Overview
overview
7Static
static
730648d1ae8...18.exe
windows7-x64
730648d1ae8...18.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
7$PLUGINSDI...ll.dll
windows10-2004-x64
7$_1_/Modules/clc.dll
windows7-x64
1$_1_/Modules/clc.dll
windows10-2004-x64
1$_1_/Modules/crm.dll
windows7-x64
1$_1_/Modules/crm.dll
windows10-2004-x64
1$_1_/Modules/wis.dll
windows7-x64
1$_1_/Modules/wis.dll
windows10-2004-x64
1$_1_/RtHelp.exe
windows7-x64
1$_1_/RtHelp.exe
windows10-2004-x64
1$_1_/msvcp110.dll
windows7-x64
3$_1_/msvcp110.dll
windows10-2004-x64
3$_1_/msvcr110.dll
windows7-x64
3$_1_/msvcr110.dll
windows10-2004-x64
3Modules/7z.dll
windows7-x64
1Modules/7z.dll
windows10-2004-x64
3Modules/cdp.dll
windows7-x64
1Modules/cdp.dll
windows10-2004-x64
1Modules/clc.dll
windows7-x64
1Modules/clc.dll
windows10-2004-x64
1Modules/crm.dll
windows7-x64
1Modules/crm.dll
windows10-2004-x64
1Modules/cus.dll
windows7-x64
1Modules/cus.dll
windows10-2004-x64
1Modules/nls.dll
windows7-x64
3Modules/nls.dll
windows10-2004-x64
3Analysis
- max time kernel
123s - max time network
98s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
10/05/2024, 18:13
Behavioral task
behavioral1
Sample
30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/UpdHelper.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/UpdHelper.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/md5dll.dll
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/md5dll.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
$_1_/Modules/clc.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
$_1_/Modules/clc.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
$_1_/Modules/crm.dll
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
$_1_/Modules/crm.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
$_1_/Modules/wis.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
$_1_/Modules/wis.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
$_1_/RtHelp.exe
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
$_1_/RtHelp.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
$_1_/msvcp110.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
$_1_/msvcp110.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
$_1_/msvcr110.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral20
Sample
$_1_/msvcr110.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral21
Sample
Modules/7z.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
Modules/7z.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral23
Sample
Modules/cdp.dll
Resource
win7-20240215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
Modules/cdp.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
Modules/clc.dll
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
Modules/clc.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
Modules/crm.dll
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
Modules/crm.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral29
Sample
Modules/cus.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
Modules/cus.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
Modules/nls.dll
Resource
win7-20240419-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral32
Sample
Modules/nls.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe
- Size 1.8MB
- Sample240510-wt4h5adf48
- SHA256 20a482d03485031a84636bc19152f63564cd2bc3eb10be1023c2e51126686106
- MD5 30648d1ae860e714f0538b6898d41fc2
- SHA1 cfca2425c79dfb90d809662dccded8ff3bf2434d
- SHA512 b94ea3382fb6d922bc0f723dd31b04bd01bcfa3599737c742958db67d60a4bd85b2c652a8402cddba9be967725a4fc2d19e20c745bf860e21402f43aac57eccf
- SSDEEP 24576:yrMM8KDlavjUEQElhcjUuS+kQ0LaSA8o19MNMeE5GKSL1hCGjOFCYzfCADRXriJN:yrMMjlavoRkQb8CuMebPbNYR2iuKk
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 14 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/memory/1816-37-0x00000000023B0000-0x00000000023BA000-memory.dmp acprotect behavioral2/memory/1816-34-0x00000000023B0000-0x00000000023BA000-memory.dmp acprotect behavioral2/files/0x00070000000233f4-36.dat acprotect behavioral2/memory/1816-126-0x00000000023B0000-0x00000000023BA000-memory.dmp acprotect behavioral2/memory/1816-111-0x00000000023B0000-0x00000000023BA000-memory.dmp acprotect behavioral2/memory/1816-102-0x00000000023B0000-0x00000000023BA000-memory.dmp acprotect behavioral2/memory/1816-101-0x00000000023B0000-0x00000000023BA000-memory.dmp acprotect behavioral2/memory/1816-92-0x00000000023B0000-0x00000000023BA000-memory.dmp acprotect behavioral2/memory/1816-84-0x00000000023B0000-0x00000000023BA000-memory.dmp acprotect behavioral2/memory/1816-75-0x00000000023B0000-0x00000000023BA000-memory.dmp acprotect behavioral2/memory/1816-177-0x00000000023B0000-0x00000000023BA000-memory.dmp acprotect behavioral2/memory/1816-178-0x00000000023B0000-0x00000000023BA000-memory.dmp acprotect behavioral2/memory/1816-179-0x00000000023B0000-0x00000000023BA000-memory.dmp acprotect behavioral2/memory/1816-180-0x00000000023B0000-0x00000000023BA000-memory.dmp acprotect - Executes dropped EXE 6 IoCs
pid Process 4040 RtHelp.exe 2104 RtHelp.exe 4788 Runner.exe 3732 Runner.exe 4736 nsi242A.tmp 2752 Runner.exe - Loads dropped DLL 61 IoCs
pid Process 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 4040 RtHelp.exe 4040 RtHelp.exe 4040 RtHelp.exe 4040 RtHelp.exe 4040 RtHelp.exe 4040 RtHelp.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 2104 RtHelp.exe 2104 RtHelp.exe 2104 RtHelp.exe 2104 RtHelp.exe 2104 RtHelp.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 4788 Runner.exe 4788 Runner.exe 4788 Runner.exe 4788 Runner.exe 4788 Runner.exe 4788 Runner.exe 3732 Runner.exe 3732 Runner.exe 3732 Runner.exe 3732 Runner.exe 3732 Runner.exe 4736 nsi242A.tmp 4736 nsi242A.tmp 4736 nsi242A.tmp 2752 Runner.exe 2752 Runner.exe 2752 Runner.exe 2752 Runner.exe 2752 Runner.exe -
resource yara_rule behavioral2/memory/1816-37-0x00000000023B0000-0x00000000023BA000-memory.dmp upx behavioral2/memory/1816-34-0x00000000023B0000-0x00000000023BA000-memory.dmp upx behavioral2/files/0x00070000000233f4-36.dat upx behavioral2/memory/1816-126-0x00000000023B0000-0x00000000023BA000-memory.dmp upx behavioral2/memory/1816-111-0x00000000023B0000-0x00000000023BA000-memory.dmp upx behavioral2/memory/1816-102-0x00000000023B0000-0x00000000023BA000-memory.dmp upx behavioral2/memory/1816-101-0x00000000023B0000-0x00000000023BA000-memory.dmp upx behavioral2/memory/1816-92-0x00000000023B0000-0x00000000023BA000-memory.dmp upx behavioral2/memory/1816-84-0x00000000023B0000-0x00000000023BA000-memory.dmp upx behavioral2/memory/1816-75-0x00000000023B0000-0x00000000023BA000-memory.dmp upx behavioral2/memory/1816-177-0x00000000023B0000-0x00000000023BA000-memory.dmp upx behavioral2/memory/1816-178-0x00000000023B0000-0x00000000023BA000-memory.dmp upx behavioral2/memory/1816-179-0x00000000023B0000-0x00000000023BA000-memory.dmp upx behavioral2/memory/1816-180-0x00000000023B0000-0x00000000023BA000-memory.dmp upx - Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum RtHelp.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 RtHelp.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 4 IoCs
pid pid_target Process procid_target 4532 1816 WerFault.exe 81 3552 1816 WerFault.exe 81 5008 4788 WerFault.exe 91 4272 4736 WerFault.exe 102 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1816 wrote to memory of 4040 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 82 PID 1816 wrote to memory of 4040 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 82 PID 1816 wrote to memory of 4040 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 82 PID 1816 wrote to memory of 2104 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 85 PID 1816 wrote to memory of 2104 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 85 PID 1816 wrote to memory of 2104 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 85 PID 4788 wrote to memory of 3732 4788 Runner.exe 95 PID 4788 wrote to memory of 3732 4788 Runner.exe 95 PID 4788 wrote to memory of 3732 4788 Runner.exe 95 PID 1816 wrote to memory of 4736 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 102 PID 1816 wrote to memory of 4736 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 102 PID 1816 wrote to memory of 4736 1816 30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe 102 PID 4736 wrote to memory of 2752 4736 nsi242A.tmp 105 PID 4736 wrote to memory of 2752 4736 nsi242A.tmp 105 PID 4736 wrote to memory of 2752 4736 nsi242A.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\30648d1ae860e714f0538b6898d41fc2_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\8D89E816-AA51-6844-82EE-E08EF68F85FD\RtHelp.exe"C:\Users\Admin\AppData\Local\Temp\8D89E816-AA51-6844-82EE-E08EF68F85FD\RtHelp.exe" --InstSupp --Supp 167 --Ver 1802⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4040
-
-
C:\Users\Admin\AppData\Local\Temp\8D89E816-AA51-6844-82EE-E08EF68F85FD\RtHelp.exe"C:\Users\Admin\AppData\Local\Temp\8D89E816-AA51-6844-82EE-E08EF68F85FD\RtHelp.exe" --PreCheck 167 --Uid A1AE24A90EB6D84BB9DFCA21D0C8AAD7 --Ver 1802⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
PID:2104
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 6082⤵
- Program crash
PID:4532
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 9082⤵
- Program crash
PID:3552
-
-
C:\Users\Admin\AppData\Local\Temp\nsi242A.tmp"C:\Users\Admin\AppData\Local\Temp\nsi242A.tmp" /S _?=C:\Users\Admin\AppData\Local\3016003A-42D1-894E-A494-D23C2363F1BB2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 6123⤵
- Program crash
PID:4272
-
-
C:\Users\Admin\AppData\Local\3016003A-42D1-894E-A494-D23C2363F1BB\Runner.exe"C:\Users\Admin\AppData\Local\3016003A-42D1-894E-A494-D23C2363F1BB\Runner.exe" --Uninstall3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1816 -ip 18161⤵PID:4652
-
C:\Users\Admin\AppData\Local\3016003A-42D1-894E-A494-D23C2363F1BB\Runner.exeC:\Users\Admin\AppData\Local\3016003A-42D1-894E-A494-D23C2363F1BB\Runner.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\3016003A-42D1-894E-A494-D23C2363F1BB\Runner.exe"C:\Users\Admin\AppData\Local\3016003A-42D1-894E-A494-D23C2363F1BB\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcADMAMAAxADYAMAAwADMAQQAtADQAMgBEADEALQA4ADkANABFAC0AQQA0ADkANAAtAEQAMgAzAEMAMgAzADYAMwBGADEAQgBCAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3732
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 4802⤵
- Program crash
PID:5008
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1816 -ip 18161⤵PID:3248
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4788 -ip 47881⤵PID:5072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4736 -ip 47361⤵PID:3568
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\3016003A-42D1-894E-A494-D23C2363F1BB\Modules\cdp.dll
- Size 91KB
- SHA256 a056ad6496931b0c0a9405cf4f7a34db68c3b78b30d4907f9472994b836ea022
- MD5 2f369f9928242f730d3cf48678158111
- SHA1 f31361fb3ed6f6654ad921cdc59786df4c10885a
- SHA512 c22c479183f66b65e1cf5b7ed75e30f18db5fd7f6427c04385990d181c53216df33994f296ed235357cc0f22e4d437e97983f910ec67fc7e52fe48fafbbebabe
- SSDEEP 1536:0M2it9IgWVjtPojH1MtpM7fiOTsaM8ZcZqyPe4cN6jUNJxriz:0M/DWVK1MtpFaM8Zeq+e4cN6aO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\3016003A-42D1-894E-A494-D23C2363F1BB\Modules\nvs.dll
- Size 90KB
- SHA256 3a35ed22fe448967d3bbb5ac16710f755760f2a083f05b22884abe811d688039
- MD5 ce70e808b2bcdf50f9fec5a965503af8
- SHA1 d8168523669f119d3e603f9569078e36362680f4
- SHA512 2449dc3716362a1a572fbf7f9472ec0d975dca07cd6d4a7cf50c72c62f9ace9a6d9f7f7f3702dcf32a8bbe81b3f38c3248ac98709d3b4f26d329a6f0f7fb770c
- SSDEEP 1536:OFYN0eTLFYmCf2fWUDrQbYfLX8h+qrnEr/3wdZMj59fqHNJxri2:OFYG3MfjHxAh+EnEQZMtFqt/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\8D89E816-AA51-6844-82EE-E08EF68F85FD\MSVCP110.dll
- Size 522KB
- SHA256 c8d5572ca8d7624871188f0acabc3ae60d4c5a4f6782d952b9038de3bc28b39a
- MD5 3e29914113ec4b968ba5eb1f6d194a0a
- SHA1 557b67e372e85eb39989cb53cffd3ef1adabb9fe
- SHA512 75078c9eaa5a7ae39408e5db1ce7dbce5a3180d1c644bcb5e481b0810b07cb7d001d68d1b4f462cd5355e98951716f041ef570fcc866d289a68ea19b3f500c43
- SSDEEP 12288:FqULIc5nb9rywgfyhUgiW6QR7t5sA3Ooc8sHkC2eRxUH:PLHnhryLfBA3Ooc8sHkC2eRxUH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\8D89E816-AA51-6844-82EE-E08EF68F85FD\Modules\clc.dll
- Size 111KB
- SHA256 f1107b54b4cbbfbd7a894226317918f5aadafd56c65ea255c81facdc539b88be
- MD5 68ec32cf0860c9db2f668964a928c913
- SHA1 3949cd9177b93bc4ad76fdaf8bc2eb2252802972
- SHA512 267bf7498638c7a062e617b44b0eed61df441ea3ea4efb7cded47c062d903d084594797be5a9ccc783a5fd50f84799a2f33afda03cfff731b0e7c215b649f18e
- SSDEEP 3072:BbRT3QJFzdoXYqPQ9bLw20IgYE9pFGNlw8jlZQxvoLAX:/3QJF5aYqPQ9bLh0SE9TKjlZQxl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\8D89E816-AA51-6844-82EE-E08EF68F85FD\Modules\crm.dll
- Size 104KB
- SHA256 ec27c6987d403bb31df794b47060fe707bca85c058ecb62b8a6ec9ab35de2c06
- MD5 d925422843f1e14f6504456764219367
- SHA1 493c1992685c7413a9497aab830175ba92b1f80e
- SHA512 9a510d68428c05f63cad243ba43a954fd595f57e2e88dddd0bf79094d19fb80ef9a71803cf635160bc88f4632176c330dadfef04681cff24fdba67732d1f9a06
- SSDEEP 1536:T/Jq1OQ6koWSM0Ly46qP0z234SlqH0QqRCHsx+pKN/sQ37bYigzoSK5NJxri6:TU1J46qP0zolBMMx+AN/sQ3Y5oHj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\8D89E816-AA51-6844-82EE-E08EF68F85FD\Modules\wis.dll
- Size 42KB
- SHA256 3a942e2bfd313ecdbd48ebe05653b50d904f9b1dc30c86067446885a8d01dff7
- MD5 875b93e5075b75fba8b080c578e9170c
- SHA1 3e04baed759bafcf80a3edc7f16054739ceb1972
- SHA512 54c008a278de9fe898cc661393df22b62be9dddd31ab910e311a52ab7035b93949baeba7ff4fc40371061bdc6d9ac9ebc6dc5cd6e31050b44964e172162f6b89
- SSDEEP 768:TkPmePU4gW1YH7FzxIT7JOB3+NI2giTcsuCGkjam54RZcCTRUf/HXNJxriD:TkPmePU4pKbBKT7JOIu9lUOsWZHT8/3g
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\8D89E816-AA51-6844-82EE-E08EF68F85FD\RtHelp.exe
- Size 334KB
- SHA256 0946e5e56039b750820fad2169e66ffe31a5a0d93fc17734948c40f9ef147c43
- MD5 cdda1f88ec6c73e0f71a4549121165f9
- SHA1 b4736704971dd67d904d3664772c815888d60d03
- SHA512 e72c718fe4f0786d171ebc2daf1402667cf380e88877b5675ac782ec22e1b643a4b19b39e193c9002674f2ced61d22de0a7a4f8db9a621fe61534be28fc28775
- SSDEEP 6144:oawJ67wblyFxImB8K7BvFRVidQhq/Jx8W:937wQFWmzaQhGf8W
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\8D89E816-AA51-6844-82EE-E08EF68F85FD\msvcr110.dll
- Size 854KB
- SHA256 b30160e759115e24425b9bcdf606ef6ebce4657487525ede7f1ac40b90ff7e49
- MD5 4ba25d2cbe1587a841dcfb8c8c4a6ea6
- SHA1 52693d4b5e0b55a929099b680348c3932f2c3c62
- SHA512 82e86ec67a5c6cddf2230872f66560f4b0c3e4c1bb672507bbb8446a8d6f62512cbd0475fe23b619db3a67bb870f4f742761cf1f87d50db7f14076f54006f6c6
- SSDEEP 12288:TmCyHcMpK7QdgD+9Tr8r3FmJciMgLFWkA8qTWu+FVlofpJCjNdr12iqwZeq:TmCyHNIQdTryVmCipIkqTWu+Fr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nse43C1.tmp\System.dll
- Size 11KB
- SHA256 4ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe
- MD5 3e6bf00b3ac976122f982ae2aadb1c51
- SHA1 caab188f7fdc84d3fdcb2922edeeb5ed576bd31d
- SHA512 1286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706
- SSDEEP 192:eP24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlbSl:T8QIl975eXqlWBrz7YLOlb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nse43C1.tmp\UpdHelper.dll
- Size 130KB
- SHA256 8b972cd7532648027a533330481a6fed08f70718b31396ddf6579519e862b169
- MD5 bb40f596eab5c6598d320677b1731d62
- SHA1 2c3f547355e07ba6585d955237a35e1125173028
- SHA512 a2b6757d82bc9ad02516ab83b31c81c310cefc04ffe8ba1937febe44da2e9786a093fba21f6ed412403acde404a6684f7c2ad7f7696c03379fde9d3aee19b436
- SSDEEP 1536:Xxl/6f/Vjj2C6+omP/I2IYhRN/YD70Z7+OpzW4kDcXMkoXsWjcd0w+bTTshSQlm/:BB2UOq+1W4rMkoY0w+bTTshSom
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nse43C1.tmp\md5dll.dll
- Size 6KB
- SHA256 32c3d36f38e7e8a8bafd4a53663203ef24a10431bda16af9e353c7d5d108610f
- MD5 7059f133ea2316b9e7e39094a52a8c34
- SHA1 ee9f1487c8152d8c42fecf2efb8ed1db68395802
- SHA512 9115986754a74d3084dd18018e757d3b281a2c2fde48c73b71dba882e13bd9b2ded0e6e7f45dc5b019e6d53d086090ccb06e18e6efeec091f655a128510cbe51
- SSDEEP 96:5mArJv6F3TqDmgK4ghEin1US36eHQZDUDgGogZcko5Nt4AMP:5XJ63LhR6inZ6dsgZkKQT
- MD5 SHA1 SHA512 SSDEEP