78d48ff5f86f03d0bb64683df00e110c26d4b356af9e08c78d590c2f9da0c9d5

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 03:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f677fe476aea016476d23eba357cc2e_JaffaCakes118.exe
Size

40KB
MD5

7f677fe476aea016476d23eba357cc2e
SHA1

df5615bd3aea0f8468789c80eeca740168c53adb
SHA256

78d48ff5f86f03d0bb64683df00e110c26d4b356af9e08c78d590c2f9da0c9d5
SHA512

482bc51ac0db3acc00b74325dee82498e5f6b24153e3ed0abfa6bbd5056d46ffe2d7dcd874e4aff0dd3b3db22735960c8c112d399d9013b15141c77b283f68c7
SSDEEP

768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtHbZ:aqk/Zdic/qjh8w19JDHN

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2968	services.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000015018-10.dat	upx
behavioral1/memory/2968-11-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2968-17-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2968-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2968-27-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2968-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2968-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2968-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2968-37-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2968-41-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2968-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2968-66-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2968-1206-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2968-1944-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2968-1945-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2968-1949-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	7f677fe476aea016476d23eba357cc2e_JaffaCakes118.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\java.exe	7f677fe476aea016476d23eba357cc2e_JaffaCakes118.exe
File created	C:\Windows\java.exe	7f677fe476aea016476d23eba357cc2e_JaffaCakes118.exe
File created	C:\Windows\services.exe	7f677fe476aea016476d23eba357cc2e_JaffaCakes118.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	7f677fe476aea016476d23eba357cc2e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	7f677fe476aea016476d23eba357cc2e_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	7f677fe476aea016476d23eba357cc2e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	7f677fe476aea016476d23eba357cc2e_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	7f677fe476aea016476d23eba357cc2e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	7f677fe476aea016476d23eba357cc2e_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	7f677fe476aea016476d23eba357cc2e_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	7f677fe476aea016476d23eba357cc2e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2968	2888	7f677fe476aea016476d23eba357cc2e_JaffaCakes118.exe	28
PID 2888 wrote to memory of 2968	2888	7f677fe476aea016476d23eba357cc2e_JaffaCakes118.exe	28
PID 2888 wrote to memory of 2968	2888	7f677fe476aea016476d23eba357cc2e_JaffaCakes118.exe	28
PID 2888 wrote to memory of 2968	2888	7f677fe476aea016476d23eba357cc2e_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\7f677fe476aea016476d23eba357cc2e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7f677fe476aea016476d23eba357cc2e_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c48466af415ac50797f0e5904cb4a93

SHA1
5b771670c5e347358f6c9e7dc1e4633c3e4baf7d

SHA256
55ad1d88973c0c68b7fddbc2ae55dbe9a6db2b0f6be01cfe9c8ceb2e86837f5d

SHA512
0ee0e2aeab080e00ad898c6753f9c3867ea1a4ee3b0f1f69ba9eda7ab113223bc73bc46331aa0000d4532315c8d411ea419cdd19dc2f7048199912b77f40d1ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69a000a957b73a66c96c102836944b96

SHA1
cf3a0ae8ae9e90a09d64bac078fcbd1ff565598b

SHA256
b2d1a89bf15379670f2207fe1190c776f90c7a8a21537ce59b4d10b8f2d4a8a1

SHA512
341b9847abba52cd54c2e8b5aa62661a3bd5d87618e485ba2839ad7a2143c5ac65e99fb2984b3359520dadc272a7d75523b6302da74f755be20d1d12b3c742bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
200190c3acfe1b74996d8b4ca91ef5bc

SHA1
dba0076215546244faf5a248b65ac2514a1a3efe

SHA256
558f420da2b43451101df728b93c7db53d7d535659a5dced72af2c7d230d07d4

SHA512
2178698b93827765f26b45f71fa1933fcf7f3228f92bbfadbdfa9b17bc15fc0c8788051ee38419761e434af7d418092b5607185f56605d78e423cc343ba5510d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78f5d8210875ac8edefae0373d49a083

SHA1
517d697575f7c8ca7d5745dd6b3cb0c25b2b928d

SHA256
04ce00aa6d7173be80a0382755b177fed5569cc74c32d6eb5697779e02c96ebf

SHA512
b6a7ada6c51f3aff62633be03bb02e1650ba643a929ed5abf8fb67c24717f9def0b97c35680ba75f4d0bf1c18a3cf102306ef79323fff776e8941d835f6256cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
753ad75d94844198a74f7cf525c9e25f

SHA1
ee7e5795312104063a4ab1ea96d9d775b45773e6

SHA256
e28a2820819341bd6d49d7cbe368d03e52fb693feadf5b8f3fe371a466a3a5f0

SHA512
cc1862638fce4e34066174b61bc8d6dcc291d5bc5c56f5aec900805fca0f99c623ae41daffe25cdb4b58fb63657badd18a6cf6b8fbd04cfe35f0633a50a5d61a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29a37a8561ff7bd70aebd1187da11053

SHA1
2da463d8219d411e427503edee64eea29804d144

SHA256
6e6be7df1c1b3ea749f00930be2eff97c1a9b5c4925e7d05443cac2c78bfedaa

SHA512
2b84265de58ab8d87d74a1ffbd150c0439dcc957151604493a4cb2a3adec73297a0649c938f24357cf0cf666f57176086abce67cafb114766ccd592cd9c83ae2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91386af726ff17bae759dbf32f10166f

SHA1
e5638937539cb15a63d66ad98cfbd15d964c0f76

SHA256
e83a34519bf86eb753132d134ee7488e40444e436f1570c48583fbc09c6a8b33

SHA512
9e44177587cf627068fd481f57d4b7bb8d447ea2117b5b7118a3666942e46e71662bbefd0e476c5ebecb3bf3a815a49bfcca9d1239a6bca92c2b40338fe79e12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f618cc31822d74086d79ba5d507ff6f

SHA1
9eb7b46ba3ac16c865375b37c0a6e4d1149d2a68

SHA256
d4b0d2a2aa182d21e7c49c22cc3d5161c171a808d564f702144ed96444db4665

SHA512
42fb068343b935be1a41ff7814eb4fd192dd8e9455e8415376c2b9aac7c159fe5d70aa3fe22716448dd4e2bda994adee733e00d2195bd125bbd30cd5d7c81fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff17ab99689d5b9ba7726024642da21c

SHA1
a21a44fdae92ea14aa51d7b51a4161f16cba3a69

SHA256
9b76e895885a6d42702ad8c1899f94fc098e7fef2a20c54974ae63fcc9ccf25d

SHA512
60bcfccc58e1ecd21d79e4a53e078eec8558e07664a3531976aa54093aabd020eb0fcff7362a46c24a259421b3eef4a16ddc46cc771a03be7208f8c9cecb9b9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6bc28fba0ff5905be96f9ebe4befe39a

SHA1
2a15d419e16692d1b41942c4f6158ebfb43ee66a

SHA256
c698f754e8be98cc3f407b26fc0f952fe5a7a422a3425d69c32b163f02833765

SHA512
779c3d6de32909f59fea155285b423a81b3bd1011732cc2f734dcef4d450c6210f2efb07e0d281a49d53dd3706d59d3baa8720b5b375498b97ace27ed49fa874

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89a4fa9fd94f05ffade53b3b4633918c

SHA1
4c69f92245636de0ef1dfc574b672ebb41e67745

SHA256
89bfc35834b27679fdfa2650a6106870e70603ebb660d4b59f8b4e36806d6b3b

SHA512
e83ec30ac6adc7392047db92deac21813e5a4fd4cc204da3014ca298c618a4a0dee903adc4250abf2d01d148111871e6d78e7b67552e24de8df5659b07c89ed4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be4a64ad95845a81e51c0d49d0eb7bb8

SHA1
dc8be5fb05052087ae41bd10a313ca6001d7be06

SHA256
e72502d6d6362232134f7a3b076543547b0e628f75ca3dcf3bf8505fbfd5635d

SHA512
a3b0a133867e6d834ca0a70ee5fa05fff4f5666e20853899b0256d91b137bc61a26926d179249d51d58c5b880e1d77552b2e954cde69f93e1921215ae92d3d0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7b55d3dbd40bb8ffed1fa4afdc3fede

SHA1
0cbe7d01a75803936dd367c4a91c73572225a13d

SHA256
2af792057f10afbfcef5171dd72f8fdbe2e07ef4917b696adabc49999b5baca2

SHA512
ade299d42b7660185ee0703b0c266ec9e6e20dd5ce8275b1f6dffb7ac098a33129466cc2362f24eab323e053c442e26e8e6973e5460de07d6623b8a30c708590

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90399835e89ff9dca370d36d83b1a117

SHA1
1560e1240ec50d0abd02bdc4a76c9336f4dca4c2

SHA256
0ec9e425fbe22981973fe4316183805adfd7449bc445f0f0386815e9119ce927

SHA512
e8a797714f07bbed2626af06be7afb0d3bd34a983e1caf465cd15c2dfa271a64e431c8e5e1753e4bd18ad0300af4d2f6d241dd9c53138e666bff42f60b933954

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b546b6011889d9f3cf01b8dc0ac8745a

SHA1
f6c2db1d923bfd7bc9c0d4325af6a1559736a2e7

SHA256
0fcc63e7c6e5295d2352be725abd03f8f1a50eb267afa929e7b9054d98ca7494

SHA512
20b0e14d42c3bd3621c89fd66505c774cbb80e5a78b7456bb2608c408d26affbe30a3c7b40be2e91dc59f0487730cf1ac37598c1157be4237ffa833ddb40ab0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
665857924071fd4802146535bdb52699

SHA1
8ce45c448a64ec189af8e8b95864f554c9a492b8

SHA256
c9b9efcce03275ba1114e2d032104a3a5e48bae6b120d79e658ce2377e96ee83

SHA512
21d22c001baab83ab31bc81307136a0f486f5b707c1c0aa096806955814eb089a213e960ebafffdec571c1db728d59e8e68a7560bc988a3464cbd855cb4eba94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a643770107c483d1ef570ef3c917fad8

SHA1
9e3d6b27719b81b43892529b7fb1fdff33d6e9da

SHA256
465b3b4b3e50796e2fcc7d204000b061777de87534aecbc4f4985fd8830aab13

SHA512
3dbd6ca18ad34a7bc27aa414660f227464e1ba169cad926ec9647a8d67d0a3ee832d8e2e1022c9ec3327153e548e53e3d8aeb33086ca689daafb02fbccc49a65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
598c057f993ee34357c8bff0879bae23

SHA1
22ffccb3c8b9631291b5f1b8de22036ad4ac808f

SHA256
a3b1e2398232552b78607ea5a727a1b0545042b28bc5f0bdd90be5468104dfdb

SHA512
6e5a3455f1512278e931ed25589044eaf641c8cbaed4e586ad0768eca4dd2c95c438f0098facc94aab8ee61d3ac1da93a248cf7af05844e3ff2bb99b2d07aec1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HW1W9CWT\searchDDLPTNT0.htm

Filesize
117KB

MD5
659cefb788468d5b76a95999fa7ff49e

SHA1
6cff98ff8396bffff419134cd5064a4b049dd8f7

SHA256
bfc3f312b07ce1a705ca2ba5c8792396bb71ca47e65d3d2d968b226e66458cbe

SHA512
8119aa6a772a62148e3d805943cbd009990e5ab52afac7f1503cf74b9f50f67cac513d5696ff8b5981411337a9bd9411db2ec5ab34b6566f97358d5268298c5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HW1W9CWT\search[4].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IQ7C270L\KKY2VJWL.htm

Filesize
175KB

MD5
ca7831226a494444a9c42f2640a096ab

SHA1
fd83a2c2cae3cd728d43babafc49a6231fb8bc2c

SHA256
2bbf236df4e8ef1dcfc3b54f44062c86079b8b6bd3f52adddee17098027099d8

SHA512
6831783809087442a6e902fc9d41d98d33e3f5772cd59043abc2adbc35516f1b901be69812f02b8ad23a78fafa885e47eade7eea765bae3b5d9b803b15c81222

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JCLKWRUL\J2R6GPU6.htm

Filesize
175KB

MD5
fbfe8f9ceaf6ee7badd2960c859f5ea4

SHA1
d7f21bf097d202d5474e4ce8bb97556bed204802

SHA256
83a300736792e0c2677e180529c7c98c4c1f42e543f56683d8197ddf4fea3aa6

SHA512
71b2be13cf2ab66e3c6b064238632b6fdda4523a97da8dbf257c2db8524631f56f6102591f9f02edee385cd36ce5781511b27515d7022be9a44ed146174f44cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZLRR78K7\results[3].htm

Filesize
1KB

MD5
211da0345fa466aa8dbde830c83c19f8

SHA1
779ece4d54a099274b2814a9780000ba49af1b81

SHA256
aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5

SHA512
37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZLRR78K7\search[5].htm

Filesize
126KB

MD5
317c6cbde01221a027100618b98f384d

SHA1
f8d7b1bc4b78d3ad854da72f048e6554638e59de

SHA256
99c7b65f988b486df12b43052340cac93def744c004ce6ad02df82de7fcbcb96

SHA512
0b778180f173a3a5f17ba1cdbb88526f78e71da152dcdd053e6507c10eb11a20b41eae6b8e2bb64a4a1d3465a4390bcdc8441120d474f8970f5aba424e34c863

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9D36.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9437.tmp

Filesize
40KB

MD5
1ca0f1f82f28dbc40ea9d53505111d79

SHA1
f709f7a2bfbc4cdaea84bf8737cccfa4dd54c886

SHA256
90577d703c61ed527b2028ab87ee1317d6a7534d0fb10550b0eae031de14d2c2

SHA512
8d32d8ccd666e677214997449a242632e08d3124c5c1049542e87809585e20411395c828ecba1a6d2af723a32301f17143b17fab5cf3665be35885a056781765

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
0a842886b95e1f71858afc7c61baab3d

SHA1
1232a377371a0e47fd2d44a48e9974c1e7b26658

SHA256
fff88b87c0838c5484c412f05f6e773e9b8407c4973c8f5d50b67821ca5d7324

SHA512
4d58e3a2410ef3ffb1b397b26e0d5709d0a7919e34c69d757fc2dc7832c69fd729b4e5900d76a219d17b84a599d0e31fe17dafa0c14a50b9a90d8cad2f1860aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
214f52e3239dfe9391872750bf3cff2e

SHA1
a75081498faeff7aa60701d8bfea9576c156188a

SHA256
70baf557e4ac04470871530565d95212d9e32a3d60dee664c3f6670a1db73969

SHA512
331adcdb350c0c22416df37f6e24b432a0ce307a8ad2bbb524d403640aea116fa0b2c1ac19f4cdb6c4772a222599964d189a828a3198e6a4250aac595e91b5d5

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2888-8-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2888-0-0x0000000000500000-0x000000000050D000-memory.dmp

Filesize
52KB

Download
memory/2888-23-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2888-22-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2888-9-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-27-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-66-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-17-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-1206-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-41-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-37-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-1944-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-1945-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2968-1949-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads