warzonerat | b503371fbde7b8b385cfad82bc1c2c4b89754daf986982febe95dc4c1c5a1498

Analysis

max time kernel
138s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-05-2024 09:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
Size

2.9MB
MD5

122fbe3a03ec201bdcf3b9e8c7620ad9
SHA1

939ed9f1afa640a55ae901234621d64bb1b14125
SHA256

b503371fbde7b8b385cfad82bc1c2c4b89754daf986982febe95dc4c1c5a1498
SHA512

97fee72ab47bdbbaf99ad1b59151c2bd6e31eebe660bab09f7a6f686198de191ab845d3e81994af9426ca87f889e61614c49b43066d72fd723bd1da007613b10
SSDEEP

24576:ATU7AAmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHd:ATU7AAmw4gxeOw46fUbNecCCFbNecA

Score

10^/10

warzonerat evasion infostealer persistence rat upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
C:\Windows\system\explorer.exe	warzonerat
C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 6 IoCs

Processes:

cmd.execmd.execmd.execmd.execmd.execmd.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe

Executes dropped EXE 31 IoCs

Processes:

explorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

pid	process
1204	explorer.exe
2360	explorer.exe
1452	explorer.exe
1424	spoolsv.exe
2308	spoolsv.exe
1616	spoolsv.exe
2820	spoolsv.exe
2448	spoolsv.exe
2584	spoolsv.exe
1944	spoolsv.exe
1588	spoolsv.exe
1904	spoolsv.exe
1716	spoolsv.exe
580	spoolsv.exe
768	spoolsv.exe
108	spoolsv.exe
2484	spoolsv.exe
2280	spoolsv.exe
3008	spoolsv.exe
2844	spoolsv.exe
3064	spoolsv.exe
1484	spoolsv.exe
2616	spoolsv.exe
940	spoolsv.exe
2140	spoolsv.exe
2124	spoolsv.exe
2000	spoolsv.exe
1312	spoolsv.exe
1700	spoolsv.exe
1584	spoolsv.exe
2168	spoolsv.exe

Loads dropped DLL 44 IoCs

Processes:

122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

pid	process
1916	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
1916	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
1452	explorer.exe
1452	explorer.exe
1424	spoolsv.exe
1452	explorer.exe
1452	explorer.exe
1616	spoolsv.exe
1452	explorer.exe
1452	explorer.exe
2448	spoolsv.exe
1452	explorer.exe
1452	explorer.exe
1944	spoolsv.exe
1452	explorer.exe
1452	explorer.exe
1588	spoolsv.exe
1452	explorer.exe
1452	explorer.exe
580	spoolsv.exe
1452	explorer.exe
1452	explorer.exe
108	spoolsv.exe
1452	explorer.exe
1452	explorer.exe
2484	spoolsv.exe
1452	explorer.exe
1452	explorer.exe
2844	spoolsv.exe
1452	explorer.exe
1452	explorer.exe
1484	spoolsv.exe
1452	explorer.exe
1452	explorer.exe
940	spoolsv.exe
1452	explorer.exe
1452	explorer.exe
2124	spoolsv.exe
1452	explorer.exe
1452	explorer.exe
1312	spoolsv.exe
1452	explorer.exe
1452	explorer.exe
1584	spoolsv.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2224-0-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2224-43-0x0000000000400000-0x0000000000446000-memory.dmp	upx
C:\Windows\system\explorer.exe	upx
behavioral1/memory/1204-101-0x0000000000400000-0x0000000000446000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe	upx
\Windows\system\spoolsv.exe	upx
behavioral1/memory/1424-198-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1616-252-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2448-305-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1944-361-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1588-410-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/580-505-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/108-529-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/108-536-0x0000000000450000-0x0000000000496000-memory.dmp	upx
behavioral1/memory/2484-578-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/2844-644-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/940-756-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/1484-713-0x0000000000400000-0x0000000000446000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exeexplorer.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 20 IoCs

Processes:

122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

description	pid	process	target process
PID 2224 set thread context of 2896	2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2896 set thread context of 1916	2896	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2896 set thread context of 2848	2896	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	diskperf.exe
PID 1204 set thread context of 2360	1204	explorer.exe	explorer.exe
PID 2360 set thread context of 1452	2360	explorer.exe	explorer.exe
PID 2360 set thread context of 1364	2360	explorer.exe	diskperf.exe
PID 1424 set thread context of 2308	1424	spoolsv.exe	spoolsv.exe
PID 1616 set thread context of 2820	1616	spoolsv.exe	spoolsv.exe
PID 2448 set thread context of 2584	2448	spoolsv.exe	spoolsv.exe
PID 1944 set thread context of 1904	1944	spoolsv.exe	spoolsv.exe
PID 1588 set thread context of 1716	1588	spoolsv.exe	spoolsv.exe
PID 580 set thread context of 768	580	spoolsv.exe	spoolsv.exe
PID 108 set thread context of 2280	108	spoolsv.exe	spoolsv.exe
PID 2484 set thread context of 3008	2484	spoolsv.exe	spoolsv.exe
PID 2844 set thread context of 3064	2844	spoolsv.exe	spoolsv.exe
PID 1484 set thread context of 2616	1484	spoolsv.exe	spoolsv.exe
PID 940 set thread context of 2140	940	spoolsv.exe	spoolsv.exe
PID 2124 set thread context of 2000	2124	spoolsv.exe	spoolsv.exe
PID 1312 set thread context of 1700	1312	spoolsv.exe	spoolsv.exe
PID 1584 set thread context of 2168	1584	spoolsv.exe	spoolsv.exe

Drops file in Windows directory 18 IoCs

Processes:

122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

description	ioc	process
File opened for modification	\??\c:\windows\system\explorer.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes:

122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

pid	process
2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
1916	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
1204	explorer.exe
1424	spoolsv.exe
1452	explorer.exe
1452	explorer.exe
1616	spoolsv.exe
1452	explorer.exe
2448	spoolsv.exe
1452	explorer.exe
1944	spoolsv.exe
1452	explorer.exe
1588	spoolsv.exe
1452	explorer.exe
580	spoolsv.exe
1452	explorer.exe
108	spoolsv.exe
1452	explorer.exe
2484	spoolsv.exe
1452	explorer.exe
2844	spoolsv.exe
1452	explorer.exe
1484	spoolsv.exe
1452	explorer.exe
940	spoolsv.exe
1452	explorer.exe
2124	spoolsv.exe
1452	explorer.exe
1312	spoolsv.exe
1452	explorer.exe
1584	spoolsv.exe

Suspicious use of SetWindowsHookEx 38 IoCs

Processes:

pid	process
2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
1916	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
1916	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
1204	explorer.exe
1204	explorer.exe
1452	explorer.exe
1452	explorer.exe
1424	spoolsv.exe
1424	spoolsv.exe
1452	explorer.exe
1452	explorer.exe
1616	spoolsv.exe
1616	spoolsv.exe
2448	spoolsv.exe
2448	spoolsv.exe
1944	spoolsv.exe
1944	spoolsv.exe
1588	spoolsv.exe
1588	spoolsv.exe
580	spoolsv.exe
580	spoolsv.exe
108	spoolsv.exe
108	spoolsv.exe
2484	spoolsv.exe
2484	spoolsv.exe
2844	spoolsv.exe
2844	spoolsv.exe
1484	spoolsv.exe
1484	spoolsv.exe
940	spoolsv.exe
940	spoolsv.exe
2124	spoolsv.exe
2124	spoolsv.exe
1312	spoolsv.exe
1312	spoolsv.exe
1584	spoolsv.exe
1584	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exeexplorer.exe

description	pid	process	target process
PID 2224 wrote to memory of 2772	2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	cmd.exe
PID 2224 wrote to memory of 2772	2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	cmd.exe
PID 2224 wrote to memory of 2772	2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	cmd.exe
PID 2224 wrote to memory of 2772	2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	cmd.exe
PID 2224 wrote to memory of 2896	2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2224 wrote to memory of 2896	2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2224 wrote to memory of 2896	2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2224 wrote to memory of 2896	2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2224 wrote to memory of 2896	2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2224 wrote to memory of 2896	2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2224 wrote to memory of 2896	2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2224 wrote to memory of 2896	2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2224 wrote to memory of 2896	2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2224 wrote to memory of 2896	2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2224 wrote to memory of 2896	2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2224 wrote to memory of 2896	2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2224 wrote to memory of 2896	2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2224 wrote to memory of 2896	2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2224 wrote to memory of 2896	2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2224 wrote to memory of 2896	2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2224 wrote to memory of 2896	2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2224 wrote to memory of 2896	2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2224 wrote to memory of 2896	2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2224 wrote to memory of 2896	2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2224 wrote to memory of 2896	2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2224 wrote to memory of 2896	2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2224 wrote to memory of 2896	2224	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2896 wrote to memory of 1916	2896	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2896 wrote to memory of 1916	2896	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2896 wrote to memory of 1916	2896	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2896 wrote to memory of 1916	2896	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2896 wrote to memory of 1916	2896	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2896 wrote to memory of 1916	2896	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2896 wrote to memory of 1916	2896	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2896 wrote to memory of 1916	2896	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2896 wrote to memory of 1916	2896	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
PID 2896 wrote to memory of 2848	2896	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	diskperf.exe
PID 2896 wrote to memory of 2848	2896	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	diskperf.exe
PID 2896 wrote to memory of 2848	2896	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	diskperf.exe
PID 2896 wrote to memory of 2848	2896	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	diskperf.exe
PID 2896 wrote to memory of 2848	2896	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	diskperf.exe
PID 2896 wrote to memory of 2848	2896	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	diskperf.exe
PID 1916 wrote to memory of 1204	1916	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	explorer.exe
PID 1916 wrote to memory of 1204	1916	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	explorer.exe
PID 1916 wrote to memory of 1204	1916	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	explorer.exe
PID 1916 wrote to memory of 1204	1916	122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe	explorer.exe
PID 1204 wrote to memory of 1540	1204	explorer.exe	cmd.exe
PID 1204 wrote to memory of 1540	1204	explorer.exe	cmd.exe
PID 1204 wrote to memory of 1540	1204	explorer.exe	cmd.exe
PID 1204 wrote to memory of 1540	1204	explorer.exe	cmd.exe
PID 1204 wrote to memory of 2360	1204	explorer.exe	explorer.exe
PID 1204 wrote to memory of 2360	1204	explorer.exe	explorer.exe
PID 1204 wrote to memory of 2360	1204	explorer.exe	explorer.exe
PID 1204 wrote to memory of 2360	1204	explorer.exe	explorer.exe
PID 1204 wrote to memory of 2360	1204	explorer.exe	explorer.exe
PID 1204 wrote to memory of 2360	1204	explorer.exe	explorer.exe
PID 1204 wrote to memory of 2360	1204	explorer.exe	explorer.exe
PID 1204 wrote to memory of 2360	1204	explorer.exe	explorer.exe
PID 1204 wrote to memory of 2360	1204	explorer.exe	explorer.exe
PID 1204 wrote to memory of 2360	1204	explorer.exe	explorer.exe
PID 1204 wrote to memory of 2360	1204	explorer.exe	explorer.exe
PID 1204 wrote to memory of 2360	1204	explorer.exe	explorer.exe
PID 1204 wrote to memory of 2360	1204	explorer.exe	explorer.exe
PID 1204 wrote to memory of 2360	1204	explorer.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
2⤵
- Drops startup file
PID:2772

C:\Users\Admin\AppData\Local\Temp\122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2896

C:\Users\Admin\AppData\Local\Temp\122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\122fbe3a03ec201bdcf3b9e8c7620ad9_JaffaCakes118.exe
3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
5⤵
- Drops startup file
PID:1540

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2360

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1452

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1424

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:3020

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:2308

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
9⤵
PID:2844

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
10⤵
PID:1656

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
11⤵
PID:3060

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
11⤵
PID:1040

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
9⤵
PID:2340

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1616

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:2824

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:2820

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
9⤵
PID:268

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
10⤵
PID:1428

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
11⤵
PID:2184

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
11⤵
PID:2572

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
9⤵
PID:1804

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2448

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:2864

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:2584

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
9⤵
PID:1260

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
9⤵
PID:1884

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1944

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:2524

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:1904

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1588

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:2116

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:1716

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:580

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:668

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:768

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:108

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:2184

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:2280

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2484

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:456

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:3008

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2844

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:2464

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:3064

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1484

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:2880

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:2616

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:940

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:1588

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:2140

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2124

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:1892

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:2000

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1312

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
- Drops startup file
PID:2952

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:1700

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1584

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:1756

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
- Executes dropped EXE
PID:2168

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:2604

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:876

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
PID:2736

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:2424

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:2676

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
PID:2020

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:2796

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
8⤵
PID:868

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe
8⤵
PID:1608

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
6⤵
PID:1364

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
3⤵
PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

Filesize
2.9MB

MD5
122fbe3a03ec201bdcf3b9e8c7620ad9

SHA1
939ed9f1afa640a55ae901234621d64bb1b14125

SHA256
b503371fbde7b8b385cfad82bc1c2c4b89754daf986982febe95dc4c1c5a1498

SHA512
97fee72ab47bdbbaf99ad1b59151c2bd6e31eebe660bab09f7a6f686198de191ab845d3e81994af9426ca87f889e61614c49b43066d72fd723bd1da007613b10

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs

Filesize
93B

MD5
8445bfa5a278e2f068300c604a78394b

SHA1
9fb4eef5ec2606bd151f77fdaa219853d4aa0c65

SHA256
5ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c

SHA512
8ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs

Filesize
92B

MD5
13222a4bb413aaa8b92aa5b4f81d2760

SHA1
268a48f2fe84ed49bbdc1873a8009db8c7cba66a

SHA256
d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d

SHA512
eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140

Download Submit
C:\Windows\system\explorer.exe

Filesize
2.9MB

MD5
af9cad8455881fd9150a2f6342c58a61

SHA1
b897d0a011bf6a3b7ca159d49db237d4c4fe7643

SHA256
0706d0a406c40d992009950ef1c4b286a887f96c88a2bde5e2c038a4bf9aabe7

SHA512
abf64a0d5e3333da319fa5de000b08049c92d0f98b240ac4943f3eb7bdf2a0e28c6b851d7dbb8d682a1811fdaa9adf736f9eebbfc73f5208708c494b1fbdf51c

Download Submit
\Windows\system\spoolsv.exe

Filesize
2.9MB

MD5
51901dc60fd04c6bff92a34538d60c83

SHA1
b6395397477fc9cb5880cfc72fd9c910d3678a61

SHA256
687b18ab9b16a5886639970414f4458e6c6d8df8b59836935062205a5699bb04

SHA512
b3ab9310e332417fc749d3ba78fe8af992d25120460d15bbf8c1b52b90e9b0d9272f2d23d749634c5c396318c75fcd1cf61bf92a1a0450fe624b726661bba12e

Download Submit
memory/108-536-0x0000000000450000-0x0000000000496000-memory.dmp

Filesize
280KB

Download
memory/108-529-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/580-505-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/768-523-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/940-756-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1204-101-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1424-198-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1452-527-0x0000000002B30000-0x0000000002B76000-memory.dmp

Filesize
280KB

Download
memory/1452-360-0x0000000002B30000-0x0000000002B76000-memory.dmp

Filesize
280KB

Download
memory/1452-799-0x0000000002B30000-0x0000000002B76000-memory.dmp

Filesize
280KB

Download
memory/1452-804-0x0000000002B30000-0x0000000002B76000-memory.dmp

Filesize
280KB

Download
memory/1452-711-0x0000000002B30000-0x0000000002B76000-memory.dmp

Filesize
280KB

Download
memory/1452-194-0x0000000002B30000-0x0000000002B76000-memory.dmp

Filesize
280KB

Download
memory/1452-721-0x0000000002B30000-0x0000000002B76000-memory.dmp

Filesize
280KB

Download
memory/1452-727-0x0000000002B30000-0x0000000002B76000-memory.dmp

Filesize
280KB

Download
memory/1452-754-0x0000000002B30000-0x0000000002B76000-memory.dmp

Filesize
280KB

Download
memory/1452-643-0x0000000002B30000-0x0000000002B76000-memory.dmp

Filesize
280KB

Download
memory/1452-641-0x0000000002B30000-0x0000000002B76000-memory.dmp

Filesize
280KB

Download
memory/1452-632-0x0000000002B30000-0x0000000002B76000-memory.dmp

Filesize
280KB

Download
memory/1452-576-0x0000000002B30000-0x0000000002B76000-memory.dmp

Filesize
280KB

Download
memory/1452-577-0x0000000002B30000-0x0000000002B76000-memory.dmp

Filesize
280KB

Download
memory/1452-533-0x0000000002B30000-0x0000000002B76000-memory.dmp

Filesize
280KB

Download
memory/1452-408-0x0000000002B30000-0x0000000002B76000-memory.dmp

Filesize
280KB

Download
memory/1452-475-0x0000000002B30000-0x0000000002B76000-memory.dmp

Filesize
280KB

Download
memory/1452-476-0x0000000002B30000-0x0000000002B76000-memory.dmp

Filesize
280KB

Download
memory/1452-303-0x0000000002B30000-0x0000000002B76000-memory.dmp

Filesize
280KB

Download
memory/1452-358-0x0000000002B30000-0x0000000002B76000-memory.dmp

Filesize
280KB

Download
memory/1452-409-0x0000000002B30000-0x0000000002B76000-memory.dmp

Filesize
280KB

Download
memory/1452-357-0x0000000002B30000-0x0000000002B76000-memory.dmp

Filesize
280KB

Download
memory/1452-195-0x0000000002B30000-0x0000000002B76000-memory.dmp

Filesize
280KB

Download
memory/1484-713-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1588-410-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1588-423-0x0000000000450000-0x0000000000496000-memory.dmp

Filesize
280KB

Download
memory/1616-252-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1716-504-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1904-416-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/1916-75-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1916-147-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1916-62-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1916-60-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1916-95-0x0000000002530000-0x0000000002576000-memory.dmp

Filesize
280KB

Download
memory/1916-58-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1916-71-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1944-372-0x00000000003A0000-0x00000000003E6000-memory.dmp

Filesize
280KB

Download
memory/1944-361-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2140-803-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2224-43-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2224-2-0x00000000003B0000-0x00000000003F6000-memory.dmp

Filesize
280KB

Download
memory/2224-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2280-608-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2308-253-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2308-1004-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2360-150-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2360-187-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2448-305-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2448-314-0x0000000001D70000-0x0000000001DB6000-memory.dmp

Filesize
280KB

Download
memory/2484-607-0x0000000000390000-0x00000000003D6000-memory.dmp

Filesize
280KB

Download
memory/2484-578-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2584-354-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2584-1158-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2616-755-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2820-298-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/2820-1150-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/2844-644-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2848-76-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2848-90-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2896-48-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2896-38-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2896-34-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2896-85-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2896-16-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2896-4-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2896-24-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2896-18-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2896-53-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2896-21-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2896-3-0x0000000000300000-0x0000000000400000-memory.dmp

Filesize
1024KB

Download
memory/2896-28-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2896-55-0x00000000004E7000-0x0000000000513000-memory.dmp

Filesize
176KB

Download
memory/2896-30-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2896-32-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2896-44-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2896-69-0x0000000008AF0000-0x0000000008B36000-memory.dmp

Filesize
280KB

Download
memory/2896-9-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2896-12-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2896-50-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2896-41-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2896-49-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2896-42-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2896-51-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2896-46-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2896-45-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2896-23-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2896-11-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2896-47-0x00000000004E7000-0x0000000000513000-memory.dmp

Filesize
176KB

Download
memory/2896-14-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2896-26-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2896-52-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/2896-6-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2896-39-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/3008-634-0x0000000000400000-0x0000000001990000-memory.dmp

Filesize
21.6MB

Download
memory/3064-731-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download