Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16-05-2024 19:59
Static task
static1
Behavioral task
behavioral1
Sample
4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe
-
Size
1.8MB
-
MD5
4cccaa5cfb192851d364230d184a0472
-
SHA1
6453801f53aabd336417b5b2d3d9bad1a5df4527
-
SHA256
8c561bd369af161f42dc9e98346ee039fced680e82666887f6dcd7ffaf84ab75
-
SHA512
fc01eb8dbceecc31a7ea193ec44417e5648b4efc3d5583d851a6c7e3bb814acac6d82be922cb1e5775429cc07d4c20768a539312539c9bf5f50605ff71c8ad65
-
SSDEEP
49152:l5+Zvuwcz/f+jGfX8r7xB58y8wBUDutZtpq4gC:Swwcz/mW8h8y8wBUStZtp
Malware Config
Signatures
-
Luminosity 2 IoCs
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
Processes:
REG.exeschtasks.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe 2248 schtasks.exe -
Executes dropped EXE 2 IoCs
Processes:
File.exenotepad.exepid process 2884 File.exe 2620 notepad.exe -
Loads dropped DLL 5 IoCs
Processes:
4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exeFile.exenotepad.exepid process 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe 2884 File.exe 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe 2620 notepad.exe -
Adds Run key to start application 2 TTPs 23 IoCs
Processes:
REG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exedescription pid process target process PID 2416 set thread context of 2620 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe notepad.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exeFile.exenotepad.exepid process 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2620 notepad.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe 2884 File.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exeFile.exedescription pid process Token: SeDebugPrivilege 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe Token: SeDebugPrivilege 2884 File.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
File.exepid process 2884 File.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4cccaa5cfb192851d364230d184a0472_JaffaCakes118.execmd.exeFile.exedescription pid process target process PID 2416 wrote to memory of 2884 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe File.exe PID 2416 wrote to memory of 2884 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe File.exe PID 2416 wrote to memory of 2884 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe File.exe PID 2416 wrote to memory of 2884 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe File.exe PID 2416 wrote to memory of 2884 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe File.exe PID 2416 wrote to memory of 2884 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe File.exe PID 2416 wrote to memory of 2884 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe File.exe PID 2416 wrote to memory of 2656 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe cmd.exe PID 2416 wrote to memory of 2656 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe cmd.exe PID 2416 wrote to memory of 2656 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe cmd.exe PID 2416 wrote to memory of 2656 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe cmd.exe PID 2416 wrote to memory of 2656 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe cmd.exe PID 2416 wrote to memory of 2656 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe cmd.exe PID 2416 wrote to memory of 2656 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe cmd.exe PID 2656 wrote to memory of 2796 2656 cmd.exe reg.exe PID 2656 wrote to memory of 2796 2656 cmd.exe reg.exe PID 2656 wrote to memory of 2796 2656 cmd.exe reg.exe PID 2656 wrote to memory of 2796 2656 cmd.exe reg.exe PID 2656 wrote to memory of 2796 2656 cmd.exe reg.exe PID 2656 wrote to memory of 2796 2656 cmd.exe reg.exe PID 2656 wrote to memory of 2796 2656 cmd.exe reg.exe PID 2416 wrote to memory of 2620 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe notepad.exe PID 2416 wrote to memory of 2620 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe notepad.exe PID 2416 wrote to memory of 2620 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe notepad.exe PID 2416 wrote to memory of 2620 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe notepad.exe PID 2416 wrote to memory of 2620 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe notepad.exe PID 2416 wrote to memory of 2620 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe notepad.exe PID 2416 wrote to memory of 2620 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe notepad.exe PID 2416 wrote to memory of 2620 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe notepad.exe PID 2416 wrote to memory of 2620 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe notepad.exe PID 2416 wrote to memory of 2620 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe notepad.exe PID 2416 wrote to memory of 2620 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe notepad.exe PID 2416 wrote to memory of 2620 2416 4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe notepad.exe PID 2884 wrote to memory of 2544 2884 File.exe REG.exe PID 2884 wrote to memory of 2544 2884 File.exe REG.exe PID 2884 wrote to memory of 2544 2884 File.exe REG.exe PID 2884 wrote to memory of 2544 2884 File.exe REG.exe PID 2884 wrote to memory of 2544 2884 File.exe REG.exe PID 2884 wrote to memory of 2544 2884 File.exe REG.exe PID 2884 wrote to memory of 2544 2884 File.exe REG.exe PID 2884 wrote to memory of 2620 2884 File.exe notepad.exe PID 2884 wrote to memory of 2620 2884 File.exe notepad.exe PID 2884 wrote to memory of 2620 2884 File.exe notepad.exe PID 2884 wrote to memory of 2620 2884 File.exe notepad.exe PID 2884 wrote to memory of 2620 2884 File.exe notepad.exe PID 2884 wrote to memory of 2248 2884 File.exe schtasks.exe PID 2884 wrote to memory of 2248 2884 File.exe schtasks.exe PID 2884 wrote to memory of 2248 2884 File.exe schtasks.exe PID 2884 wrote to memory of 2248 2884 File.exe schtasks.exe PID 2884 wrote to memory of 2248 2884 File.exe schtasks.exe PID 2884 wrote to memory of 2248 2884 File.exe schtasks.exe PID 2884 wrote to memory of 2248 2884 File.exe schtasks.exe PID 2884 wrote to memory of 2168 2884 File.exe REG.exe PID 2884 wrote to memory of 2168 2884 File.exe REG.exe PID 2884 wrote to memory of 2168 2884 File.exe REG.exe PID 2884 wrote to memory of 2168 2884 File.exe REG.exe PID 2884 wrote to memory of 2168 2884 File.exe REG.exe PID 2884 wrote to memory of 2168 2884 File.exe REG.exe PID 2884 wrote to memory of 2168 2884 File.exe REG.exe PID 2884 wrote to memory of 2752 2884 File.exe REG.exe PID 2884 wrote to memory of 2752 2884 File.exe REG.exe PID 2884 wrote to memory of 2752 2884 File.exe REG.exe PID 2884 wrote to memory of 2752 2884 File.exe REG.exe PID 2884 wrote to memory of 2752 2884 File.exe REG.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4cccaa5cfb192851d364230d184a0472_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\File.exe"C:\Users\Admin\AppData\Local\Temp\File.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Luminosity
- Adds Run key to start application
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /NP /sc onlogon /tn "Client Monitor" /rl highest /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f3⤵
- Luminosity
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\tskmgr.exe.lnk " /f3⤵
-
C:\Users\Admin\AppData\Local\Temp\notepad.exe"C:\Users\Admin\AppData\Local\Temp\notepad.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\FolderN\tskmgr.exeFilesize
1.8MB
MD54cccaa5cfb192851d364230d184a0472
SHA16453801f53aabd336417b5b2d3d9bad1a5df4527
SHA2568c561bd369af161f42dc9e98346ee039fced680e82666887f6dcd7ffaf84ab75
SHA512fc01eb8dbceecc31a7ea193ec44417e5648b4efc3d5583d851a6c7e3bb814acac6d82be922cb1e5775429cc07d4c20768a539312539c9bf5f50605ff71c8ad65
-
\Users\Admin\AppData\Local\Temp\File.exeFilesize
857KB
MD5bc6529f2a93dd5eb328963e0b41a855a
SHA10d3fe448baa8a886fd33541f17e893a8a550640f
SHA256b98c711a375f39574672d49fdb798e70dab73b56c5a605c2cfd55a82d8d1b528
SHA5124b50bc0de71bdbdbe76622d498d70b940e11a5c34b6d58b43765eacb2447d3106da3ac80f3a20e7eed67598bf9875cda9646694724b8fae6d91a7ed97b0bad73
-
\Users\Admin\AppData\Local\Temp\notepad.exeFilesize
52KB
MD5278edbd499374bf73621f8c1f969d894
SHA1a81170af14747781c5f5f51bb1215893136f0bc0
SHA256c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391
SHA51293b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9
-
memory/2416-0-0x0000000074A72000-0x0000000074A74000-memory.dmpFilesize
8KB
-
memory/2620-32-0x0000000000400000-0x00000000004DC000-memory.dmpFilesize
880KB
-
memory/2620-38-0x0000000000960000-0x0000000000977000-memory.dmpFilesize
92KB
-
memory/2620-30-0x0000000000400000-0x00000000004DC000-memory.dmpFilesize
880KB
-
memory/2620-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2620-25-0x0000000000400000-0x00000000004DC000-memory.dmpFilesize
880KB
-
memory/2620-23-0x0000000000400000-0x00000000004DC000-memory.dmpFilesize
880KB
-
memory/2620-48-0x0000000000960000-0x0000000000977000-memory.dmpFilesize
92KB
-
memory/2620-33-0x0000000000400000-0x00000000004DC000-memory.dmpFilesize
880KB
-
memory/2620-36-0x0000000000960000-0x0000000000977000-memory.dmpFilesize
92KB
-
memory/2620-21-0x0000000000400000-0x00000000004DC000-memory.dmpFilesize
880KB
-
memory/2620-43-0x00000000009C0000-0x00000000009C1000-memory.dmpFilesize
4KB
-
memory/2620-45-0x00000000009C0000-0x00000000009C1000-memory.dmpFilesize
4KB
-
memory/2620-42-0x0000000000960000-0x0000000000977000-memory.dmpFilesize
92KB
-
memory/2620-40-0x0000000000960000-0x0000000000977000-memory.dmpFilesize
92KB
-
memory/2620-37-0x0000000000960000-0x0000000000977000-memory.dmpFilesize
92KB
-
memory/2620-46-0x0000000000960000-0x0000000000977000-memory.dmpFilesize
92KB
-
memory/2884-12-0x0000000074A70000-0x000000007501B000-memory.dmpFilesize
5.7MB
-
memory/2884-49-0x0000000074A70000-0x000000007501B000-memory.dmpFilesize
5.7MB