Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2024 15:45
Static task
static1
Behavioral task
behavioral1
Sample
2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe
-
Size
1.9MB
-
MD5
2fdafb254cd0b250ce4d2330cfe10d1a
-
SHA1
73fbf34a64f560f236fea960ba7055e211f168f9
-
SHA256
7883a94c3bd1af3f49dd72ff193742c26a849d54ff25cd91a9b78553b0e8d7bf
-
SHA512
3cd78a0b6864d377350b17f8cdbdd72a3bd5879aa6007690077b560efe53f64bfbfaef14c906c16a15bf6f0a6915c9834a6cd6ed1665e848f39588e195520901
-
SSDEEP
49152:W84BBskoGYvcxD8Bvj1j65e6t1UbvIyQ+dp7m4:W8kBnoGfKBpAeeUbgf+Xi
Malware Config
Signatures
-
Luminosity 2 IoCs
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
Processes:
2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exeschtasks.exedescription ioc process File opened for modification C:\Windows\assembly 2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe 3420 schtasks.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation 2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
Tskmgr.exesvhost.exepid process 5060 Tskmgr.exe 4444 svhost.exe -
Adds Run key to start application 2 TTPs 23 IoCs
Processes:
REG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exedescription ioc process File created C:\Windows\assembly\Desktop.ini 2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe File opened for modification C:\Windows\assembly\Desktop.ini 2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exedescription pid process target process PID 2292 set thread context of 4444 2292 2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe svhost.exe -
Drops file in Windows directory 3 IoCs
Processes:
2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\assembly 2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe File created C:\Windows\assembly\Desktop.ini 2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe File opened for modification C:\Windows\assembly\Desktop.ini 2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exeTskmgr.exesvhost.exeschtasks.exepid process 2292 2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe 2292 2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 4444 svhost.exe 4444 svhost.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 3420 schtasks.exe 3420 schtasks.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe 5060 Tskmgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exeTskmgr.exedescription pid process Token: SeDebugPrivilege 2292 2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe Token: SeDebugPrivilege 5060 Tskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Tskmgr.exepid process 5060 Tskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.execmd.exeTskmgr.exedescription pid process target process PID 2292 wrote to memory of 5060 2292 2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe Tskmgr.exe PID 2292 wrote to memory of 5060 2292 2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe Tskmgr.exe PID 2292 wrote to memory of 5060 2292 2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe Tskmgr.exe PID 2292 wrote to memory of 468 2292 2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe cmd.exe PID 2292 wrote to memory of 468 2292 2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe cmd.exe PID 2292 wrote to memory of 468 2292 2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe cmd.exe PID 468 wrote to memory of 4452 468 cmd.exe reg.exe PID 468 wrote to memory of 4452 468 cmd.exe reg.exe PID 468 wrote to memory of 4452 468 cmd.exe reg.exe PID 2292 wrote to memory of 4444 2292 2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe svhost.exe PID 2292 wrote to memory of 4444 2292 2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe svhost.exe PID 2292 wrote to memory of 4444 2292 2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe svhost.exe PID 2292 wrote to memory of 4444 2292 2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe svhost.exe PID 2292 wrote to memory of 4444 2292 2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe svhost.exe PID 2292 wrote to memory of 4444 2292 2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe svhost.exe PID 2292 wrote to memory of 4444 2292 2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe svhost.exe PID 2292 wrote to memory of 4444 2292 2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe svhost.exe PID 5060 wrote to memory of 4964 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 4964 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 4964 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 4444 5060 Tskmgr.exe svhost.exe PID 5060 wrote to memory of 4444 5060 Tskmgr.exe svhost.exe PID 5060 wrote to memory of 4444 5060 Tskmgr.exe svhost.exe PID 5060 wrote to memory of 4444 5060 Tskmgr.exe svhost.exe PID 5060 wrote to memory of 4444 5060 Tskmgr.exe svhost.exe PID 5060 wrote to memory of 3420 5060 Tskmgr.exe schtasks.exe PID 5060 wrote to memory of 3420 5060 Tskmgr.exe schtasks.exe PID 5060 wrote to memory of 3420 5060 Tskmgr.exe schtasks.exe PID 5060 wrote to memory of 4616 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 4616 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 4616 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 3420 5060 Tskmgr.exe schtasks.exe PID 5060 wrote to memory of 3420 5060 Tskmgr.exe schtasks.exe PID 5060 wrote to memory of 3420 5060 Tskmgr.exe schtasks.exe PID 5060 wrote to memory of 3420 5060 Tskmgr.exe schtasks.exe PID 5060 wrote to memory of 3420 5060 Tskmgr.exe schtasks.exe PID 5060 wrote to memory of 1868 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 1868 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 1868 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 4640 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 4640 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 4640 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 4628 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 4628 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 4628 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 4384 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 4384 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 4384 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 3488 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 3488 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 3488 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 4260 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 4260 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 4260 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 824 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 824 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 824 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 4596 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 4596 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 4596 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 1464 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 1464 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 1464 5060 Tskmgr.exe REG.exe PID 5060 wrote to memory of 1548 5060 Tskmgr.exe REG.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2fdafb254cd0b250ce4d2330cfe10d1a_JaffaCakes118.exe"1⤵
- Luminosity
- Checks computer location settings
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Tskmgr.exe"C:\Users\Admin\AppData\Local\Temp\Tskmgr.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /NP /sc onlogon /tn "Client Monitor" /rl highest /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f3⤵
- Luminosity
- Creates scheduled task(s)
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\FolderN\Tskmgr.exe.lnk " /f3⤵
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Tskmgr.exeFilesize
857KB
MD5bc6529f2a93dd5eb328963e0b41a855a
SHA10d3fe448baa8a886fd33541f17e893a8a550640f
SHA256b98c711a375f39574672d49fdb798e70dab73b56c5a605c2cfd55a82d8d1b528
SHA5124b50bc0de71bdbdbe76622d498d70b940e11a5c34b6d58b43765eacb2447d3106da3ac80f3a20e7eed67598bf9875cda9646694724b8fae6d91a7ed97b0bad73
-
C:\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
52KB
MD5a64daca3cfbcd039df3ec29d3eddd001
SHA1eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3
SHA256403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36
SHA512b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479
-
memory/2292-0-0x0000000074682000-0x0000000074683000-memory.dmpFilesize
4KB
-
memory/2292-1-0x0000000074680000-0x0000000074C31000-memory.dmpFilesize
5.7MB
-
memory/2292-2-0x0000000074680000-0x0000000074C31000-memory.dmpFilesize
5.7MB
-
memory/2292-23-0x0000000074680000-0x0000000074C31000-memory.dmpFilesize
5.7MB
-
memory/3420-39-0x00000000012E0000-0x00000000012F7000-memory.dmpFilesize
92KB
-
memory/3420-37-0x00000000012E0000-0x00000000012F7000-memory.dmpFilesize
92KB
-
memory/3420-34-0x00000000012E0000-0x00000000012F7000-memory.dmpFilesize
92KB
-
memory/3420-36-0x0000000000F00000-0x0000000000F01000-memory.dmpFilesize
4KB
-
memory/3420-33-0x00000000012E0000-0x00000000012F7000-memory.dmpFilesize
92KB
-
memory/3420-35-0x00000000012E0000-0x00000000012F7000-memory.dmpFilesize
92KB
-
memory/4444-31-0x00000000056D0000-0x00000000056E7000-memory.dmpFilesize
92KB
-
memory/4444-28-0x00000000056D0000-0x00000000056E7000-memory.dmpFilesize
92KB
-
memory/4444-24-0x00000000056D0000-0x00000000056E7000-memory.dmpFilesize
92KB
-
memory/4444-26-0x00000000056D0000-0x00000000056E7000-memory.dmpFilesize
92KB
-
memory/4444-25-0x00000000056D0000-0x00000000056E7000-memory.dmpFilesize
92KB
-
memory/4444-27-0x00000000056F0000-0x00000000056F1000-memory.dmpFilesize
4KB
-
memory/4444-19-0x0000000000430000-0x000000000050C000-memory.dmpFilesize
880KB
-
memory/5060-32-0x0000000074680000-0x0000000074C31000-memory.dmpFilesize
5.7MB
-
memory/5060-15-0x0000000074680000-0x0000000074C31000-memory.dmpFilesize
5.7MB
-
memory/5060-14-0x0000000074680000-0x0000000074C31000-memory.dmpFilesize
5.7MB
-
memory/5060-13-0x0000000074680000-0x0000000074C31000-memory.dmpFilesize
5.7MB