Overview

overview

10

Static

static

3

JaffaCakes...5f.exe

windows7-x64

10

JaffaCakes...5f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-01-2025 05:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_023a0256b1cbc2ec41c7b6e1193ad65f.exe

  • Size

    554KB

  • MD5

    023a0256b1cbc2ec41c7b6e1193ad65f

  • SHA1

    43dc185bb5fc8e4afaf6b859f9013cc8ab57ca5a

  • SHA256

    ad0313e5c846916859f4b2166f89c87290d41b7d04a5352d38fb700d98297cb6

  • SHA512

    2a397659debc5b2f46fa1dfe221483fcc63429f99c2fb56827209dd2d0ab401da35d219108f7b0686226c887c12e8a51b2f5640742332ad4c8ef97d1da6e5cec

  • SSDEEP

    6144:xOr2DKVquhuUpmpc+bBXW0Gpr2DKVquhuUpmpc+bBXW0Gpr2DKVquhuUpmpc+bBF:xgEK8hc+NGPEK8hc+NGPEK8hc+NGW

Score
10/10
modiloaderdefense_evasiondiscoverypersistencetrojanupx

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Modiloader family
    modiloader
  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • ModiLoader Second Stage 21 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    defense_evasiontrojan
  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 64 IoCs
    defense_evasion
  • Modifies registry class 6 IoCs
  • Modifies registry key 1 TTPs 42 IoCs
  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_023a0256b1cbc2ec41c7b6e1193ad65f.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_023a0256b1cbc2ec41c7b6e1193ad65f.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1608
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im egui.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2816
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im ekrn.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2940
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c net stop "Panda anti-virus service"
      2⤵
        PID:3872
        • C:\Windows\SysWOW64\net.exe
          net stop "Panda anti-virus service"
          3⤵
            PID:5032
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Panda anti-virus service"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:1468
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im ApVxdWin.exe
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1204
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im AVENGINE.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:560
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im pavsrv51.exe
          2⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:880
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im psimreal.exe
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1376
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im PsImSvc.exe
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2540
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im WebProxy.exe
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2452
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v APVXDWIN /f
          2⤵
          • System Location Discovery: System Language Discovery
          PID:3636
          • C:\Windows\SysWOW64\reg.exe
            reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v APVXDWIN /f
            3⤵
            • Modifies registry key
            PID:6620
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im mcagent.exe
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4012
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im mcdash.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2036
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im mghtml.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2052
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im mcmnhdlr.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3912
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im mcvsshld.exe
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1648
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im McVSEscn.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2696
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im mcvsftsn.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3840
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCAgentExe /f
          2⤵
            PID:3476
            • C:\Windows\SysWOW64\reg.exe
              reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCAgentExe /f
              3⤵
              • Modifies registry key
              PID:6528
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v McRegWiz /f
            2⤵
              PID:3432
              • C:\Windows\SysWOW64\reg.exe
                reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v McRegWiz /f
                3⤵
                • System Location Discovery: System Language Discovery
                • Modifies registry key
                PID:440
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCUpdateExe /f
              2⤵
                PID:652
                • C:\Windows\SysWOW64\reg.exe
                  reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCUpdateExe /f
                  3⤵
                  • Modifies registry key
                  PID:6908
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v CleanUp /f
                2⤵
                • System Location Discovery: System Language Discovery
                PID:2356
                • C:\Windows\SysWOW64\reg.exe
                  reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v CleanUp /f
                  3⤵
                  • Modifies registry key
                  PID:1436
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v VirusScan Online /f
                2⤵
                  PID:372
                  • C:\Windows\SysWOW64\reg.exe
                    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v VirusScan Online /f
                    3⤵
                    • Modifies registry key
                    PID:1920
                • C:\Users\Admin\AppData\Local\Temp\Meu Primeiro TROJAN.exe
                  "C:\Users\Admin\AppData\Local\Temp\Meu Primeiro TROJAN.exe"
                  2⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  PID:5080
                  • C:\Windows\mstwain32.exe
                    "C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\Meu Primeiro TROJAN.exe"
                    3⤵
                    • UAC bypass
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Adds Run key to start application
                    • Checks whether UAC is enabled
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:5244
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore /v DisableRegistryTools /t REG_DWORD /d 1
                  2⤵
                    PID:5116
                    • C:\Windows\SysWOW64\reg.exe
                      reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore /v DisableRegistryTools /t REG_DWORD /d 1
                      3⤵
                      • Modifies registry key
                      PID:4900
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /f /im egui.exe
                    2⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1556
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /f /im ekrn.exe
                    2⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1324
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /c net stop "Panda anti-virus service"
                    2⤵
                      PID:4000
                      • C:\Windows\SysWOW64\net.exe
                        net stop "Panda anti-virus service"
                        3⤵
                          PID:7284
                          • C:\Windows\SysWOW64\net1.exe
                            C:\Windows\system32\net1 stop "Panda anti-virus service"
                            4⤵
                              PID:8376
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /f /im ApVxdWin.exe
                          2⤵
                          • System Location Discovery: System Language Discovery
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2916
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /f /im AVENGINE.exe
                          2⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2160
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /f /im pavsrv51.exe
                          2⤵
                          • System Location Discovery: System Language Discovery
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3320
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /f /im psimreal.exe
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4792
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /f /im PsImSvc.exe
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4888
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /f /im WebProxy.exe
                          2⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2656
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v APVXDWIN /f
                          2⤵
                            PID:3192
                            • C:\Windows\SysWOW64\reg.exe
                              reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v APVXDWIN /f
                              3⤵
                              • System Location Discovery: System Language Discovery
                              • Modifies registry key
                              PID:1084
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /f /im mcagent.exe
                            2⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2200
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /f /im mcdash.exe
                            2⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2008
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /f /im mghtml.exe
                            2⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3504
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /f /im mcmnhdlr.exe
                            2⤵
                            • System Location Discovery: System Language Discovery
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3108
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /f /im mcvsshld.exe
                            2⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4960
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /f /im McVSEscn.exe
                            2⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4548
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /f /im mcvsftsn.exe
                            2⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4080
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCAgentExe /f
                            2⤵
                              PID:3936
                              • C:\Windows\SysWOW64\reg.exe
                                reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCAgentExe /f
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Modifies registry key
                                PID:5236
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v McRegWiz /f
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:2612
                              • C:\Windows\SysWOW64\reg.exe
                                reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v McRegWiz /f
                                3⤵
                                • Modifies registry key
                                PID:6908
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCUpdateExe /f
                              2⤵
                                PID:2964
                                • C:\Windows\SysWOW64\reg.exe
                                  reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCUpdateExe /f
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry key
                                  PID:3036
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v CleanUp /f
                                2⤵
                                  PID:2620
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v CleanUp /f
                                    3⤵
                                    • Modifies registry key
                                    PID:1480
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v VirusScan Online /f
                                  2⤵
                                    PID:2128
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v VirusScan Online /f
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry key
                                      PID:2260
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore /v DisableRegistryTools /t REG_DWORD /d 1
                                    2⤵
                                      PID:5376
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore /v DisableRegistryTools /t REG_DWORD /d 1
                                        3⤵
                                        • Modifies registry key
                                        PID:4900
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      taskkill /f /im egui.exe
                                      2⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5384
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      taskkill /f /im ekrn.exe
                                      2⤵
                                      • Kills process with taskkill
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5392
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd.exe /c net stop "Panda anti-virus service"
                                      2⤵
                                        PID:5400
                                        • C:\Windows\SysWOW64\net.exe
                                          net stop "Panda anti-virus service"
                                          3⤵
                                            PID:8676
                                            • C:\Windows\SysWOW64\net1.exe
                                              C:\Windows\system32\net1 stop "Panda anti-virus service"
                                              4⤵
                                                PID:8276
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /f /im ApVxdWin.exe
                                            2⤵
                                            • Kills process with taskkill
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5408
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /f /im AVENGINE.exe
                                            2⤵
                                            • System Location Discovery: System Language Discovery
                                            • Kills process with taskkill
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5420
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /f /im pavsrv51.exe
                                            2⤵
                                            • Kills process with taskkill
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5428
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /f /im psimreal.exe
                                            2⤵
                                            • Kills process with taskkill
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5436
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /f /im PsImSvc.exe
                                            2⤵
                                            • System Location Discovery: System Language Discovery
                                            • Kills process with taskkill
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5452
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /f /im WebProxy.exe
                                            2⤵
                                            • System Location Discovery: System Language Discovery
                                            • Kills process with taskkill
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5468
                                          • C:\Windows\SysWOW64\cmd.exe
                                            cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v APVXDWIN /f
                                            2⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:5476
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v APVXDWIN /f
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry key
                                              PID:8684
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /f /im mcagent.exe
                                            2⤵
                                            • System Location Discovery: System Language Discovery
                                            • Kills process with taskkill
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5484
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /f /im mcdash.exe
                                            2⤵
                                            • Kills process with taskkill
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5492
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /f /im mghtml.exe
                                            2⤵
                                            • Kills process with taskkill
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5500
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /f /im mcmnhdlr.exe
                                            2⤵
                                            • Kills process with taskkill
                                            PID:5508
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /f /im mcvsshld.exe
                                            2⤵
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5516
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /f /im McVSEscn.exe
                                            2⤵
                                            • Kills process with taskkill
                                            PID:5528
                                            • C:\Windows\System32\Conhost.exe
                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              3⤵
                                                PID:1920
                                            • C:\Windows\SysWOW64\taskkill.exe
                                              taskkill /f /im mcvsftsn.exe
                                              2⤵
                                              • System Location Discovery: System Language Discovery
                                              • Kills process with taskkill
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:5536
                                            • C:\Windows\SysWOW64\cmd.exe
                                              cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCAgentExe /f
                                              2⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:5544
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCAgentExe /f
                                                3⤵
                                                • System Location Discovery: System Language Discovery
                                                • Modifies registry key
                                                PID:8512
                                            • C:\Windows\SysWOW64\cmd.exe
                                              cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v McRegWiz /f
                                              2⤵
                                                PID:5556
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v McRegWiz /f
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry key
                                                  PID:4676
                                              • C:\Windows\SysWOW64\cmd.exe
                                                cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCUpdateExe /f
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:5564
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCUpdateExe /f
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry key
                                                  PID:8524
                                              • C:\Windows\SysWOW64\cmd.exe
                                                cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v CleanUp /f
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:5572
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v CleanUp /f
                                                  3⤵
                                                  • Modifies registry key
                                                  PID:8448
                                              • C:\Windows\SysWOW64\cmd.exe
                                                cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v VirusScan Online /f
                                                2⤵
                                                  PID:5580
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v VirusScan Online /f
                                                    3⤵
                                                    • Modifies registry key
                                                    PID:8424
                                                • C:\Users\Admin\AppData\Local\Temp\Meu Primeiro TROJAN.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Meu Primeiro TROJAN.exe"
                                                  2⤵
                                                  • Executes dropped EXE
                                                  PID:6208
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore /v DisableRegistryTools /t REG_DWORD /d 1
                                                  2⤵
                                                    PID:6220
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore /v DisableRegistryTools /t REG_DWORD /d 1
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry key
                                                      PID:8600
                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                    taskkill /f /im egui.exe
                                                    2⤵
                                                    • Kills process with taskkill
                                                    PID:6232
                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                    taskkill /f /im ekrn.exe
                                                    2⤵
                                                    • Kills process with taskkill
                                                    PID:6240
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    cmd.exe /c net stop "Panda anti-virus service"
                                                    2⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:6248
                                                    • C:\Windows\SysWOW64\net.exe
                                                      net stop "Panda anti-virus service"
                                                      3⤵
                                                        PID:3640
                                                        • C:\Windows\SysWOW64\net1.exe
                                                          C:\Windows\system32\net1 stop "Panda anti-virus service"
                                                          4⤵
                                                            PID:2884
                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                        taskkill /f /im ApVxdWin.exe
                                                        2⤵
                                                        • Kills process with taskkill
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:6256
                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                        taskkill /f /im AVENGINE.exe
                                                        2⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Kills process with taskkill
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:6264
                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                        taskkill /f /im pavsrv51.exe
                                                        2⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:6272
                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                        taskkill /f /im psimreal.exe
                                                        2⤵
                                                        • Kills process with taskkill
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:6280
                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                        taskkill /f /im PsImSvc.exe
                                                        2⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:6288
                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                        taskkill /f /im WebProxy.exe
                                                        2⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Kills process with taskkill
                                                        PID:6296
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v APVXDWIN /f
                                                        2⤵
                                                          PID:6304
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v APVXDWIN /f
                                                            3⤵
                                                            • Modifies registry key
                                                            PID:5208
                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                          taskkill /f /im mcagent.exe
                                                          2⤵
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:6312
                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                          taskkill /f /im mcdash.exe
                                                          2⤵
                                                            PID:6320
                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                            taskkill /f /im mghtml.exe
                                                            2⤵
                                                            • Kills process with taskkill
                                                            PID:6328
                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                            taskkill /f /im mcmnhdlr.exe
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Kills process with taskkill
                                                            PID:6336
                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                            taskkill /f /im mcvsshld.exe
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Kills process with taskkill
                                                            PID:6344
                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                            taskkill /f /im McVSEscn.exe
                                                            2⤵
                                                            • Kills process with taskkill
                                                            PID:6352
                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                            taskkill /f /im mcvsftsn.exe
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Kills process with taskkill
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:6360
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCAgentExe /f
                                                            2⤵
                                                              PID:6376
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCAgentExe /f
                                                                3⤵
                                                                • Modifies registry key
                                                                PID:5464
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v McRegWiz /f
                                                              2⤵
                                                                PID:6384
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v McRegWiz /f
                                                                  3⤵
                                                                  • Modifies registry key
                                                                  PID:5436
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCUpdateExe /f
                                                                2⤵
                                                                  PID:6392
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCUpdateExe /f
                                                                    3⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies registry key
                                                                    PID:988
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v CleanUp /f
                                                                  2⤵
                                                                    PID:6400
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v CleanUp /f
                                                                      3⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Modifies registry key
                                                                      PID:4812
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v VirusScan Online /f
                                                                    2⤵
                                                                      PID:6408
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v VirusScan Online /f
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Modifies registry key
                                                                        PID:3936
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore /v DisableRegistryTools /t REG_DWORD /d 1
                                                                      2⤵
                                                                        PID:6692
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore /v DisableRegistryTools /t REG_DWORD /d 1
                                                                          3⤵
                                                                          • Modifies registry key
                                                                          PID:5764
                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                        taskkill /f /im egui.exe
                                                                        2⤵
                                                                        • Kills process with taskkill
                                                                        PID:6700
                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                        taskkill /f /im ekrn.exe
                                                                        2⤵
                                                                        • Kills process with taskkill
                                                                        PID:6708
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        cmd.exe /c net stop "Panda anti-virus service"
                                                                        2⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:6716
                                                                        • C:\Windows\SysWOW64\net.exe
                                                                          net stop "Panda anti-virus service"
                                                                          3⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:3796
                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                            C:\Windows\system32\net1 stop "Panda anti-virus service"
                                                                            4⤵
                                                                              PID:8876
                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                          taskkill /f /im ApVxdWin.exe
                                                                          2⤵
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:6724
                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                          taskkill /f /im AVENGINE.exe
                                                                          2⤵
                                                                          • Kills process with taskkill
                                                                          PID:6732
                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                          taskkill /f /im pavsrv51.exe
                                                                          2⤵
                                                                          • Kills process with taskkill
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:6748
                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                          taskkill /f /im psimreal.exe
                                                                          2⤵
                                                                            PID:6756
                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                            taskkill /f /im PsImSvc.exe
                                                                            2⤵
                                                                            • Kills process with taskkill
                                                                            PID:6764
                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                            taskkill /f /im WebProxy.exe
                                                                            2⤵
                                                                            • Kills process with taskkill
                                                                            PID:6772
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v APVXDWIN /f
                                                                            2⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:6780
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v APVXDWIN /f
                                                                              3⤵
                                                                              • Modifies registry key
                                                                              PID:5248
                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                            taskkill /f /im mcagent.exe
                                                                            2⤵
                                                                            • Kills process with taskkill
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:6788
                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                            taskkill /f /im mcdash.exe
                                                                            2⤵
                                                                            • Kills process with taskkill
                                                                            PID:6796
                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                            taskkill /f /im mghtml.exe
                                                                            2⤵
                                                                            • Kills process with taskkill
                                                                            PID:6804
                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                            taskkill /f /im mcmnhdlr.exe
                                                                            2⤵
                                                                            • Kills process with taskkill
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:6812
                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                            taskkill /f /im mcvsshld.exe
                                                                            2⤵
                                                                            • Kills process with taskkill
                                                                            PID:6820
                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                            taskkill /f /im McVSEscn.exe
                                                                            2⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Kills process with taskkill
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:6828
                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                            taskkill /f /im mcvsftsn.exe
                                                                            2⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Kills process with taskkill
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:6844
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCAgentExe /f
                                                                            2⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:6852
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCAgentExe /f
                                                                              3⤵
                                                                              • Modifies registry key
                                                                              PID:216
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v McRegWiz /f
                                                                            2⤵
                                                                              PID:6860
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v McRegWiz /f
                                                                                3⤵
                                                                                • Modifies registry key
                                                                                PID:4316
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCUpdateExe /f
                                                                              2⤵
                                                                                PID:6868
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCUpdateExe /f
                                                                                  3⤵
                                                                                  • Modifies registry key
                                                                                  PID:5980
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v CleanUp /f
                                                                                2⤵
                                                                                  PID:6876
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v CleanUp /f
                                                                                    3⤵
                                                                                    • Modifies registry key
                                                                                    PID:2704
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v VirusScan Online /f
                                                                                  2⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:6884
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v VirusScan Online /f
                                                                                    3⤵
                                                                                    • Modifies registry key
                                                                                    PID:5600
                                                                                • C:\Users\Admin\AppData\Local\Temp\Meu Primeiro TROJAN.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\Meu Primeiro TROJAN.exe"
                                                                                  2⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:7532
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore /v DisableRegistryTools /t REG_DWORD /d 1
                                                                                  2⤵
                                                                                    PID:7540
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore /v DisableRegistryTools /t REG_DWORD /d 1
                                                                                      3⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Modifies registry key
                                                                                      PID:4660
                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                    taskkill /f /im egui.exe
                                                                                    2⤵
                                                                                      PID:7552
                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                      taskkill /f /im ekrn.exe
                                                                                      2⤵
                                                                                      • Kills process with taskkill
                                                                                      PID:7560
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      cmd.exe /c net stop "Panda anti-virus service"
                                                                                      2⤵
                                                                                        PID:7568
                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                          net stop "Panda anti-virus service"
                                                                                          3⤵
                                                                                            PID:7856
                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                              C:\Windows\system32\net1 stop "Panda anti-virus service"
                                                                                              4⤵
                                                                                                PID:5216
                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                            taskkill /f /im ApVxdWin.exe
                                                                                            2⤵
                                                                                            • Kills process with taskkill
                                                                                            PID:7576
                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                            taskkill /f /im AVENGINE.exe
                                                                                            2⤵
                                                                                              PID:7584
                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                              taskkill /f /im pavsrv51.exe
                                                                                              2⤵
                                                                                              • Kills process with taskkill
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:7592
                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                              taskkill /f /im psimreal.exe
                                                                                              2⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Kills process with taskkill
                                                                                              PID:7600
                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                              taskkill /f /im PsImSvc.exe
                                                                                              2⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Kills process with taskkill
                                                                                              PID:7608
                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                              taskkill /f /im WebProxy.exe
                                                                                              2⤵
                                                                                              • Kills process with taskkill
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:7616
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v APVXDWIN /f
                                                                                              2⤵
                                                                                                PID:7624
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v APVXDWIN /f
                                                                                                  3⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Modifies registry key
                                                                                                  PID:1544
                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                taskkill /f /im mcagent.exe
                                                                                                2⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Kills process with taskkill
                                                                                                PID:7632
                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                taskkill /f /im mcdash.exe
                                                                                                2⤵
                                                                                                • Kills process with taskkill
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:7640
                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                taskkill /f /im mghtml.exe
                                                                                                2⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:7648
                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                taskkill /f /im mcmnhdlr.exe
                                                                                                2⤵
                                                                                                • Kills process with taskkill
                                                                                                PID:7656
                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                taskkill /f /im mcvsshld.exe
                                                                                                2⤵
                                                                                                • Kills process with taskkill
                                                                                                PID:7664
                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                taskkill /f /im McVSEscn.exe
                                                                                                2⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Kills process with taskkill
                                                                                                PID:7672
