Overview

overview

10

Static

static

3

90cd9d0894...18.exe

windows7-x64

10

90cd9d0894...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 06:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    90cd9d08942324a7771d50cdbe4418b3_JaffaCakes118.exe
  • Size 196KB
  • Sample240603-g2cm2sed8s
  • SHA256 823d51adf8a048bc710c14b604f3af4260fa4bc9f95d8b67b1809089ce69da69
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 32 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 9 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 9 IoCs
    evasion
  • Disables RegEdit via registry modification 16 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 16 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 51 IoCs
  • Loads dropped DLL 44 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 48 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 38 IoCs
  • Drops file in Windows directory 22 IoCs
  • Program crash 11 IoCs
  • Modifies Control Panel 64 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 48 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 16 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 4 IoCs
  • Suspicious use of SetWindowsHookEx 52 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 32 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\90cd9d08942324a7771d50cdbe4418b3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\90cd9d08942324a7771d50cdbe4418b3_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:840
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Modifies WinLogon
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:4516
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 744
        3⤵
        • Program crash
        PID:780
        • C:\Windows\SysWOW64\Shell.exe
          "C:\Windows\system32\Shell.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          PID:3764
        • C:\Windows\SysWOW64\Shell.exe
          "C:\Windows\system32\Shell.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          PID:1608
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1696
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:4332
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:4796
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:3552
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:432
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Modifies WinLogon for persistence
          • Disables RegEdit via registry modification
          • Disables cmd.exe use via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Modifies WinLogon
          • Modifies Control Panel
          • Modifies Internet Explorer settings
          • Modifies Internet Explorer start page
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:2904
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 708
            5⤵
            • Program crash
            PID:4412
            • C:\Windows\SysWOW64\Shell.exe
              "C:\Windows\system32\Shell.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:3032
            • C:\Windows\SysWOW64\Shell.exe
              "C:\Windows\system32\Shell.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:4000
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:4528
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:464
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:4344
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Disables RegEdit via registry modification
          • Disables cmd.exe use via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Modifies WinLogon
          • Modifies Control Panel
          • Modifies Internet Explorer settings
          • Modifies Internet Explorer start page
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:2220
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 196
            5⤵
            • Program crash
            PID:5092
            • C:\Windows\SysWOW64\Shell.exe
              "C:\Windows\system32\Shell.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:4188
            • C:\Windows\SysWOW64\Shell.exe
              "C:\Windows\system32\Shell.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:512
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Modifies WinLogon
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2632
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 700
          4⤵
          • Program crash
          PID:2172
          • C:\Windows\SysWOW64\Shell.exe
            "C:\Windows\system32\Shell.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:4128
          • C:\Windows\SysWOW64\Shell.exe
            "C:\Windows\system32\Shell.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:2780
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Modifies WinLogon
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:2432
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 732
        3⤵
        • Program crash
        PID:4216
        • C:\Windows\SysWOW64\Shell.exe
          "C:\Windows\system32\Shell.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Disables RegEdit via registry modification
          • Disables cmd.exe use via registry modification
          • Executes dropped EXE
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Modifies WinLogon
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies Control Panel
          • Modifies Internet Explorer settings
          • Modifies Internet Explorer start page
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:2336
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 716
            5⤵
            • Program crash
            PID:3532
            • C:\Windows\SysWOW64\Shell.exe
              "C:\Windows\system32\Shell.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:2964
            • C:\Windows\SysWOW64\Shell.exe
              "C:\Windows\system32\Shell.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:1096
        • C:\Windows\SysWOW64\Shell.exe
          "C:\Windows\system32\Shell.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Disables RegEdit via registry modification
          • Disables cmd.exe use via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Modifies WinLogon
          • Modifies Control Panel
          • Modifies Internet Explorer settings
          • Modifies Internet Explorer start page
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:2076
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 676
            5⤵
            • Program crash
            PID:1556
            • C:\Windows\SysWOW64\Shell.exe
              "C:\Windows\system32\Shell.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:2436
            • C:\Windows\SysWOW64\Shell.exe
              "C:\Windows\system32\Shell.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:1208
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Modifies WinLogon
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:5060
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 672
        3⤵
        • Program crash
        PID:2648
        • C:\Windows\SysWOW64\Shell.exe
          "C:\Windows\system32\Shell.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:4380
        • C:\Windows\SysWOW64\Shell.exe
          "C:\Windows\system32\Shell.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:1340
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:4796
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Modifies WinLogon
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:3628
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 656
        3⤵
        • Program crash
        PID:5056
        • C:\Windows\SysWOW64\Shell.exe
          "C:\Windows\system32\Shell.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • Disables RegEdit via registry modification
          • Disables cmd.exe use via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Enumerates connected drives
          • Modifies WinLogon
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies Control Panel
          • Modifies Internet Explorer settings
          • Modifies Internet Explorer start page
          • Modifies registry class
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2524
          • C:\Windows\Tiwi.exe
            C:\Windows\Tiwi.exe
            5⤵
            • Modifies WinLogon for persistence
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • Disables RegEdit via registry modification
            • Disables cmd.exe use via registry modification
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies system executable filetype association
            • Adds Run key to start application
            • Enumerates connected drives
            • Modifies WinLogon
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Modifies Control Panel
            • Modifies Internet Explorer settings
            • Modifies Internet Explorer start page
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:4860
            • C:\Windows\Tiwi.exe
              C:\Windows\Tiwi.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:4576
            • C:\Windows\SysWOW64\IExplorer.exe
              C:\Windows\system32\IExplorer.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:2304
            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:4092
            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:4848
            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:4528
          • C:\Windows\SysWOW64\IExplorer.exe
            C:\Windows\system32\IExplorer.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:3032
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:4056
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:3312
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
            5⤵
            • Modifies WinLogon for persistence
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • Disables RegEdit via registry modification
            • Disables cmd.exe use via registry modification
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies system executable filetype association
            • Adds Run key to start application
            • Modifies WinLogon
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Modifies Control Panel
            • Modifies Internet Explorer settings
            • Modifies Internet Explorer start page
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:5032
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 736
              6⤵
              • Program crash
              PID:1736
              • C:\Windows\SysWOW64\Shell.exe
                "C:\Windows\system32\Shell.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:1700
              • C:\Windows\SysWOW64\Shell.exe
                "C:\Windows\system32\Shell.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:3388
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:1224
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:860
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 736
        3⤵
        • Program crash
        PID:3644
        • C:\Windows\SysWOW64\Shell.exe
          "C:\Windows\system32\Shell.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:764
        • C:\Windows\SysWOW64\Shell.exe
          "C:\Windows\system32\Shell.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:4676
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:4148
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:1296
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2432 -ip 2432
    1⤵
      PID:2152
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4516 -ip 4516
      1⤵
        PID:4980
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2632 -ip 2632
        1⤵
          PID:2524
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2336 -ip 2336
          1⤵
            PID:960
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2904 -ip 2904
            1⤵
              PID:4548
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2076 -ip 2076
              1⤵
                PID:5028
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2220 -ip 2220
                1⤵
                  PID:1816
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3628 -ip 3628
                  1⤵
                    PID:3036
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5060 -ip 5060
                    1⤵
                      PID:1648
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5032 -ip 5032
                      1⤵
                        PID:3040
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 860 -ip 860
                        1⤵
                          PID:756

                        Network

                              MITRE ATT&CK Enterprise v15

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Replication Through Removable Media

                              1
                              T1091

                              Execution

                              Persistence

                              Boot or Logon Autostart Execution

                              3
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Winlogon Helper DLL

                              2
                              T1547.004

                              Event Triggered Execution

                              1
                              T1546

                              Change Default File Association

                              1
                              T1546.001

                              Privilege Escalation

                              Boot or Logon Autostart Execution

                              3
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Winlogon Helper DLL

                              2
                              T1547.004

                              Event Triggered Execution

                              1
                              T1546

                              Change Default File Association

                              1
                              T1546.001

                              Defense Evasion

                              Hide Artifacts

                              2
                              T1564

                              Hidden Files and Directories

                              2
                              T1564.001

                              Modify Registry

                              9
                              T1112

                              Credential Access

                              Discovery

                              Peripheral Device Discovery

                              1
                              T1120

                              Query Registry

                              1
                              T1012

                              System Information Discovery

                              1
                              T1082

                              Lateral Movement

                              Replication Through Removable Media

                              1
                              T1091

                              Collection

                              Command and Control

                              Exfiltration

                              Impact

                              Inhibit System Recovery

                              1
                              T1490

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              Tiwi.exe
                              • Path C:\Tiwi.exe
                              • Size 196KB
                              • SHA256 01756e747b13d9938563506d5a8d53ffc4c117900d5c804e8b16360dff9fd439
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              cute.exe
                              • Path C:\Users\Admin\AppData\Local\WINDOWS\cute.exe
                              • Size 196KB
                              • SHA256 773f2e90b105e09a2fad36005b16ba803487b5778c2bb7588b8706496531770d
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              imoet.exe
                              • Path C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe
                              • Size 196KB
                              • SHA256 ddf19641d7286a8522caf8deeab74e6bd8fa8e3b9062e19a47d8e51467a9cff9
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              winlogon.exe
                              • Path C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe
                              • Size 196KB
                              • SHA256 dbc8c220ada20a9e4c765a7e29ad1cc015fb98d06667ae933c6aabdc74f164d2
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              cute.exe
                              • Path C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
                              • Size 196KB
                              • SHA256 4269ffa89ba7dd5a5afab8c2f4674bfe4464c42011488f418a5cb9f1a733edb0
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              imoet.exe
                              • Path C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
                              • Size 196KB
                              • SHA256 55aa82b9bab416ccb379e606c3a1e2a56bff63a1f2e7dbc456a6f26b0b8f8c55
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              lsass.exe
                              • Path C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
                              • Size 45KB
                              • SHA256 5dbd8de6344d914b73130c3d6eb56cb55a4ef9c784d1df96e27618147908cde9
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              lsass.exe
                              • Path C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
                              • Size 45KB
                              • SHA256 8052209411858903700e14e4a0a5296d177e875a5b7e5e5c084fa2a13dfbb040
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              IExplorer.exe
                              • Path C:\Windows\SysWOW64\IExplorer.exe
                              • Size 196KB
                              • SHA256 55964043f3bca91c2ce2880e229dee9afa93a333c1601adb518429cf99b8e8d8
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              shell.exe
                              • Path C:\Windows\SysWOW64\shell.exe
                              • Size 196KB
                              • SHA256 db4d0fdb0fb189e82e656c78a3986458c30e91a39eeea3fd727e2f4540a2dc27
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              shell.exe
                              • Path C:\Windows\SysWOW64\shell.exe
                              • Size 196KB
                              • SHA256 823d51adf8a048bc710c14b604f3af4260fa4bc9f95d8b67b1809089ce69da69
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              msvbvm60.dll
                              • Path C:\Windows\msvbvm60.dll
                              • Size 1.4MB
                              • SHA256 898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              tiwi.exe
                              • Path C:\Windows\tiwi.exe
                              • Size 196KB
                              • SHA256 3b607ddea8fe9051dc40e4eb88d6c195e8fcf7358492486669c4e040018aa7dd
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              tiwi.exe
                              • Path C:\Windows\tiwi.exe
                              • Size 196KB
                              • SHA256 53c8e769573b77b97d2478e83a1bf891af0a08d80a0f1606d05e037f61fd64b3
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              present.txt
                              • Path C:\present.txt
                              • Size 729B
                              • SHA256 574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad
                              • MD5 SHA1 SHA512
                              Submit Download

                              autorun.inf
                              • Path F:\autorun.inf
                              • Size 39B
                              • SHA256 e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e
                              • MD5 SHA1 SHA512
                              Submit Download

                              memory/432-175-0x0000000000400000-0x000000000042A000-memory.dmp
                              Download

                              memory/840-0-0x0000000000400000-0x000000000042A000-memory.dmp
                              Download

                              memory/1696-102-0x0000000000400000-0x000000000042A000-memory.dmp
                              Download

                              memory/2336-115-0x0000000000400000-0x000000000042A000-memory.dmp
                              Download

                              memory/2432-110-0x0000000000400000-0x000000000042A000-memory.dmp
                              Download

                              memory/2524-344-0x0000000000400000-0x000000000042A000-memory.dmp
                              Download

                              memory/2632-182-0x0000000000400000-0x000000000042A000-memory.dmp
                              Download

                              memory/2904-205-0x0000000000400000-0x000000000042A000-memory.dmp
                              Download

                              memory/3628-341-0x0000000000400000-0x000000000042A000-memory.dmp
                              Download

                              memory/4332-155-0x0000000000400000-0x000000000042A000-memory.dmp
                              Download

                              memory/4516-96-0x0000000000400000-0x000000000042A000-memory.dmp
                              Download

                              memory/4860-377-0x0000000000400000-0x000000000042A000-memory.dmp
                              Download

                              memory/5032-390-0x0000000000400000-0x000000000042A000-memory.dmp
                              Download

                              memory/5060-334-0x0000000000400000-0x000000000042A000-memory.dmp
                              Download