99cd6c5bf2a0bccc76155ae1270c6c65aee26f07373886b90818e43d2947ce98

General

Target

a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe
Size

163KB
MD5

a6961f695783bdf9b602551df545cbcd
SHA1

9d6f35b80e752f24f28821979f164532f46b6ad6
SHA256

99cd6c5bf2a0bccc76155ae1270c6c65aee26f07373886b90818e43d2947ce98
SHA512

9707707a92b9f158f2130362997f86ba0c77160dd19e4a60046566614806a096229d827ff376b819c107ecdec6e0808c8b63f5e38a4986f8cd78601a97dcb4ef
SSDEEP

3072:89JwqAaNrrDLrX7g5lRaBdMn67iCUF1sDpCUF1sD1L:8HwqAIfrylR+K6EF1sDDF1sD

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\niu.exe\Debugger = "ntsd -d"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guangd.exe\Debugger = "ntsd -d"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASTask.exe\Debugger = "ntsd -d"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe\Debugger = "ntsd -d"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe\Debugger = "ntsd -d"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe\Debugger = "ntsd -d"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSetup.exe	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp\Debugger = "ntsd -d"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wsyscheck.exe	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp\Debugger = "ntsd -d"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvupload.exe	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVSetup.exe\Debugger = "ntsd -d"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USBCleaner.exe\Debugger = "ntsd -d"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\av.exe	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntiU.exe	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe\Debugger = "ntsd -d"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe\Debugger = "ntsd -d"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ArSwp.exe\Debugger = "ntsd -d"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQSC.exe	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvfwMcl.exe\Debugger = "ntsd -d"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP_1.kxp\Debugger = "ntsd -d"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kwatch.exe	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe\Debugger = "ntsd -d"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UFO.exe\Debugger = "ntsd -d"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wsyscheck.exe\Debugger = "ntsd -d"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.exe\Debugger = "ntsd -d"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe\Debugger = "ntsd -d"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe\Debugger = "ntsd -d"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sos.exe	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoRun.exe	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.exe	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ArSwp2.exe\Debugger = "ntsd -d"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe\Debugger = "ntsd -d"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmartUp.exe	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREng.EXE\Debugger = "ntsd -d"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxFwHlp.exe\Debugger = "ntsd -d"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsstat.exe	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe\Debugger = "ntsd -d"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe\Debugger = "ntsd -d"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SysSafe.exe\Debugger = "ntsd -d"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe\Debugger = "ntsd -d"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapw32.exe	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconsol.exe	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe\Debugger = "ntsd -d"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe\Debugger = "ntsd -d"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFWSvc.exe	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe\Debugger = "ntsd -d"	explorer.exe

Drops startup file 1 IoCs

Processes:

explorer.exe

description ioc process

File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1681.lnk explorer.exe
Executes dropped EXE 1 IoCs

Processes:

explorer.exe

pid process

1988 explorer.exe
Loads dropped DLL 3 IoCs

Processes:

a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exeexplorer.exe

pid process

2040 a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe
2040 a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe
1988 explorer.exe
Modifies system executable filetype association 2 TTPs 1 IoCs
persistence

Modify Registry
T1112

Change Default File Association
T1546.001

Processes:

explorer.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" explorer.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1681.lnk	explorer.exe

pid	process
1988	explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1"	explorer.exe

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

explorer.exea6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe

description	ioc	process
File opened (read-only)	\??\r:	explorer.exe
File opened (read-only)	\??\s:	explorer.exe
File opened (read-only)	\??\j:	explorer.exe
File opened (read-only)	\??\j:	a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe
File opened (read-only)	\??\e:	explorer.exe
File opened (read-only)	\??\g:	explorer.exe
File opened (read-only)	\??\o:	explorer.exe
File opened (read-only)	\??\e:	a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe
File opened (read-only)	\??\y:	a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe
File opened (read-only)	\??\i:	explorer.exe
File opened (read-only)	\??\p:	explorer.exe
File opened (read-only)	\??\v:	explorer.exe
File opened (read-only)	\??\v:	a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe
File opened (read-only)	\??\n:	a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe
File opened (read-only)	\??\k:	explorer.exe
File opened (read-only)	\??\l:	explorer.exe
File opened (read-only)	\??\n:	explorer.exe
File opened (read-only)	\??\u:	explorer.exe
File opened (read-only)	\??\y:	explorer.exe
File opened (read-only)	\??\l:	a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe
File opened (read-only)	\??\k:	a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe
File opened (read-only)	\??\z:	a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe
File opened (read-only)	\??\h:	explorer.exe
File opened (read-only)	\??\w:	explorer.exe
File opened (read-only)	\??\g:	a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe
File opened (read-only)	\??\t:	a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe
File opened (read-only)	\??\u:	a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe
File opened (read-only)	\??\w:	a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe
File opened (read-only)	\??\x:	a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe
File opened (read-only)	\??\q:	explorer.exe
File opened (read-only)	\??\t:	explorer.exe
File opened (read-only)	\??\z:	explorer.exe
File opened (read-only)	\??\r:	a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe
File opened (read-only)	\??\i:	a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe
File opened (read-only)	\??\m:	a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe
File opened (read-only)	\??\o:	a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe
File opened (read-only)	\??\p:	a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe
File opened (read-only)	\??\q:	a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe
File opened (read-only)	\??\s:	a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe
File opened (read-only)	\??\h:	a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe
File opened (read-only)	\??\x:	explorer.exe
File opened (read-only)	\??\m:	explorer.exe

Drops file in Program Files directory 6 IoCs

Processes:

explorer.exea6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\uiui8.dll	explorer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe	explorer.exe
File opened for modification	C:\Program Files (x86)\Common Files	explorer.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe	a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe	a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\uiui8.dll	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1"	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exeexplorer.exe

pid	process
2040	a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

explorer.exe

description pid process

Token: SeDebugPrivilege 1988 explorer.exe
Token: SeDebugPrivilege 1988 explorer.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

explorer.exe

pid process

1988 explorer.exe
1988 explorer.exe

description	pid	process
Token: SeDebugPrivilege	1988	explorer.exe
Token: SeDebugPrivilege	1988	explorer.exe

pid	process
1988	explorer.exe
1988	explorer.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe

description	pid	process	target process
PID 2040 wrote to memory of 1988	2040	a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe	explorer.exe
PID 2040 wrote to memory of 1988	2040	a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe	explorer.exe
PID 2040 wrote to memory of 1988	2040	a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe	explorer.exe
PID 2040 wrote to memory of 1988	2040	a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a6961f695783bdf9b602551df545cbcd_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2040

C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Sets file execution options in registry
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1988

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\1681.lnk
Filesize
449B

MD5
ae342318b288719168082ba3f26d8e33

SHA1
0464e616edc87b677de3e514a5e5baf696ac92ec

SHA256
331939a00efce9cab0dc7e690b7be7de0e3d2378f7ea48640bc80ead177332ec

SHA512
2e7d224df58bdc39395208fae51726c6d7eff76752c1fdc746da3294b159c1b6fbc9440354ff935c41b2d18d6734cfcc6c18fb726b78fc7d73d870a32cebda34

Download Submit
\Program Files (x86)\Common Files\microsoft shared\explorer.exe
Filesize
163KB

MD5
a6961f695783bdf9b602551df545cbcd

SHA1
9d6f35b80e752f24f28821979f164532f46b6ad6

SHA256
99cd6c5bf2a0bccc76155ae1270c6c65aee26f07373886b90818e43d2947ce98

SHA512
9707707a92b9f158f2130362997f86ba0c77160dd19e4a60046566614806a096229d827ff376b819c107ecdec6e0808c8b63f5e38a4986f8cd78601a97dcb4ef

Download Submit
\Program Files (x86)\Common Files\uiui8.dll
Filesize
17KB

MD5
0cbc6b0568209d4ed0a0ff71db4fd13c

SHA1
8a7166784536e6ebe718d82667d2314c42938387

SHA256
d52d74da5230180634f0459f228202dc876c1c2a5661badd170f8308061f1a60

SHA512
4494eb6b4a1363b06b25bcf3504517279dbf99bc35ffc95d98e5f55804148ed1fbc68e99295fbc2971abb6f58d945e0e8d0f17e0e7f7bf9aa746486a580fc343

Download Submit
memory/1988-45-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1988-54-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1988-31-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1988-36-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1988-40-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1988-89-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1988-49-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1988-32-0x0000000000390000-0x000000000039B000-memory.dmp

Filesize
44KB

Download
memory/1988-58-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1988-63-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1988-67-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1988-72-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1988-76-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1988-81-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1988-85-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2040-24-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads