e64c44186ebe9b3ccebb55b94b83e0074347d29d5b3fff36c7f17fa40e40d9ed

General

Target

fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
Size

173KB
MD5

fb749b67e3b3e6bfdc9cb2467a2c9acb
SHA1

13748074e2b2386de82cfb967487cee2d82a2908
SHA256

e64c44186ebe9b3ccebb55b94b83e0074347d29d5b3fff36c7f17fa40e40d9ed
SHA512

847d724a8a9584f0a7fac2199b9d67acdee97a6a7432b7091f0468cf3d047029172089f9fbe2a23579dd0914bbdb94eb72db43f25bf007759e8073652a38e238
SSDEEP

3072:fhpZNAUncfuKz/Vy3ApP1pqvpkBrMxPSrCHw9SI+VFZfOVmehXvSRkRehfoebNZ:fhzNAZPNBpPnypxNArZSnhAM

Score

7^/10

spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

TrustedInstaller.exe

pid process

4308 TrustedInstaller.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4308	TrustedInstaller.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1856-0-0x0000000001000000-0x0000000001069000-memory.dmp	upx
C:\Windows\SysWOW64\msiexec.vir	upx
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	upx

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe

description	ioc	process
File opened (read-only)	\??\Y:	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened (read-only)	\??\M:	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened (read-only)	\??\P:	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened (read-only)	\??\S:	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened (read-only)	\??\V:	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened (read-only)	\??\K:	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened (read-only)	\??\Q:	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened (read-only)	\??\T:	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened (read-only)	\??\G:	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened (read-only)	\??\H:	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened (read-only)	\??\I:	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened (read-only)	\??\J:	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened (read-only)	\??\L:	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened (read-only)	\??\N:	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened (read-only)	\??\O:	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened (read-only)	\??\R:	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened (read-only)	\??\E:	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened (read-only)	\??\W:	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened (read-only)	\??\X:	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened (read-only)	\??\Z:	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened (read-only)	\??\U:	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe

Drops file in System32 directory 27 IoCs

Processes:

fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\c:\windows\SysWOW64\snmptrap.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\tieringengineservice.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\Agentservice.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\spectrum.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\diagsvcs\diagnosticshub.standardcollector.service.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\sensordataservice.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\sgrmbroker.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\wbem\wmiApsrv.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\perceptionsimulation\perceptionsimulationservice.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\perfhost.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File created	\??\c:\windows\SysWOW64\msiexec.vir	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\Appvclient.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\vssvc.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.vir	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\fxssvc.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\openssh\ssh-agent.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

Processes:

fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\program files (x86)\microsoft\edge\Application\122.0.2365.52\elevation_service.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.vir	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\program files\google\chrome\Application\106.0.5249.119\elevation_service.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\source engine\ose.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\createdump.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe

Drops file in Windows directory 4 IoCs

Processes:

fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exeTrustedInstaller.exe

description	ioc	process
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
File created	C:\Windows\Logs\CBS\CBS.log	TrustedInstaller.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TrustedInstaller.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe

description pid process

Token: SeTakeOwnershipPrivilege 1856 fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1856	fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fb749b67e3b3e6bfdc9cb2467a2c9acb_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3960 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:4700

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4308

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Filesize
567KB

MD5
ff09b9bea0a3b0f11df15781a1b17e24

SHA1
6764d5da68f988e5781b45a8932ea66a101d93e5

SHA256
e06ee44221336d1369456178f75080e9e20fc70d77647c6232c26f7bb3951f8c

SHA512
9dfa5a22b1f5093e919e025aa23f5b5e042681a866b7e584b017762602ebe250a4810be94a968617b24a9e6f1163023034846db7f8bd65f78f628fb4b23c7569

Download Submit
C:\Windows\SysWOW64\msiexec.vir
Filesize
202KB

MD5
562df0364b2179b127995dd5a530c341

SHA1
eb808a6a7a40497640f6749c8e9cb990f1f03b19

SHA256
147f4ecf1848e21add10088deeb10e7186747174945eb67935771166df912f4c

SHA512
4975ca2bece583ce2f51099373a8d5b74a3764bfc95a166b5b9dbe6413d7423f4e0c9ef5ac0f9cffdff43c6c2f185a29f44581e8e159d665ebf7a0464d41316e

Download Submit
C:\Windows\servicing\TrustedInstaller.exe
Filesize
193KB

MD5
805418acd5280e97074bdadca4d95195

SHA1
a69e4f03d775a7a0cc5ed2d5569cbfbb4d31d2d6

SHA256
73684e31ad4afe3fdc525b51ccaacc14d402c92db9c42e3fcbfe1e65524b1c01

SHA512
630a255950c0ae0983ae907d20326adea36ce262c7784428a0811b04726849c929bc9cea338a89e77447a6cec30b0889694158327c002566d3cf5be2bb88e4de

Download Submit
memory/1856-0-0x0000000001000000-0x0000000001069000-memory.dmp

Filesize
420KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads