ac4b37a2facba94ee05030e6ef3a0898b6078a96bbb798ae9c1e6d075827beb2

Analysis

max time kernel
34s
max time network
36s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe
Size 398KB
Sample240420-daa4csfd2v
SHA256 ac4b37a2facba94ee05030e6ef3a0898b6078a96bbb798ae9c1e6d075827beb2
MD5 fbc2c420abf78cac67f0ad1b699d498a
SHA1 6d8b9ca17a5c7ce312108a7a8ea36c5052bc0c05
SHA512 8a131e3bc8d86c9a97c7b749eea520561a92d05a2c7fb02f18facf9be246ad508ba1a73b0ea1779573a800c336b3c3a8265e6532fefa473756d2fcb15f25a569
SSDEEP 12288:0BZHH6OfVl9JvtJ5mVicCocaC+jbDEdzknOhzEvboE:8aOdltJ5mVqMlbarhgvsE
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

bootkit evasion persistence trojan upx

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	7bsxzxl.exe

Executes dropped EXE 9 IoCs

pid	Process
2112	cb.exe
2132	1EuroP.exe
2576	3E4U - Bucks.exe
2632	2IC.exe
2736	6tbp.exe
2496	IR.exe
1252	7bsxzxl.exe
1696	7bsxzxl.exe
848	7bsxzxl.exe

Loads dropped DLL 46 IoCs

pid	Process
2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe
2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe
2112	cb.exe
2112	cb.exe
2112	cb.exe
2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe
2132	1EuroP.exe
2132	1EuroP.exe
2132	1EuroP.exe
2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe
2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe
2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe
2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe
2632	2IC.exe
2632	2IC.exe
2632	2IC.exe
2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe
2576	3E4U - Bucks.exe
2576	3E4U - Bucks.exe
2576	3E4U - Bucks.exe
2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe
2736	6tbp.exe
2736	6tbp.exe
2736	6tbp.exe
2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe
2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe
2496	IR.exe
2496	IR.exe
2496	IR.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2816	rundll32.exe
2496	IR.exe
2496	IR.exe
1252	7bsxzxl.exe
1252	7bsxzxl.exe
1252	7bsxzxl.exe
1852	rundll32.exe
1852	rundll32.exe
1852	rundll32.exe
1852	rundll32.exe
1252	7bsxzxl.exe
1696	7bsxzxl.exe
1696	7bsxzxl.exe
1696	7bsxzxl.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000001739d-79.dat	upx
behavioral1/memory/2576-86-0x00000000013D0000-0x00000000013EB000-memory.dmp	upx
behavioral1/memory/2496-94-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral1/memory/2496-124-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral1/memory/1252-131-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral1/memory/2496-147-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral1/memory/1696-160-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral1/memory/1252-159-0x0000000005B40000-0x0000000005B70000-memory.dmp	upx
behavioral1/memory/1252-158-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral1/memory/848-196-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral1/memory/1696-209-0x0000000000400000-0x0000000000430000-memory.dmp	upx

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ureyeg = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\wlstefmr.dll\",Startup"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\46f2 = "C:\\Users\\Admin\\AppData\\Roaming\\7bsxzxl.exe"	IR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	Rundll32.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IR.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\physicaldrive0	2IC.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.app.log	Rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	7bsxzxl.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2600	sc.exe
2776	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IR.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	7bsxzxl.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2576	3E4U - Bucks.exe
2576	3E4U - Bucks.exe
2816	rundll32.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeRestorePrivilege	1944	Rundll32.exe
Token: SeRestorePrivilege	1944	Rundll32.exe
Token: SeRestorePrivilege	1944	Rundll32.exe
Token: SeRestorePrivilege	1944	Rundll32.exe
Token: SeRestorePrivilege	1944	Rundll32.exe
Token: SeRestorePrivilege	1944	Rundll32.exe
Token: SeRestorePrivilege	1944	Rundll32.exe
Token: SeShutdownPrivilege	2632	2IC.exe
Token: SeRestorePrivilege	1696	7bsxzxl.exe
Token: SeRestorePrivilege	1696	7bsxzxl.exe
Token: SeRestorePrivilege	1696	7bsxzxl.exe
Token: SeRestorePrivilege	1696	7bsxzxl.exe
Token: SeRestorePrivilege	1696	7bsxzxl.exe
Token: SeRestorePrivilege	1696	7bsxzxl.exe
Token: SeRestorePrivilege	1696	7bsxzxl.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2736	6tbp.exe
2816	rundll32.exe
2496	IR.exe
2496	IR.exe
2496	IR.exe
1252	7bsxzxl.exe
1252	7bsxzxl.exe
1252	7bsxzxl.exe
1852	rundll32.exe
1696	7bsxzxl.exe
1696	7bsxzxl.exe
1696	7bsxzxl.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2112	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	28
PID 2932 wrote to memory of 2112	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	28
PID 2932 wrote to memory of 2112	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	28
PID 2932 wrote to memory of 2112	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	28
PID 2932 wrote to memory of 2112	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	28
PID 2932 wrote to memory of 2112	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	28
PID 2932 wrote to memory of 2112	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	28
PID 2932 wrote to memory of 2132	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	29
PID 2932 wrote to memory of 2132	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	29
PID 2932 wrote to memory of 2132	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	29
PID 2932 wrote to memory of 2132	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	29
PID 2932 wrote to memory of 2132	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	29
PID 2932 wrote to memory of 2132	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	29
PID 2932 wrote to memory of 2132	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	29
PID 2932 wrote to memory of 2632	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	30
PID 2932 wrote to memory of 2632	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	30
PID 2932 wrote to memory of 2632	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	30
PID 2932 wrote to memory of 2632	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	30
PID 2932 wrote to memory of 2632	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	30
PID 2932 wrote to memory of 2632	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	30
PID 2932 wrote to memory of 2632	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	30
PID 2932 wrote to memory of 2576	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	31
PID 2932 wrote to memory of 2576	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	31
PID 2932 wrote to memory of 2576	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	31
PID 2932 wrote to memory of 2576	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	31
PID 2932 wrote to memory of 2576	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	31
PID 2932 wrote to memory of 2576	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	31
PID 2932 wrote to memory of 2576	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	31
PID 2932 wrote to memory of 2736	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	32
PID 2932 wrote to memory of 2736	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	32
PID 2932 wrote to memory of 2736	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	32
PID 2932 wrote to memory of 2736	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	32
PID 2932 wrote to memory of 2736	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	32
PID 2932 wrote to memory of 2736	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	32
PID 2932 wrote to memory of 2736	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	32
PID 2932 wrote to memory of 2496	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	33
PID 2932 wrote to memory of 2496	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	33
PID 2932 wrote to memory of 2496	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	33
PID 2932 wrote to memory of 2496	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	33
PID 2932 wrote to memory of 2496	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	33
PID 2932 wrote to memory of 2496	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	33
PID 2932 wrote to memory of 2496	2932	fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe	33
PID 2736 wrote to memory of 2816	2736	6tbp.exe	34
PID 2736 wrote to memory of 2816	2736	6tbp.exe	34
PID 2736 wrote to memory of 2816	2736	6tbp.exe	34
PID 2736 wrote to memory of 2816	2736	6tbp.exe	34
PID 2736 wrote to memory of 2816	2736	6tbp.exe	34
PID 2736 wrote to memory of 2816	2736	6tbp.exe	34
PID 2736 wrote to memory of 2816	2736	6tbp.exe	34
PID 2496 wrote to memory of 2704	2496	IR.exe	36
PID 2496 wrote to memory of 2704	2496	IR.exe	36
PID 2496 wrote to memory of 2704	2496	IR.exe	36
PID 2496 wrote to memory of 2704	2496	IR.exe	36
PID 2496 wrote to memory of 2704	2496	IR.exe	36
PID 2496 wrote to memory of 2704	2496	IR.exe	36
PID 2496 wrote to memory of 2704	2496	IR.exe	36
PID 2496 wrote to memory of 2600	2496	IR.exe	37
PID 2496 wrote to memory of 2600	2496	IR.exe	37
PID 2496 wrote to memory of 2600	2496	IR.exe	37
PID 2496 wrote to memory of 2600	2496	IR.exe	37
PID 2496 wrote to memory of 2600	2496	IR.exe	37
PID 2496 wrote to memory of 2600	2496	IR.exe	37
PID 2496 wrote to memory of 2600	2496	IR.exe	37
PID 2496 wrote to memory of 2764	2496	IR.exe	39

C:\Users\Admin\AppData\Local\Temp\fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fbc2c420abf78cac67f0ad1b699d498a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\nsd1805.tmp\cb.exe
  "C:\Users\Admin\AppData\Local\Temp\nsd1805.tmp\cb.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2112
- C:\Users\Admin\AppData\Local\Temp\nsd1805.tmp\1EuroP.exe
  "C:\Users\Admin\AppData\Local\Temp\nsd1805.tmp\1EuroP.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2132
- C:\Users\Admin\AppData\Local\Temp\nsd1805.tmp\2IC.exe
  "C:\Users\Admin\AppData\Local\Temp\nsd1805.tmp\2IC.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of AdjustPrivilegeToken
  PID:2632
- C:\Users\Admin\AppData\Local\Temp\nsd1805.tmp\3E4U - Bucks.exe
  "C:\Users\Admin\AppData\Local\Temp\nsd1805.tmp\3E4U - Bucks.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2576
- C:\Users\Admin\AppData\Local\Temp\nsd1805.tmp\6tbp.exe
  "C:\Users\Admin\AppData\Local\Temp\nsd1805.tmp\6tbp.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\wlstefmr.dll",Startup
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2816
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\wlstefmr.dll",iep
      4⤵
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1852
- C:\Users\Admin\AppData\Local\Temp\nsd1805.tmp\IR.exe
  "C:\Users\Admin\AppData\Local\Temp\nsd1805.tmp\IR.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Windows\SysWOW64\net.exe
    net.exe stop "Security Center"
    3⤵
    PID:2704
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Security Center"
      4⤵
      PID:1316
- - C:\Windows\SysWOW64\sc.exe
    sc config wscsvc start= DISABLED
    3⤵
    - Launches sc.exe
    PID:2600
- - C:\Windows\SysWOW64\net.exe
    net.exe stop "Windows Firewall/Internet Connection Sharing (ICS)"
    3⤵
    PID:2764
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
      4⤵
      PID:1236
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= DISABLED
    3⤵
    - Launches sc.exe
    PID:2776
- - C:\Users\Admin\AppData\Roaming\7bsxzxl.exe
    C:\Users\Admin\AppData\Roaming\7bsxzxl.exe
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1252
  - - C:\Users\Admin\AppData\Roaming\7bsxzxl.exe
      C:\Users\Admin\AppData\Roaming\7bsxzxl.exe -d2F3C2FC513D42DF240B1CFE8FBBF5E5B33A6ABDB8CEE7DB49FF34D3B38EE056DA5D9A0BD4D31DB85255155FAC9F7D4FC32F1866E6FC47824C4FD9AE61A650674ADE468C7525AB75BCF8E9FD81DE6474D8BBC652917A6B2B27CCE3E56C5313BBD663130222739B30369AF24738C4FF8AD7BC690A3AAF1BC8B1436531DEE9188392B3DE049115300C762539FCCEC2968E87E9390908D7767251982326D8A6B0BED9BFEA3DE95F30E206631085251CF58FA513A2F9C6446C472585573FCCE8A27FC91EEE1F379348E75621298021180C88DF24C7633155825A9DD3EF1612FE97CAB2C90424EC17373C28485C958C00AFAB99DA8AD84C5B619ADF646C34B619AEC87C826B11BB139EB5F38DF536F337A6FA9D0705D64D8F772E93007420A5BF697AD014D55A2D09B6A572B152E51809EE804489E50EAF4764273586B087F5029DEACB6F898E2E2069F204A5B95D8FB3A6681010A8ECEFE7BD9257AD3EE84B652631B02672439EDF37BD0C311015D3AEC2A4D389761091A49C7F4E41F0D1942C205BE446BE028344430C4027129BA11FDB4386B65516AAE9DDFA52390BECEE9F3E8FD187FF65F3E9C2F66B4370862954EC60C57F527C45E1331DA04219926E0996A735AF9CF8CCE862808C776D6541CA3611DF810
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1696
    - - C:\7bsxzxl.exe
        
        \7bsxzxl.exe
        5⤵
        Executes dropped EXE
        
        PID:848
    - - C:\Windows\SysWOW64\Rundll32.exe
        
        Rundll32.exe setupapi,InstallHinfSection DefaultInstall 128 \mdinstall.inf
        5⤵
        
        PID:2624
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c \oguohrym.bat
        5⤵
        
        PID:2436
- - C:\Windows\SysWOW64\Rundll32.exe
    Rundll32.exe setupapi,InstallHinfSection DefaultInstall 128 C:\Users\Admin\AppData\Roaming\mdinstall.inf
    3⤵
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:1944
  - - C:\Windows\SysWOW64\runonce.exe
      "C:\Windows\system32\runonce.exe" -r
      4⤵
      Checks processor information in registry
      PID:1568
    - - C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        5⤵
        
        PID:1924
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Roaming\nfunhqxl.bat
    3⤵
    PID:1060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RGI9D59.tmp

Path C:\Users\Admin\AppData\Local\Temp\RGI9D59.tmp
Size 24KB
SHA256 d23dd97fb2b812af621146a912d2cdaccff29e836ba33266d1f81e083ad1c39d
MD5 73d1da91a59b3cb4715e28bfc6cb95e4
SHA1 45fbd7d45b5a805cfd708bbde0092455de2b657f
SHA512 1cc73b0fb0c8f3f53e039071dfc15e8b5f4e4872f66f1dfb4a37532f48417dfa227564f024ebf472635690f2c284ff0c53c14fe4b9854f0b660be854afa350dd
SSDEEP 192:D161V1+hcTueeCSh5e29gEK6WK2SpCSPQVsYIF8SYLzoDpjF/qTUqYjZ2l5gnJQn:D12+hcTueeCSXe29KSLIzw3VgYJQn
MD5 SHA1 SHA512 SSDEEP

Submit Download

2IC.exe

Path C:\Users\Admin\AppData\Local\Temp\nsd1805.tmp\2IC.exe
Size 168KB
SHA256 28e120376e926940dc45f8cc2f9193457bf8b89671901453d30e996ca617a29a
MD5 84d7956209c39cde3b9b02d1b6c64113
SHA1 9feb8cb82f178be3180d033d9b1715b0d5114c58
SHA512 03a55ad0b5ec4913b3a53b6cb67afbf661c0321a6e059a6e01272c9e7fc10935c2f9297640d905eeb3d00a1b5154269052be4b6bf74627c3577722ea7c91ee18
SSDEEP 3072:IEbSG8knnKvrTh0gRXjtWxcm4aSJfnL36NxqHSWsMNgHpvQ5tjS9YLIoKjJLP:TbSGhnKvWOskLJf763ES1buf+9bNLP
MD5 SHA1 SHA512 SSDEEP

Submit Download

3E4U - Bucks.exe

Path C:\Users\Admin\AppData\Local\Temp\nsd1805.tmp\3E4U - Bucks.exe
Size 29KB
SHA256 e5775cc832c611d33bae42484d318e62b374fcf8786f11d5ae8087e5fb6d011f
MD5 bc1e9eefab202aa96ca36e2de9e0d167
SHA1 2a7f254e2ede629db228f95075eaa9c74f5f7586
SHA512 8e8c00acae442246de1aaf821d7f0a5a3d77c64f3946ad48caebdf841b790472be2f4bdc6027103ca695f10101869382e5a43aec023164d0fac136bb8528a773
SSDEEP 384:vPKU6vD2sOqxzgE4mDUfWXxpQzg+Rji4J0wWZ1cfXc3eIUH4sYuDLLR:vPKPD5xzVUexpAjiSoZ1cfmewsLV
MD5 SHA1 SHA512 SSDEEP

Submit Download

6tbp.exe

Path C:\Users\Admin\AppData\Local\Temp\nsd1805.tmp\6tbp.exe
Size 112KB
SHA256 7ff56015fd3fe7ccec00eb198318d8647c0c3386974f1889abc632a55ceafa80
MD5 e9f63abc82ffabfaa4c325da1554af7c
SHA1 9bd51f5695225f7a13a44a03d0eac2b1339dab5f
SHA512 2721a5cdae7c0a066defe65b7e9e4f15bab7b0ffbffe0eb72e2c3d21c0f2fe547def37df3ec1c7ccdae7a89383d9514d44f386e0c0ab8f14b69c666f9c8b8ee2
SSDEEP 3072:Vxgo+cPE1xTX/LnMN/1OlRXJdg52qAoCw9lJ:VhJPE1hXDMNQg52qAw9
MD5 SHA1 SHA512 SSDEEP

Submit Download

cb.exe

Path C:\Users\Admin\AppData\Local\Temp\nsd1805.tmp\cb.exe
Size 3KB
SHA256 bd7ca609d2fb63e14d08acab1091579c23e298b4fa2ac1e8d2daaff94fc107be
MD5 46e07fd3a40760fda18cf6b4fc691742
SHA1 53ee1a754bf5e94fa88a6ab8bb6120b4011afcfa
SHA512 ce13f6527cbd13002dca00b71ab38ab12e3f3f7138ada0780ad3f40e7c49946c018a00782ec957b1fd123fb439aabc0d9b3660829dabf10ddcebba08d6e2fbbd
MD5 SHA1 SHA512

Submit Download

mdinstall.inf

Path C:\Users\Admin\AppData\Roaming\mdinstall.inf
Size 410B
SHA256 5d96bec9bc06fd8d7abc11efbb3cb263844ee0416910f63581dd7848b4e1d8dd
MD5 3ccb3b743b0d79505a75476800c90737
SHA1 b5670f123572972883655ef91c69ecc2be987a63
SHA512 09b1cdd4393f515f7569fbccc3f63051823ed7292b6e572bc9a34e4389b727b2914b22118e874864ccb32ef63016b2abd6d84510fd46fdee712fd84be59c114e
MD5 SHA1 SHA512

Submit Download

nfunhqxl.bat

Path C:\Users\Admin\AppData\Roaming\nfunhqxl.bat
Size 154B
SHA256 daa60878f2e1b3308c45f441f024c2c9967deccb66abe41c6060cb60e588bee8
MD5 cfad0aeb0fb50bd76751b231ce918327
SHA1 b96bfdea91a2a1827324d1a5073a0b2d62812359
SHA512 c9b02e89b39014ca79b589f3028056cea1631242bb485a5c38da93aeab595c6fa0008db2173e9af36587c626053408dd5b0a6be7eb65c75b8ce3b6f9429eeddd
MD5 SHA1 SHA512

Submit Download

oguohrym.bat

Path C:\oguohrym.bat
Size 134B
SHA256 ae722709d4f0c006e7835a9d22a4463debf3a7c80893ec3487fae50a7e4206be
MD5 ed27cdac94ff7f57dc182f3fc19d5402
SHA1 105f96643b1c2bfede8074e5c26c0008b8ad5541
SHA512 367014a9e04885da1aa22e8c22ca39a7f3886fdde3b5b1411f016507ec90450b8ffe1b46ba74e5d4687dab66e68f9468d1105ddb8f1ba005a9c5baa54337d455
MD5 SHA1 SHA512

Submit Download

1EuroP.exe

Path \Users\Admin\AppData\Local\Temp\nsd1805.tmp\1EuroP.exe
Size 75KB
SHA256 40abf4fe2142f94b0a9b6ebf933423b47a975b4b6a67332545e9dc7afcfbd1e2
MD5 87fb5442c7843acf787ea54f50d27ef3
SHA1 e2c0bc89abdf1cc14f030633b8520fa488c2ee7c
SHA512 09307d21725976717bd162c019ffccd3f7667eee0506de009df99ce52d220b56452530df51275638a5298ac11ca6ab3b11ce29270e5f8b66c8547f34c407488c
SSDEEP 1536:2M669FOOSQBhgbibVE1qTwswXsLzFali:L7HhgmbVE1qfc+ss
MD5 SHA1 SHA512 SSDEEP

Submit Download

IR.exe

Path \Users\Admin\AppData\Local\Temp\nsd1805.tmp\IR.exe
Size 61KB
SHA256 cd964af4e62c9007c4aaedd9ccab5cf84a78b51e11332ded2b591c81b23872d6
MD5 b4060ce0c8f8a3bad7a63b9fa95c1464
SHA1 f77bb4306747258219f2b97693d62eedc438ccae
SHA512 35eb45b85f3166a5f007465911e04669e8182df1cf23815ab109868507c95479561950faf918afe8d3664a6f0f04492d6742b74369d7e85f1090f964ecb9544e
SSDEEP 1536:btsbUcKv6cNr1D2eu00FXMiX/DR1rNhoVBVI:52odpu0hiX7r3
MD5 SHA1 SHA512 SSDEEP

Submit Download

wlstefmr.dll

Path \Users\Admin\AppData\Local\wlstefmr.dll
Size 112KB
SHA256 0fff9ca615a9371402721e8b3a4c99ef846bff7e5e663b764660edae138f5fa7
MD5 7131c18f90b51938fbe7f4e5744a82b6
SHA1 3c69d3e7b45bd4a6d2aaf8096a6448b93fd4f550
SHA512 dc982b471b0bc27e5358bb5ca3fa948a76d407251f66c040e8499a07e104f41d53a85db398b6bf2e709347dda55dee062005adfd2bc19263051a05ef0382135b
SSDEEP 3072:1xgo+cPE1xTX/LnMN/1OlRXJdg52qAoCw9lJ:1hJPE1hXDMNQg52qAw9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/848-196-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1252-114-0x0000000000230000-0x0000000000260000-memory.dmp

Download

memory/1252-158-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1252-116-0x0000000003790000-0x00000000047F2000-memory.dmp

Download

memory/1252-131-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1252-159-0x0000000005B40000-0x0000000005B70000-memory.dmp

Download

memory/1696-200-0x0000000002720000-0x0000000002750000-memory.dmp

Download

memory/1696-160-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1696-162-0x00000000037C0000-0x0000000004822000-memory.dmp

Download

memory/1696-209-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1852-161-0x0000000002290000-0x00000000022D0000-memory.dmp

Download

memory/2132-133-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/2132-60-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/2132-44-0x0000000000280000-0x00000000002A5000-memory.dmp

Download

memory/2132-117-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/2496-94-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2496-124-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2496-100-0x00000000035E0000-0x0000000004642000-memory.dmp

Download

memory/2496-96-0x0000000000230000-0x0000000000260000-memory.dmp

Download

memory/2496-95-0x0000000000230000-0x0000000000260000-memory.dmp

Download

memory/2496-147-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2576-86-0x00000000013D0000-0x00000000013EB000-memory.dmp

Download

memory/2576-80-0x0000000000D90000-0x0000000000F00000-memory.dmp

Download

memory/2632-81-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2632-98-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2632-85-0x0000000000260000-0x00000000002A0000-memory.dmp

Download

memory/2736-121-0x0000000010000000-0x000000001001C000-memory.dmp

Download

memory/2736-93-0x00000000024C0000-0x0000000002500000-memory.dmp

Download

memory/2736-66-0x0000000010000000-0x000000001001C000-memory.dmp

Download

memory/2816-125-0x0000000010000000-0x000000001001C000-memory.dmp

Download

memory/2816-99-0x0000000000900000-0x0000000000940000-memory.dmp

Download

memory/2816-92-0x0000000010000000-0x000000001001C000-memory.dmp

Download