Analysis
-
max time kernel
155s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15-04-2024 05:00
Static task
static1
General
-
Target
f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe
-
Size
3.1MB
-
MD5
f05e4420dfc79226b34b0f7e3d1a65f1
-
SHA1
95c5fc288a628e2fba01879b0dbe0dbbd79ae74f
-
SHA256
bd887a31360a06cf6094b3b889bf7ec9d835c9642bff6a0ed98bb248f225bf24
-
SHA512
d427c45f260e9bd38fa5a843c4eeff5482c102ace9b3f083ce015e9ce303dd9c481b70a715764c3cec16c6dc0246ad66f251197945f52a13e4e5eab77542ce38
-
SSDEEP
98304:qw3BM5HPz7UtPTkJY58taa7RTBQl50HeaCdRd9zojPGuH:qw3EHPzOTkJYla7RTBQl509CdRd9zojH
Malware Config
Extracted
asyncrat
0.5.7B
Default
whiteshadows.ddns.net:9731
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
microsoft 2.exe
-
install_folder
%AppData%
Extracted
gcleaner
g-prtnrs.top
g-prtrs.top
Extracted
redline
UPD
185.215.113.45:41009
Extracted
redline
Liez
liezaphare.xyz:80
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2344-139-0x0000000002430000-0x0000000002450000-memory.dmp family_redline behavioral2/memory/2344-150-0x00000000024B0000-0x00000000024CE000-memory.dmp family_redline behavioral2/memory/4912-155-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2344-139-0x0000000002430000-0x0000000002450000-memory.dmp family_sectoprat behavioral2/memory/2344-150-0x00000000024B0000-0x00000000024CE000-memory.dmp family_sectoprat behavioral2/memory/4912-155-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Socelars payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\askinstall54.exe family_socelars -
Async RAT payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\microsoft 2.exe family_asyncrat -
OnlyLogger payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3156-148-0x0000000000550000-0x000000000057E000-memory.dmp family_onlylogger behavioral2/memory/3156-149-0x0000000000400000-0x0000000000477000-memory.dmp family_onlylogger -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe3002.exemicrosoft 2.exeChrome3 2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 3002.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation microsoft 2.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation Chrome3 2.exe -
Executes dropped EXE 14 IoCs
Processes:
3002.exeaskinstall54.exe3002.exeBearVpn 3.exeChrome3 2.exeGLKbrow.exejhuuee.exemicrosoft 2.exeNGlorySetp.exesetup.exeupdatenew.exeGLKbrow.exeservices64.exemicrosoft 2.exepid process 4956 3002.exe 2460 askinstall54.exe 4736 3002.exe 4928 BearVpn 3.exe 4820 Chrome3 2.exe 380 GLKbrow.exe 2816 jhuuee.exe 4260 microsoft 2.exe 1592 NGlorySetp.exe 3156 setup.exe 2344 updatenew.exe 4912 GLKbrow.exe 3600 services64.exe 4380 microsoft 2.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
Processes:
flow ioc 48 iplogger.org 49 iplogger.org 53 iplogger.org 54 iplogger.org 58 iplogger.org -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
GLKbrow.exedescription pid process target process PID 380 set thread context of 4912 380 GLKbrow.exe GLKbrow.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4944 3156 WerFault.exe setup.exe 3700 3156 WerFault.exe setup.exe 4120 3156 WerFault.exe setup.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3524 schtasks.exe 3996 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1452 timeout.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4280 taskkill.exe -
Processes:
3002.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 3002.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 3002.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
microsoft 2.exeChrome3 2.exepid process 4260 microsoft 2.exe 4260 microsoft 2.exe 4260 microsoft 2.exe 4260 microsoft 2.exe 4260 microsoft 2.exe 4260 microsoft 2.exe 4260 microsoft 2.exe 4260 microsoft 2.exe 4260 microsoft 2.exe 4260 microsoft 2.exe 4260 microsoft 2.exe 4260 microsoft 2.exe 4260 microsoft 2.exe 4260 microsoft 2.exe 4260 microsoft 2.exe 4260 microsoft 2.exe 4260 microsoft 2.exe 4260 microsoft 2.exe 4260 microsoft 2.exe 4260 microsoft 2.exe 4260 microsoft 2.exe 4260 microsoft 2.exe 4260 microsoft 2.exe 4260 microsoft 2.exe 4820 Chrome3 2.exe 4820 Chrome3 2.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
Processes:
askinstall54.exeNGlorySetp.exeBearVpn 3.exemicrosoft 2.exetaskkill.exeChrome3 2.exeGLKbrow.exemicrosoft 2.exeupdatenew.exedescription pid process Token: SeCreateTokenPrivilege 2460 askinstall54.exe Token: SeAssignPrimaryTokenPrivilege 2460 askinstall54.exe Token: SeLockMemoryPrivilege 2460 askinstall54.exe Token: SeIncreaseQuotaPrivilege 2460 askinstall54.exe Token: SeMachineAccountPrivilege 2460 askinstall54.exe Token: SeTcbPrivilege 2460 askinstall54.exe Token: SeSecurityPrivilege 2460 askinstall54.exe Token: SeTakeOwnershipPrivilege 2460 askinstall54.exe Token: SeLoadDriverPrivilege 2460 askinstall54.exe Token: SeSystemProfilePrivilege 2460 askinstall54.exe Token: SeSystemtimePrivilege 2460 askinstall54.exe Token: SeProfSingleProcessPrivilege 2460 askinstall54.exe Token: SeIncBasePriorityPrivilege 2460 askinstall54.exe Token: SeCreatePagefilePrivilege 2460 askinstall54.exe Token: SeCreatePermanentPrivilege 2460 askinstall54.exe Token: SeBackupPrivilege 2460 askinstall54.exe Token: SeRestorePrivilege 2460 askinstall54.exe Token: SeShutdownPrivilege 2460 askinstall54.exe Token: SeDebugPrivilege 2460 askinstall54.exe Token: SeAuditPrivilege 2460 askinstall54.exe Token: SeSystemEnvironmentPrivilege 2460 askinstall54.exe Token: SeChangeNotifyPrivilege 2460 askinstall54.exe Token: SeRemoteShutdownPrivilege 2460 askinstall54.exe Token: SeUndockPrivilege 2460 askinstall54.exe Token: SeSyncAgentPrivilege 2460 askinstall54.exe Token: SeEnableDelegationPrivilege 2460 askinstall54.exe Token: SeManageVolumePrivilege 2460 askinstall54.exe Token: SeImpersonatePrivilege 2460 askinstall54.exe Token: SeCreateGlobalPrivilege 2460 askinstall54.exe Token: 31 2460 askinstall54.exe Token: 32 2460 askinstall54.exe Token: 33 2460 askinstall54.exe Token: 34 2460 askinstall54.exe Token: 35 2460 askinstall54.exe Token: SeDebugPrivilege 1592 NGlorySetp.exe Token: SeDebugPrivilege 4928 BearVpn 3.exe Token: SeDebugPrivilege 4260 microsoft 2.exe Token: SeDebugPrivilege 4280 taskkill.exe Token: SeDebugPrivilege 4820 Chrome3 2.exe Token: SeDebugPrivilege 4912 GLKbrow.exe Token: SeDebugPrivilege 4380 microsoft 2.exe Token: SeDebugPrivilege 2344 updatenew.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe3002.exeGLKbrow.exeaskinstall54.execmd.exemicrosoft 2.exeChrome3 2.execmd.execmd.execmd.exedescription pid process target process PID 812 wrote to memory of 4956 812 f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe 3002.exe PID 812 wrote to memory of 4956 812 f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe 3002.exe PID 812 wrote to memory of 4956 812 f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe 3002.exe PID 812 wrote to memory of 2460 812 f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe askinstall54.exe PID 812 wrote to memory of 2460 812 f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe askinstall54.exe PID 812 wrote to memory of 2460 812 f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe askinstall54.exe PID 4956 wrote to memory of 4736 4956 3002.exe 3002.exe PID 4956 wrote to memory of 4736 4956 3002.exe 3002.exe PID 4956 wrote to memory of 4736 4956 3002.exe 3002.exe PID 812 wrote to memory of 4928 812 f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe BearVpn 3.exe PID 812 wrote to memory of 4928 812 f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe BearVpn 3.exe PID 812 wrote to memory of 4928 812 f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe BearVpn 3.exe PID 812 wrote to memory of 4820 812 f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe Chrome3 2.exe PID 812 wrote to memory of 4820 812 f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe Chrome3 2.exe PID 812 wrote to memory of 380 812 f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe GLKbrow.exe PID 812 wrote to memory of 380 812 f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe GLKbrow.exe PID 812 wrote to memory of 380 812 f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe GLKbrow.exe PID 812 wrote to memory of 2816 812 f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe jhuuee.exe PID 812 wrote to memory of 2816 812 f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe jhuuee.exe PID 812 wrote to memory of 4260 812 f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe microsoft 2.exe PID 812 wrote to memory of 4260 812 f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe microsoft 2.exe PID 812 wrote to memory of 4260 812 f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe microsoft 2.exe PID 812 wrote to memory of 1592 812 f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe NGlorySetp.exe PID 812 wrote to memory of 1592 812 f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe NGlorySetp.exe PID 812 wrote to memory of 3156 812 f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe setup.exe PID 812 wrote to memory of 3156 812 f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe setup.exe PID 812 wrote to memory of 3156 812 f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe setup.exe PID 812 wrote to memory of 2344 812 f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe updatenew.exe PID 812 wrote to memory of 2344 812 f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe updatenew.exe PID 812 wrote to memory of 2344 812 f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe updatenew.exe PID 380 wrote to memory of 4912 380 GLKbrow.exe GLKbrow.exe PID 380 wrote to memory of 4912 380 GLKbrow.exe GLKbrow.exe PID 380 wrote to memory of 4912 380 GLKbrow.exe GLKbrow.exe PID 2460 wrote to memory