ef4a2ad08c55e0a5404d1293128987e7b5d5b27a5ad2fcf54bd06d0cd9eb361c

Analysis

max time kernel
143s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.exe
Size 3.7MB
Sample240614-behb5ayepc
SHA256 ef4a2ad08c55e0a5404d1293128987e7b5d5b27a5ad2fcf54bd06d0cd9eb361c
MD5 a7728562c9d2d733cac56f4eea629afb
SHA1 84d681995880272fd7b366944d464050422fbc1a
SHA512 47a5e85da0629201b5f930aac59daf6e2e13c1abc04c86caeed6144b61c51fe35bd34a478337141a8a8ff774af048c1dba620b493ad33b86b6dbef0457ead44e
SSDEEP 98304:W5ZDQAUIPI8b4juADSGXx/vYdY+enhIb+wDQwiUGoV+ziSpZ3hUX3m1TX:usVwIljuADSgx4dY+yH+V++SpZxUO
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp

Executes dropped EXE 4 IoCs

pid	Process
4264	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp
4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp
3224	_setup.exe
980	_setup.tmp

Loads dropped DLL 2 IoCs

pid	Process
4264	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp
4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp

Checks system information in the registry 2 TTPs 1 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\InstallShield\Update\ISUSPM.exe	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Common Files\InstallShield\Update\is-QF1KO.tmp	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2948	sc.exe
1936	sc.exe
4684	sc.exe
3472	sc.exe
1200	sc.exe
3552	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4624	schtasks.exe
3308	schtasks.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3576	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp
4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3576	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 4264	4076	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.exe	82
PID 4076 wrote to memory of 4264	4076	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.exe	82
PID 4076 wrote to memory of 4264	4076	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.exe	82
PID 4264 wrote to memory of 3264	4264	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	84
PID 4264 wrote to memory of 3264	4264	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	84
PID 4264 wrote to memory of 3264	4264	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	84
PID 3264 wrote to memory of 4520	3264	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.exe	85
PID 3264 wrote to memory of 4520	3264	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.exe	85
PID 3264 wrote to memory of 4520	3264	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.exe	85
PID 4520 wrote to memory of 3576	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	87
PID 4520 wrote to memory of 3576	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	87
PID 4520 wrote to memory of 3576	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	87
PID 4520 wrote to memory of 1708	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	91
PID 4520 wrote to memory of 1708	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	91
PID 4520 wrote to memory of 1708	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	91
PID 4520 wrote to memory of 1200	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	93
PID 4520 wrote to memory of 1200	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	93
PID 4520 wrote to memory of 1200	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	93
PID 4520 wrote to memory of 3552	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	95
PID 4520 wrote to memory of 3552	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	95
PID 4520 wrote to memory of 3552	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	95
PID 4520 wrote to memory of 2948	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	97
PID 4520 wrote to memory of 2948	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	97
PID 4520 wrote to memory of 2948	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	97
PID 4520 wrote to memory of 1936	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	99
PID 4520 wrote to memory of 1936	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	99
PID 4520 wrote to memory of 1936	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	99
PID 4520 wrote to memory of 4684	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	101
PID 4520 wrote to memory of 4684	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	101
PID 4520 wrote to memory of 4684	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	101
PID 4520 wrote to memory of 3472	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	103
PID 4520 wrote to memory of 3472	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	103
PID 4520 wrote to memory of 3472	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	103
PID 4520 wrote to memory of 4624	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	105
PID 4520 wrote to memory of 4624	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	105
PID 4520 wrote to memory of 4624	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	105
PID 4520 wrote to memory of 3308	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	107
PID 4520 wrote to memory of 3308	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	107
PID 4520 wrote to memory of 3308	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	107
PID 4520 wrote to memory of 3224	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	109
PID 4520 wrote to memory of 3224	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	109
PID 4520 wrote to memory of 3224	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	109
PID 4520 wrote to memory of 1808	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	110
PID 4520 wrote to memory of 1808	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	110
PID 4520 wrote to memory of 1808	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	110
PID 3224 wrote to memory of 980	3224	_setup.exe	112
PID 3224 wrote to memory of 980	3224	_setup.exe	112
PID 3224 wrote to memory of 980	3224	_setup.exe	112
PID 4520 wrote to memory of 3720	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	113
PID 4520 wrote to memory of 3720	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	113
PID 4520 wrote to memory of 3720	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	113
PID 4520 wrote to memory of 3248	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	115
PID 4520 wrote to memory of 3248	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	115
PID 4520 wrote to memory of 3248	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	115
PID 4520 wrote to memory of 2452	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	117
PID 4520 wrote to memory of 2452	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	117
PID 4520 wrote to memory of 2452	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	117
PID 4520 wrote to memory of 4960	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	120
PID 4520 wrote to memory of 4960	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	120
PID 4520 wrote to memory of 4960	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	120
PID 4520 wrote to memory of 3216	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	122
PID 4520 wrote to memory of 3216	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	122
PID 4520 wrote to memory of 3216	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	122
PID 4520 wrote to memory of 1340	4520	a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp	124

