ecdbdb30c22a8028bf998afbda3a9be2d6a70bcea24341e9dfa35fe19a375bd8

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48f42f7d2dc58ae0932513368f510e63_JaffaCakes118.exe
Size

40KB
MD5

48f42f7d2dc58ae0932513368f510e63
SHA1

fdd5d5938c5786dd9f21afc90326bece21b03ce6
SHA256

ecdbdb30c22a8028bf998afbda3a9be2d6a70bcea24341e9dfa35fe19a375bd8
SHA512

1db202ea1190c133a92da7073202d1f1361f32ea2281a2850ae519fd8a61ccf0f4bf5837ce5e4052c35d718ded2ac340cc5088d01b03eaa0da61cba8833f7bb4
SSDEEP

768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtH+:aqk/Zdic/qjh8w19JDH+

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
288	services.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/288-11-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0039000000013362-10.dat	upx
behavioral1/memory/288-17-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/288-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/288-27-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/288-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/288-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/288-49-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/288-50-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/288-54-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/288-58-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/288-59-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/288-63-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/288-366-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/288-1137-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/288-2021-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	48f42f7d2dc58ae0932513368f510e63_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	48f42f7d2dc58ae0932513368f510e63_JaffaCakes118.exe
File opened for modification	C:\Windows\java.exe	48f42f7d2dc58ae0932513368f510e63_JaffaCakes118.exe
File created	C:\Windows\java.exe	48f42f7d2dc58ae0932513368f510e63_JaffaCakes118.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	48f42f7d2dc58ae0932513368f510e63_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	48f42f7d2dc58ae0932513368f510e63_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	48f42f7d2dc58ae0932513368f510e63_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	48f42f7d2dc58ae0932513368f510e63_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	48f42f7d2dc58ae0932513368f510e63_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	48f42f7d2dc58ae0932513368f510e63_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	48f42f7d2dc58ae0932513368f510e63_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	48f42f7d2dc58ae0932513368f510e63_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 288	2440	48f42f7d2dc58ae0932513368f510e63_JaffaCakes118.exe	28
PID 2440 wrote to memory of 288	2440	48f42f7d2dc58ae0932513368f510e63_JaffaCakes118.exe	28
PID 2440 wrote to memory of 288	2440	48f42f7d2dc58ae0932513368f510e63_JaffaCakes118.exe	28
PID 2440 wrote to memory of 288	2440	48f42f7d2dc58ae0932513368f510e63_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\48f42f7d2dc58ae0932513368f510e63_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\48f42f7d2dc58ae0932513368f510e63_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e600edcdd0a50c7c4380ad3a68ccd29c

SHA1
68770f5383949070b86ead3855bc602c2a5ea6dc

SHA256
37848b1fd48eaecad1921447a7b799b50ed7b234c355eb8c60b34ee6529a2b57

SHA512
10b0c85df19ca205a3520f57267a6b921a1ff1d9acebc068248864a76f15704a8158796fd5ed70b5e7bef244e238695212a6314347a2d0ee06a415bbaa062436

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb31c5abab14d09c3b82953652e8eed9

SHA1
85f8b67983c2e67b46bef68f885d682f322589a1

SHA256
9f444b57119fc0d4bd429e4eca07e5c38ef0f542f982fa80fcbb19887b86e513

SHA512
7baba36290576c936a394b70236f415447c7d90c121cf3d84563b5ebccf0ab87ee1189aa611e39a4f2819f4940b0c44221d481287e452243d32e67b0c12b4776

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24292e4f53439b8a14eff5b63ffa1d88

SHA1
545d70555b1d67d5c2acbffcb78c00c83f78844a

SHA256
601b929196c68b39f4be18ea45b485b9f3cd67cfedbb05d12787615ec65c0632

SHA512
856544fa3b167e6d056012bfcc80b14298801b6a73318f42a68bf87aace92a6f72d9690bfe0ceac1944ff084d0ab3b9a69b4b025c54af4007def4862684c4142

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28b171b98991b04ae217d485b54e9c5d

SHA1
4c00265f0b44558d374313e24b4fce5d745d7a1c

SHA256
205c597bb8a73b3c03eab18903a7451d489a9577d9280d7fea770ae0c5254863

SHA512
ead47b7599c845ea398e25041334a9fbe2f771d09a177892f601c92ed256b49dfaf0e2bab2972d1567f43f3241e94a877c831598bc330ee6a58ac98380f3299a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddecf3e4ff933fd07516adcd1bc74dd6

SHA1
33c83997ee8af43b3b26b9197fd4d7a4c095af11

SHA256
e4abc5f0d060258047d41bd148f987392f4108b98232925feb491b8f880aaaa0

SHA512
bb61dc03f81d3ca8d91eead188c078d5fb6e46df38d6c6d8996c0c0c278b2dc5bd17a8b4ac414ed838ffbd45f07019f179add2211562ab5eb467ff411fc1afeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50f0e5c1f846980ae21efd93d576de56

SHA1
4a4976cd069596caa0077148deade022dcb041c4

SHA256
e7303fa5a1ff36fedc410ff4cefa679271d8b25512a6fa2efcacca9e75a433f2

SHA512
b93da2313b0f77d77ee1cc46bd5618378851241a4c2b23ced687cc30ce37f740fd02d905c88ef53b1002ca842e865a417b1ba1ed94515f7aabd704f968872c5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fd65a6448e65d74f3a0311063c52aae

SHA1
c6fd00cacc0db4fa4992b3c6d9b50e9c997bf404

SHA256
dcb6707242d33b162811d8cce5f123dfc0067b18ee270df052e4f8ef404bf974

SHA512
3f10f180093cfd7432c8652eff50b32ebc9daf1a8e955af7e00a50946faa152ec4c775b5576bb2ebb547974bd0dd4a50a3ad8ca25a4bd2b16e03b4c55a664579

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f7c290b24125110d86d4637e56777e4

SHA1
867cac23e0ea1690542e016914d601ef25e254d4

SHA256
129283a18c2d833774b5c1ff59d6f7c5a74a34efa30e3102790e82bae8958e73

SHA512
99d1bc5354a56375f9ca23f75afb1a81fd1e73a3f14e9cf84d474c6da454f968a49740acceca59e8510afa04fab8a65bb51196099a7a03411474570825163648

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85047eebbe78309ef572f4ae39668a3b

SHA1
4caa643f5b58b621c9ef47eb4ac7e776f2fd1f3b

SHA256
c3da410fd79255d358f94b4c3ce8c950f8e10c455cd214ece3ddf2913e19a626

SHA512
13518c1e960b0e201af6646f857c926692bdcfb34db28a275c5c612311320f2235dd13687aaaaec8edf0adc42cd7cc146b0c001b654f984288657190cc6cb243

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c271217b75b836db3168c26c0936888e

SHA1
514f96426987f96ca46701b408ee951ef35f3603

SHA256
7ea2070b93a7074c1651a78eeacd85cbe379d963519b62a6d6bc69661107c641

SHA512
3da88c61eb0cadcb46d6955d740cf2d14996a3aebaf4d844d927b70b7c941593851815744ec3cfa1e2d4320752706e8dd824833461e0f04746f4107bcff75ef8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d1144eab065b90a6f640251a00bc145

SHA1
35fd9b3a1dc5b4db1104109c9173d176510ef400

SHA256
c6aa61d8602fcb6aee508055e262bf7311cdd2c96f1af508f69bff68304aee15

SHA512
698522b4e83abb245eefe80568bdedaf04ed874ac693c13e818c77242cdd8a646e9411827903819d385b98d9379b5f5ae7d3131222021a1ecf0042c42e79be2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
130a273f88a92a353a778149c90c502b

SHA1
e091b7370fe68e7e26ff0800fbff3d95d966a482

SHA256
285932ca686b9d9b06d2ec15865c66b1e77f084b24e46bd7b074472241ba7382

SHA512
fc539349a1241362c8f58697f7343eb32d95dc4cbd9ef5818b990d046bb99d37044818711a6fcfa158f8a55ada81c37098bb477f85758205f22f789493f46ddb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
227865c234489f3b613daf7c9a2edc04

SHA1
93bb7636ce438e6e4391925b2b9fc17e63f52fec

SHA256
57b49817d6f8fa9bf8954506cc462c2e988564dc09b1bd80176f3b79f0365bfa

SHA512
adfc3c1550a41ce5e65e7b424ab6943385cd5eac0b151717958cc3e91479b37730c98bd84221cf33051a503165179ae46d0df1d6fc53e362d8d1795ebbfd5ae7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c191436577fdf382ee9ad405c3c78ec9

SHA1
fb8fab102546e0f905f2200e552a7fcf461e7e9c

SHA256
a40810d0d38db8f21dbe6323cdca05bf714e5e30227acd8cfa8c2c08380c9968

SHA512
1b8f6281f77296e296c3cb4b94708f869ff9c655592893bb7ec961fecf6d1a366a9a96b2715b69de7958fd8843dcdc201ca16a9cd9c2fff0b0eeea1a95c8f84e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
203f119df52591e65cc629ac6aa039c8

SHA1
c4038666f5ebfba6ec55a58251e06715f334754e

SHA256
95a698ae3a4a96c6bad3b14478b06affa72d1915b706d568d18dd5dc0630b06a

SHA512
6e03a692423d30a10bc97273e51131427bbd4e61720eeccd24808a4918e7ec7326466016caa49f9b0e47ba749da4b70cfa7536420abfde28c736f68901e435ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0db8e1763d040aafd385faee6d01480

SHA1
3af8de3bcbf23dd8d0ca7702be92f665cda86c23

SHA256
2f86e3ec6b0bf69bb3604847494a6a0b7ff7d201f707f592b934ecb43fc4cbc6

SHA512
94d3e3519d6405895672b7c11c85ff21ec159bf883628c36e4e19a2c0d2906b4e1112f5fe6bcabd1245df7baa931341d9b0fbed1e35df175e0010a70cec3c753

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52773ef80e5accef73b151f4e8342a04

SHA1
609a4d254ebf8f634073622b194fee081c362dee

SHA256
9e21f52629129e65b1439b5ccb70768e9a75a3a82986c1970e7bfd0ac253953b

SHA512
1f8be92a7afef57e210ae1c37231dac43181490ec75f5186edf0f99be25553f979df441254e9fd0f2140e143c2881a48db74ab4586ad28bd3e09d959c4ba6da5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b760c1442f2dfe9de07459fd16e5d3ed

SHA1
ded42846d3afee7525d852ad1f2caa75b62e4712

SHA256
60ea8d662a4164763a94ab29750c7c0dd8334d234e4cd7215b7488ece2869805

SHA512
0bdd897e711ae6016b45e99d030e426b72b60bf68b8b3399b3eeaa2ab3bda2d4ad75fba5da6fd53b6b110b2a96dca481655b7637dae92cb3fbcb1be0638cbda2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\528EVS6A\default[1].htm

Filesize
315B

MD5
14b82aec966e8e370a28053db081f4e9

SHA1
a0f30ebbdb4c69947d3bd41fa63ec4929dddd649

SHA256
202eada95ef503b303a05caf5a666f538236c7e697f5301fd178d994fa6e24cf

SHA512
ec04f1d86137dc4d75a47ba47bb2f2c912115372fa000cf986d13a04121aae9974011aa716c7da3893114e0d5d0e2fb680a6c2fd40a1f93f0e0bfd6fd625dfa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KRMHFE1W\default[1].htm

Filesize
315B

MD5
e510f9586fd45ddb7f0c00cc01b5bb78

SHA1
0f49be1ea6f9228f7fa5877a74df5913d500f44c

SHA256
06dc56e918b87be102dbef5a82c2b9e572d2e4dd4e778026ab8aa59ec58c454c

SHA512
4a6cd27994a9bab95b152bd6be520dfa186b3b067345a350ced80933757ce875bf53cdaf3413ddf1ed14968adc233f7cb6bb2fcda0fa19c4d68e2e9d86416b90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KRMHFE1W\default[3].htm

Filesize
308B

MD5
d955962d274d59697d96429589cd53c9

SHA1
27116d108539bfadba051a440149097e50b54a1e

SHA256
ea45df96838b7d2e7c51bad1eec1d2649826c606a3499a91530a9c3fc7b04c68

SHA512
22054973e43e43acdea55f2b9d04eb9e9b3a81923ab300336bb481f7717a196f18f2fe6fe9ef31c98ca94e74829e7615aeb9406cdd8afec54d9251d91266a348

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KRMHFE1W\search[3].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OV51DDG5\default[3].htm

Filesize
315B

MD5
058e41d2b5063436d4aa0b002fd7e569

SHA1
96a4ca8e2491c6b39717b65ad133d585bc075d62

SHA256
e9db8fcc986290d2376d5478a7c5a524c2949a0ef2e8c18d56b052b6841359cc

SHA512
6e55d73e1d091f5a7e886fa08ce3c27a38ff3d70c64ab099b9c285b2437817e6228b79461aa67ef1983df1fddb790445eb7a5bc9156a82a77b3cf6c0dfdc5dc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PH7CXNA3\default[1].htm

Filesize
308B

MD5
ccfe63b884fe4225fa33f618a54ce37a

SHA1
bbb0778c1597eafe7fb9c5c65412f8ab04b2e311

SHA256
f7dd5bab49466a4cdb6a7f5a0e07a158f7a1567bd809ed745812469775b33112

SHA512
858f345503c89ba075b374764145fba5b1a9d3440d1628edeab0a3e02cc7cbfbe1119c20747026e69d630ed262d3c91c5073ef06823cf727dfcb11605c7c5ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PH7CXNA3\default[2].htm

Filesize
306B

MD5
e0c3b4c8541e5bc3cf19d22ccf8365d6

SHA1
9ac1347e4dbce09ddacc47ff46b9cb15b01fd77d

SHA256
69e3c690688497ac57963720235b9181d6ab79161289aed6bc518f2284e75696

SHA512
3c6a7bb5b195dd5e973d180f051ad4979d37bfaa489e6e22c239a2efc007a203c72732496d0db1324a16344606510cba911af242337bd96da4f9832c9f6552aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PH7CXNA3\default[4].htm

Filesize
305B

MD5
157431349a057954f4227efc1383ecad

SHA1
69ccc939e6b36aa1fabb96ad999540a5ab118c48

SHA256
8553409a8a3813197c474a95d9ae35630e2a67f8e6f9f33b3f39ef4c78a8bfac

SHA512
6405adcfa81b53980f448c489c1d13506d874d839925bffe5826479105cbf5ba194a7bdb93095585441c79c58de42f1dab1138b3d561011dc60f4b66d11e9284

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDD4D.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDD9E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpDE9C.tmp

Filesize
40KB

MD5
b420609bebcf432e1c397e639c50079b

SHA1
d1422d3b87a284fb97cefa4a56e9f0464fd6cc34

SHA256
7cc335e16b14e45d72499722a7f419ba2137c2043ecf72c9861d5c1c63db2a4a

SHA512
442f9d4ccccb4be55582a7535536d4dcebae0b34ee2c7db917d40e3d467eaabb4cc8738626f79f634d23af2153eb96c122e4337f23c65a2d57f319ee7aa7072c

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
98777678f619f85a298de317e05fc50c

SHA1
a06a3a3a49aa28140cd3467a505956c92895a07b

SHA256
e455a71c6d52bf3c869484070f937daa567a8ad9c5fad2b0cc3c03bacd3b6b73

SHA512
3c74e08e5a21c20b570515d22d3b35ac9a05df03ce74d2d9183726c12f40e4ab5986c42703f1a0ab4517f11b11a8a5fb8ff111816cd569a21a1e77bda91d7246

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
a7b2983e51fef8baf4fcdf98342b8b93

SHA1
336a7c5084559ee5b2602549c136c9c595183dec

SHA256
6a55f5ce3543e0be2392a9061e19b7e8be2eec1eb2993a83eafd48ad6db2675a

SHA512
800f03c6e955099d04dac0d5c80f6b399a6f3575866f14ea583169c27131eb1f24c9c1a1868c825ddf185fb2b4ec7b06bbb622d8b4a0192e030cca4cd33b95df

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/288-2021-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/288-1137-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/288-54-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/288-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/288-27-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/288-49-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/288-366-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/288-50-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/288-59-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/288-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/288-17-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/288-63-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/288-58-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/288-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/288-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2440-8-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2440-9-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2440-23-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2440-0-0x0000000000500000-0x000000000050D000-memory.dmp

Filesize
52KB

Download
memory/2440-22-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads