dafd9
- SHA1 68c64d655d0df1c9974587d12b3b88f5ce1f4cac
- SHA512 978440c09b70b695fdc171c6e2a7c064aa078d4a300db7f297afde5e3c1cfdf513da01dae967a9a8c524c185432ef87bf922a5cc97a9c8a6d1fd9cc3155e0aea
- SSDEEP 384:Ltr4DQARiay4it6nlfua2r8IxXD94REj:Zr4hrKt6hI/yRE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\qeuer.exe
- Size 188KB
- SHA256 19edfd0d5be85f81d02a832e49162217a4741f90d8cf203f014b1c91f78c4555
- MD5 11c7ef766635dabb7423be8a8a051ecc
- SHA1 9f76f26d0ccd8bcf575d4471a3b38f2325e87643
- SHA512 c11331018c915952391418864a6de57196c2f48097c94fbf648f70a3f231440c591680d3c9ff65ddeb68c60d7c3a96390e71d89f2f194d926687ad10355f7eca
- SSDEEP 3072:QkgXAKunUbD4LdWKnvmb7/D26105nFeziUq6fNMUoZEA6YMSiWo7TI5Oa+EhFVjL:QXA9n0xKnvmb7/D261CnFeziUq6fNoZx
- MD5 SHA1 SHA512 SSDEEP