of 3296 2460 askinstall54.exe cmd.exe PID 2460 wrote to memory of 3296 2460 askinstall54.exe cmd.exe PID 2460 wrote to memory of 3296 2460 askinstall54.exe cmd.exe PID 3296 wrote to memory of 4280 3296 cmd.exe taskkill.exe PID 3296 wrote to memory of 4280 3296 cmd.exe taskkill.exe PID 3296 wrote to memory of 4280 3296 cmd.exe taskkill.exe PID 380 wrote to memory of 4912 380 GLKbrow.exe GLKbrow.exe PID 380 wrote to memory of 4912 380 GLKbrow.exe GLKbrow.exe PID 380 wrote to memory of 4912 380 GLKbrow.exe GLKbrow.exe PID 380 wrote to memory of 4912 380 GLKbrow.exe GLKbrow.exe PID 380 wrote to memory of 4912 380 GLKbrow.exe GLKbrow.exe PID 4260 wrote to memory of 3676 4260 microsoft 2.exe cmd.exe PID 4260 wrote to memory of 3676 4260 microsoft 2.exe cmd.exe PID 4260 wrote to memory of 3676 4260 microsoft 2.exe cmd.exe PID 4260 wrote to memory of 2592 4260 microsoft 2.exe cmd.exe PID 4260 wrote to memory of 2592 4260 microsoft 2.exe cmd.exe PID 4260 wrote to memory of 2592 4260 microsoft 2.exe cmd.exe PID 4820 wrote to memory of 1412 4820 Chrome3 2.exe cmd.exe PID 4820 wrote to memory of 1412 4820 Chrome3 2.exe cmd.exe PID 2592 wrote to memory of 1452 2592 cmd.exe timeout.exe PID 2592 wrote to memory of 1452 2592 cmd.exe timeout.exe PID 2592 wrote to memory of 1452 2592 cmd.exe timeout.exe PID 3676 wrote to memory of 3524 3676 cmd.exe schtasks.exe PID 3676 wrote to memory of 3524 3676 cmd.exe schtasks.exe PID 3676 wrote to memory of 3524 3676 cmd.exe schtasks.exe PID 1412 wrote to memory of 3996 1412 cmd.exe schtasks.exe PID 1412 wrote to memory of 3996 1412 cmd.exe schtasks.exe PID 4820 wrote to memory of 3600 4820 Chrome3 2.exe services64.exe PID 4820 wrote to memory of 3600 4820 Chrome3 2.exe services64.exe PID 2592 wrote to memory of 4380 2592 cmd.exe microsoft 2.exe PID 2592 wrote to memory of 4380 2592 cmd.exe microsoft 2.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f05e4420dfc79226b34b0f7e3d1a65f1_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe" -a3⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\askinstall54.exe"C:\Users\Admin\AppData\Local\Temp\askinstall54.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Chrome3 2.exe"C:\Users\Admin\AppData\Local\Temp\Chrome3 2.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\GLKbrow.exe"C:\Users\Admin\AppData\Local\Temp\GLKbrow.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GLKbrow.exeC:\Users\Admin\AppData\Local\Temp\GLKbrow.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\microsoft 2.exe"C:\Users\Admin\AppData\Local\Temp\microsoft 2.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "microsoft 2" /tr '"C:\Users\Admin\AppData\Roaming\microsoft 2.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "microsoft 2" /tr '"C:\Users\Admin\AppData\Roaming\microsoft 2.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpDF9D.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\microsoft 2.exe"C:\Users\Admin\AppData\Roaming\microsoft 2.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\NGlorySetp.exe"C:\Users\Admin\AppData\Local\Temp\NGlorySetp.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 7963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 8043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 8003⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\updatenew.exe"C:\Users\Admin\AppData\Local\Temp\updatenew.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4168 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3156 -ip 31561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3156 -ip 31561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3156 -ip 31561⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\microsoft 2.exe.logFilesize
522B
MD5acc9090417037dfa2a55b46ed86e32b8
SHA153fa6fb25fb3e88c24d2027aca6ae492b2800a4d
SHA2562412679218bb0a7d05ceee32869bbb223619bde9966c4c460a68304a3367724b
SHA512d51f7085ec147c708f446b9fb6923cd2fb64596d354ed929e125b30ace57c8cb3217589447a36960e5d3aea87a4e48aaa82c7509eced6d6c2cecd71fcfe3697b
-
C:\Users\Admin\AppData\Local\Temp\3002.exeFilesize
56KB
MD5e511bb4cf31a2307b6f3445a869bcf31
SHA176f5c6e8df733ac13d205d426831ed7672a05349
SHA25656002017746f61eee8d8e9b5ad2f3cbb119dc99300c5b6d32c1be184d3e25137
SHA5129c81de34bf3b0eb75405c726d641ef6090054e9be8e0c0ab1bb2ed095e6477ce2fa8996868bf8a77a720b210a76b5f4e1b3b086d7f40449d79498681b367199c
-
C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exeFilesize
6KB
MD5e4ff121d36dff8e94df4e718ecd84aff
SHA1b84af5dae944bbf34d289d7616d2fef09dab26b7
SHA2562a019bc6bace686b08286ee7d8e2e66c18283b162d27774c486037c940dc60cc
SHA512141f12468cfe737b3694a4ece8f17c5d35bbade05ee0538fe4ef4fccf61584374f79a474fd4bf82685a4840afd94e9a9bbd9c9f357cb342dda9f89109c4da5f4
-
C:\Users\Admin\AppData\Local\Temp\Chrome3 2.exeFilesize
43KB
MD558eea186f52da3256cc01e3856bca5c0
SHA135e8b3f570d572ea56fdf0dfb480e9cc4a36d986
SHA25626021efed039139a1c40ad7125a380e166321c65bc7354ea45d74ece6b0c692f
SHA5120d69916dde2e6a24a7addb9f1b21b51ff4b9d0b2052a719af431c6a382647bb01fdd96aedf89dc9c531faf3d2849fd2dc505385b929df23d8e7b1c3c5a9d740a
-
C:\Users\Admin\AppData\Local\Temp\GLKbrow.exeFilesize
390KB
MD5a186a0ef26742808b75c2ef534ece63c
SHA1d79062c6c9c039831e54c88fb67cd64e8146048c
SHA25618bc677465a6195706664788be8d88acd5cfd4abdad074aa1e1f0b2fbfed2b76
SHA512f5d2304750011a920bf1c219185bf9963fb47ab52e1fec96ce98cd15853fe6b592356b638f2f3628d3f5a1a45c47e85db1fb2d5a00a85840ad3e296ff130c21b
-
C:\Users\Admin\AppData\Local\Temp\NGlorySetp.exeFilesize
120KB
MD5bf08a1385317518360e2fd24e25a67e2
SHA100b5d4aa063217b31755c4a698135915671f231f
SHA256d06d7d96e973671151438fe57a33c2834f7427c6c39501c22e0fbf1bd38de227
SHA512802750549a8302a69255e48ffe9b293babf26693e533484050449993e5c9365bf4b137013cbb7ae75359abe3a557bd4cc67b143be7dccad41b02a3ff5c0af5dc
-
C:\Users\Admin\AppData\Local\Temp\askinstall54.exeFilesize
1.4MB
MD5f15409c47e5eb9ef4b316c3c8d2d3936
SHA132df482df77e5ef84560ff814a725831acb89b42
SHA256ec860b4ca9a08990622bc7fd0606383c965de9dd58bcf2022de601988fb7e3a4
SHA5122e8ba5d6b6d599f4df23365f0f93eee65f51ad369794b0d43d4e56a9060700a038e7af9dc15bca3034c20cfadc2300dff526ec64fb08c9499cb2fa24943949fc
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exeFilesize
239KB
MD51fa531c00decf91ca71f207cac84eaf7
SHA18131ac8c897ba6f76175cfed34cbd7b1c96d1e19
SHA25681613cf7f25302f85a8f6e80cea1fee589e6b05828ed6b0946b3855f7c70233f
SHA5125b2c27bc949f618dbb8bd94339f35ca5f55c0fd7f347463c79d3d1ec0b033322be65542429397fdbcccf9e92163b82505f5113c48ff111ec08ca050fb9812be7
-
C:\Users\Admin\AppData\Local\Temp\microsoft 2.exeFilesize
45KB
MD596e4aa05fbaf3ee4aa018be285821cb0
SHA18152a37db98c8b4cd96e66ae5942a5c0afce2fa1
SHA256b8957cff3e10c9e25e2fb62a044646e153a22d5b1943613270568dccef3a4fcd
SHA51251e8e0e041d8ceb6e889ede1ac2b3a0d4979cc8eff1a1216f5d5caa67cacba7563c3bb8f4c98d5c9b9ef3d95dbd9a839ff532d79109a208ba70e9f61d9d026d8
-
C:\Users\Admin\AppData\Local\Temp\setup.exeFilesize
370KB
MD59e71e05b637b04dd7ea315b4ac6feb4a
SHA178dbe6d8fe1af0009fdc803cdf40a7101422fa94
SHA256733693a304149939abc2dba1857e2f37111eba29b3c5d47dc3cf5243dd3dbb1a
SHA512dd31ac2fdfde46b5ade917bf102732bcf5c193de4060a9813b750f907051e822731273a8ab2ea999903354bf434132f6a7176da2ea1988a08c06714ff4a1445b
-
C:\Users\Admin\AppData\Local\Temp\tmpDF9D.tmp.batFilesize
155B
MD50f9500a079f9decb60f3b80eb9787530
SHA10a1610b2ebddde9c0b0d8b291fc43092e041d43d
SHA2561002709415a05dd9acac8cfde30049c34d822fc1349fa64d5b3b9e80d50be546
SHA512bbf40501012d19f9366981d0b7153e224930d6eae331b7375d3197bc9710979aaad967e01bbe11f8993ef710f7ecf825164e4592bbd73d68dd52042b1fff5d0c
-
C:\Users\Admin\AppData\Local\Temp\updatenew.exeFilesize
394KB
MD5f0524f49b7826d4a1ec521784e18a159
SHA1a9a60c3e40fe80153091a51c182bb80134eaadaf
SHA25630eaf7331e0e7e4323f35fb5c6b0744aec2dc0f18d1eb9a1f842b006926c1a83
SHA5127cad9f36d3564b7e673738251322ae8888cba17e324c7c34e312b0550e5549b257aaa1b3c9cb947b013f5ac0d21019ef1bf20421a851787a65ab97cac5711472
-
memory/380-106-0x0000000005190000-0x0000000005206000-memory.dmpFilesize
472KB
-
memory/380-126-0x0000000005150000-0x0000000005160000-memory.dmpFilesize
64KB
-
memory/380-85-0x0000000074FE0000-0x0000000075790000-memory.dmpFilesize
7.7MB
-
memory/380-144-0x00000000058A0000-0x0000000005E44000-memory.dmpFilesize
5.6MB
-
memory/380-75-0x0000000000920000-0x0000000000988000-memory.dmpFilesize
416KB
-
memory/380-160-0x0000000074FE0000-0x0000000075790000-memory.dmpFilesize
7.7MB
-
memory/380-131-0x0000000005210000-0x000000000522E000-memory.dmpFilesize
120KB
-
memory/812-3-0x0000000074FE0000-0x0000000075790000-memory.dmpFilesize
7.7MB
-
memory/812-1-0x0000000000430000-0x0000000000744000-memory.dmpFilesize
3.1MB
-
memory/812-0-0x0000000074FE0000-0x0000000075790000-memory.dmpFilesize
7.7MB
-
memory/812-124-0x0000000074FE0000-0x0000000075790000-memory.dmpFilesize
7.7MB
-
memory/1592-105-0x0000000000460000-0x0000000000488000-memory.dmpFilesize
160KB
-
memory/1592-108-0x0000000002600000-0x000000000261E000-memory.dmpFilesize
120KB
-
memory/1592-107-0x00007FF9703D0000-0x00007FF970E91000-memory.dmpFilesize
10.8MB
-
memory/1592-123-0x000000001AFD0000-0x000000001AFE0000-memory.dmpFilesize
64KB
-
memory/1592-133-0x00007FF9703D0000-0x00007FF970E91000-memory.dmpFilesize
10.8MB
-
memory/2344-146-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/2344-158-0x0000000000400000-0x000000000047D000-memory.dmpFilesize
500KB
-
memory/2344-207-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/2344-205-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/2344-206-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/2344-136-0x0000000000650000-0x0000000000750000-memory.dmpFilesize
1024KB
-
memory/2344-137-0x00000000005E0000-0x000000000060F000-memory.dmpFilesize
188KB
-
memory/2344-138-0x0000000000400000-0x000000000047D000-memory.dmpFilesize
500KB
-
memory/2344-139-0x0000000002430000-0x0000000002450000-memory.dmpFilesize
128KB
-
memory/2344-204-0x0000000074FE0000-0x0000000075790000-memory.dmpFilesize
7.7MB
-
memory/2344-145-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/2344-202-0x0000000000650000-0x0000000000750000-memory.dmpFilesize
1024KB
-
memory/2344-199-0x00000000058C0000-0x00000000059CA000-memory.dmpFilesize
1.0MB
-
memory/2344-197-0x00000000005E0000-0x000000000060F000-memory.dmpFilesize
188KB
-
memory/2344-173-0x0000000004B60000-0x0000000004BAC000-memory.dmpFilesize
304KB
-
memory/2344-167-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/2344-150-0x00000000024B0000-0x00000000024CE000-memory.dmpFilesize
120KB
-
memory/2344-143-0x0000000074FE0000-0x0000000075790000-memory.dmpFilesize
7.7MB
-
memory/2344-152-0x00000000051D0000-0x00000000057E8000-memory.dmpFilesize
6.1MB
-
memory/2344-153-0x0000000004B00000-0x0000000004B12000-memory.dmpFilesize
72KB
-
memory/3156-148-0x0000000000550000-0x000000000057E000-memory.dmpFilesize
184KB
-
memory/3156-151-0x00000000007B0000-0x00000000008B0000-memory.dmpFilesize
1024KB
-
memory/3156-149-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/3600-192-0x00007FF9703D0000-0x00007FF970E91000-memory.dmpFilesize
10.8MB
-
memory/4260-154-0x0000000004F00000-0x0000000004F9C000-memory.dmpFilesize
624KB
-
memory/4260-100-0x0000000074FE0000-0x0000000075790000-memory.dmpFilesize
7.7MB
-
memory/4260-97-0x0000000000530000-0x0000000000542000-memory.dmpFilesize
72KB
-
memory/4260-127-0x0000000004DF0000-0x0000000004E00000-memory.dmpFilesize
64KB
-
memory/4260-164-0x0000000074FE0000-0x0000000075790000-memory.dmpFilesize
7.7MB
-
memory/4260-174-0x0000000074FE0000-0x0000000075790000-memory.dmpFilesize
7.7MB
-
memory/4380-203-0x0000000004E60000-0x0000000004E70000-memory.dmpFilesize
64KB
-
memory/4380-198-0x0000000074FE0000-0x0000000075790000-memory.dmpFilesize
7.7MB
-
memory/4380-209-0x0000000004E60000-0x0000000004E70000-memory.dmpFilesize
64KB
-
memory/4820-163-0x0000000001480000-0x000000000148E000-memory.dmpFilesize
56KB
-
memory/4820-142-0x00007FF9703D0000-0x00007FF970E91000-memory.dmpFilesize
10.8MB
-
memory/4820-166-0x00000000014B0000-0x00000000014C2000-memory.dmpFilesize
72KB
-
memory/4820-191-0x00007FF9703D0000-0x00007FF970E91000-memory.dmpFilesize
10.8MB
-
memory/4820-52-0x0000000000A50000-0x0000000000A60000-memory.dmpFilesize
64KB
-
memory/4820-74-0x00007FF9703D0000-0x00007FF970E91000-memory.dmpFilesize
10.8MB
-
memory/4820-165-0x000000001C5C0000-0x000000001C5D0000-memory.dmpFilesize
64KB
-
memory/4912-161-0x00000000056D0000-0x000000000570C000-memory.dmpFilesize
240KB
-
memory/4912-155-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4912-162-0x0000000074FE0000-0x0000000075790000-memory.dmpFilesize
7.7MB
-
memory/4912-208-0x0000000005880000-0x0000000005890000-memory.dmpFilesize
64KB
-
memory/4912-168-0x0000000005880000-0x0000000005890000-memory.dmpFilesize
64KB
-
memory/4928-48-0x0000000000D10000-0x0000000000D18000-memory.dmpFilesize
32KB
-
memory/4928-135-0x0000000074FE0000-0x0000000075790000-memory.dmpFilesize
7.7MB
-
memory/4928-53-0x0000000074FE0000-0x0000000075790000-memory.dmpFilesize
7.7MB
-
memory/4928-122-0x0000000005500000-0x0000000005510000-memory.dmpFilesize
64KB