                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                taskkill /f /im mcvsftsn.exe
                                                                                                2⤵
                                                                                                • Kills process with taskkill
                                                                                                PID:7680
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCAgentExe /f
                                                                                                2⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:7688
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCAgentExe /f
                                                                                                  3⤵
                                                                                                  • Modifies registry key
                                                                                                  PID:5260
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v McRegWiz /f
                                                                                                2⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:7696
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v McRegWiz /f
                                                                                                  3⤵
                                                                                                  • Modifies registry key
                                                                                                  PID:5692
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCUpdateExe /f
                                                                                                2⤵
                                                                                                  PID:7704
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v MCUpdateExe /f
                                                                                                    3⤵
                                                                                                    • Modifies registry key
                                                                                                    PID:5976
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v CleanUp /f
                                                                                                  2⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:7712
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v CleanUp /f
                                                                                                    3⤵
                                                                                                    • Modifies registry key
                                                                                                    PID:5784
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v VirusScan Online /f
                                                                                                  2⤵
                                                                                                    PID:7720
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v VirusScan Online /f
                                                                                                      3⤵
                                                                                                      • Modifies registry key
                                                                                                      PID:5268
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore /v DisableRegistryTools /t REG_DWORD /d 1
                                                                                                    2⤵
                                                                                                      PID:3120
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore /v DisableRegistryTools /t REG_DWORD /d 1
                                                                                                        3⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Modifies registry key
                                                                                                        PID:5240
                                                                                                  • C:\Windows\System32\rundll32.exe
                                                                                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\FirewallControlPanel.dll,ShowWarningDialog "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_023a0256b1cbc2ec41c7b6e1193ad65f.exe"
                                                                                                    1⤵
                                                                                                    • Modifies registry class
                                                                                                    PID:544
                                                                                                  • C:\Windows\System32\rundll32.exe
                                                                                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\FirewallControlPanel.dll,ShowWarningDialog "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_023a0256b1cbc2ec41c7b6e1193ad65f.exe"
                                                                                                    1⤵
                                                                                                    • Modifies registry class
                                                                                                    PID:5180
                                                                                                  • C:\Windows\System32\rundll32.exe
                                                                                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\FirewallControlPanel.dll,ShowWarningDialog "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_023a0256b1cbc2ec41c7b6e1193ad65f.exe"
                                                                                                    1⤵
                                                                                                    • Modifies registry class
                                                                                                    PID:5964
                                                                                                  • C:\Windows\System32\rundll32.exe
                                                                                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\FirewallControlPanel.dll,ShowWarningDialog "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_023a0256b1cbc2ec41c7b6e1193ad65f.exe"
                                                                                                    1⤵
                                                                                                    • Modifies registry class
                                                                                                    PID:6596
                                                                                                  • C:\Windows\System32\rundll32.exe
                                                                                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\FirewallControlPanel.dll,ShowWarningDialog "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_023a0256b1cbc2ec41c7b6e1193ad65f.exe"
                                                                                                    1⤵
                                                                                                    • Modifies registry class
                                                                                                    PID:6060
                                                                                                  • C:\Windows\system32\vssvc.exe
                                                                                                    C:\Windows\system32\vssvc.exe
                                                                                                    1⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:7900
                                                                                                  • C:\Windows\System32\rundll32.exe
                                                                                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\FirewallControlPanel.dll,ShowWarningDialog "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_023a0256b1cbc2ec41c7b6e1193ad65f.exe"
                                                                                                    1⤵
                                                                                                    • Modifies registry class
                                                                                                    PID:916
                                                                                                  • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                    C:\Windows\System32\WaaSMedicAgent.exe 81b23c8a2e6f13389d51716dd78362c7 fW73BGVDgECQenzbkTXkyQ.0.1.0.0.0
                                                                                                    1⤵
                                                                                                      PID:216

                                                                                                    Network

                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Meu Primeiro TROJAN.exe
                                                                                                      Filesize

                                                                                                      110KB

                                                                                                      MD5

                                                                                                      a4b88da80f58e93ed949f53b689768c2

                                                                                                      SHA1

                                                                                                      2c3380be790a5de08663f39105f57f7f39efe171

                                                                                                      SHA256

                                                                                                      a0e7c9603e704769a1200da2901d95d1e0b207b70bff66a3497be5da7981c5db

                                                                                                      SHA512

                                                                                                      5e068449ea180217e5af90408d4aa70609cbfc64b95b599f93e2f034c41ab2758b7b72f140614ec9a88f62910b2c12d3fdffde1289106d73127c8a153580ef8a

                                                                                                      Download Submit

                                                                                                    • C:\Windows\cmsetac.dll
                                                                                                      Filesize

                                                                                                      32KB

                                                                                                      MD5

                                                                                                      9f43aa01bf23ddbc1233e0dd789fb3ff

                                                                                                      SHA1

                                                                                                      6d6505f41dcd0b7bb068c51578000a6b962854fa

                                                                                                      SHA256

                                                                                                      27287f50ac30186afe7b6b3bf3a0cc35889d7956cb9073cfab30fdad5378d610

                                                                                                      SHA512

                                                                                                      796c527da2a03bbb7ec067e2761777ead3b9d7e48095653850668a8aa20e332e5477072f00ee79d6c520cd293f6aa240f134d658dbc7e8d33e24a34a003920b9

                                                                                                      Download Submit

                                                                                                    • C:\Windows\ntdtcstp.dll
                                                                                                      Filesize

                                                                                                      7KB

                                                                                                      MD5

                                                                                                      67587e25a971a141628d7f07bd40ffa0

                                                                                                      SHA1

                                                                                                      76fcd014539a3bb247cc0b761225f68bd6055f6b

                                                                                                      SHA256

                                                                                                      e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

                                                                                                      SHA512

                                                                                                      6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

                                                                                                      Download Submit

                                                                                                    • memory/5080-22-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                      Filesize

                                                                                                      316KB

                                                                                                      Download

                                                                                                    • memory/5080-11-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                      Filesize

                                                                                                      316KB

                                                                                                      Download

                                                                                                    • memory/5080-35-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                      Filesize

                                                                                                      316KB

                                                                                                      Download

                                                                                                    • memory/5244-51-0x0000000000A80000-0x0000000000A88000-memory.dmp

                                                                                                      Filesize

                                                                                                      32KB

                                                                                                      Download

                                                                                                    • memory/5244-57-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                      Filesize

                                                                                                      316KB

                                                                                                      Download

                                                                                                    • memory/5244-87-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                      Filesize

                                                                                                      316KB

                                                                                                      Download

                                                                                                    • memory/5244-84-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                      Filesize

                                                                                                      316KB

                                                                                                      Download

                                                                                                    • memory/5244-81-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                      Filesize

                                                                                                      316KB

                                                                                                      Download

                                                                                                    • memory/5244-47-0x00000000028E0000-0x00000000028EE000-memory.dmp

                                                                                                      Filesize

                                                                                                      56KB

                                                                                                      Download

                                                                                                    • memory/5244-53-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                      Filesize

                                                                                                      316KB

                                                                                                      Download

                                                                                                    • memory/5244-52-0x00000000028E0000-0x00000000028EE000-memory.dmp

                                                                                                      Filesize

                                                                                                      56KB

                                                                                                      Download

                                                                                                    • memory/5244-78-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                      Filesize

                                                                                                      316KB

                                                                                                      Download

                                                                                                    • memory/5244-50-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                      Filesize

                                                                                                      316KB

                                                                                                      Download

                                                                                                    • memory/5244-54-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                      Filesize

                                                                                                      316KB

                                                                                                      Download

                                                                                                    • memory/5244-36-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                      Filesize

                                                                                                      316KB

                                                                                                      Download

                                                                                                    • memory/5244-60-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                      Filesize

                                                                                                      316KB

                                                                                                      Download

                                                                                                    • memory/5244-63-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                      Filesize

                                                                                                      316KB

                                                                                                      Download

                                                                                                    • memory/5244-66-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                      Filesize

                                                                                                      316KB

                                                                                                      Download

                                                                                                    • memory/5244-69-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                      Filesize

                                                                                                      316KB

                                                                                                      Download

                                                                                                    • memory/5244-72-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                      Filesize

                                                                                                      316KB

                                                                                                      Download

                                                                                                    • memory/5244-75-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                      Filesize

                                                                                                      316KB

                                                                                                      Download

                                                                                                    • memory/6208-16-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                      Filesize

                                                                                                      316KB

                                                                                                      Download

                                                                                                    • memory/6208-14-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                      Filesize

                                                                                                      316KB

                                                                                                      Download

                                                                                                    • memory/7532-21-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                      Filesize

                                                                                                      316KB

                                                                                                      Download

                                                                                                    • memory/7532-19-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                      Filesize

                                                                                                      316KB

                                                                                                      Download