C:\Users\Admin\AppData\Local\Temp\a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Users\Admin\AppData\Local\Temp\is-O4VV0.tmp\a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-O4VV0.tmp\a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp" /SL5="$6016E,3599818,122880,C:\Users\Admin\AppData\Local\Temp\a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Users\Admin\AppData\Local\Temp\a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.exe" /VERYSILENT
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\is-BHV3T.tmp\a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-BHV3T.tmp\a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp" /SL5="$40218,3599818,122880,C:\Users\Admin\AppData\Local\Temp\a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4520
    - - C:\Windows\SysWOW64\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /f /im "ISUSPM.exe"
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3576
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks.exe" /delete /tn * /f
        5⤵
        
        PID:1708
    - - C:\Windows\SysWOW64\sc.exe
        
        "sc.exe" delete isupdate.exe
        5⤵
        Launches sc.exe
        
        PID:1200
    - - C:\Windows\SysWOW64\sc.exe
        
        "sc.exe" delete ISUSPM.exe
        5⤵
        Launches sc.exe
        
        PID:3552
    - - C:\Windows\SysWOW64\sc.exe
        
        "sc.exe" delete msiupd.exe
        5⤵
        Launches sc.exe
        
        PID:2948
    - - C:\Windows\SysWOW64\sc.exe
        
        "sc.exe" delete router.exe
        5⤵
        Launches sc.exe
        
        PID:1936
    - - C:\Windows\SysWOW64\sc.exe
        
        "sc.exe" delete Updater.exe
        5⤵
        Launches sc.exe
        
        PID:4684
    - - C:\Windows\SysWOW64\sc.exe
        
        "sc.exe" delete updatesvc.exe
        5⤵
        Launches sc.exe
        
        PID:3472
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks.exe" /Create /F /SC ONLOGON /RL HIGHEST /TN "InstallShield® Update Service Scheduler" /TR "\"C:\Program Files (x86)\Common Files\InstallShield\Update\ISUSPM.exe\"
        5⤵
        Creates scheduled task(s)
        
        PID:4624
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks.exe" /Create /F /SC WEEKLY /D WED,SUN /ST 12:00 /RL HIGHEST /TN "Optimize Thumbnail Cache Files" /TR "wscript.exe //nologo //E:jscript //B \"C:\ProgramData\InstallShield\Update\isuspm.ini\"
        5⤵
        Creates scheduled task(s)
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\is-O8RF4.tmp\_setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-O8RF4.tmp\_setup.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\is-DTQ4P.tmp\_setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-DTQ4P.tmp\_setup.tmp" /SL5="$D0162,2952592,69120,C:\Users\Admin\AppData\Local\Temp\is-O8RF4.tmp\_setup.exe"
        6⤵
        Executes dropped EXE
        
        PID:980
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy
        5⤵
        
        PID:1808
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=ActiveSync
        5⤵
        
        PID:3720
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy
        5⤵
        
        PID:3248
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy
        5⤵
        
        PID:2452
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy
        5⤵
        
        PID:4960
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
        5⤵
        
        PID:3216
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.AccountsControl_cw5n1h2txyewy
        5⤵
        
        PID:1340
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.AsyncTextService_8wekyb3d8bbwe
        5⤵
        
        PID:3528
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.BioEnrollment_cw5n1h2txyewy
        5⤵
        
        PID:1860
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.CredDialogHost_cw5n1h2txyewy
        5⤵
        
        PID:208
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.ECApp_8wekyb3d8bbwe
        5⤵
        
        PID:3220
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.LockApp_cw5n1h2txyewy
        5⤵
        
        PID:3968
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe
        5⤵
        
        PID:2832
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.MicrosoftEdge_8wekyb3d8bbwe
        5⤵
        
        PID:4364
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.VCLibs.140.00_8wekyb3d8bbwe
        5⤵
        
        PID:404
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Win32WebViewHost_cw5n1h2txyewy
        5⤵
        
        PID:3280
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy
        5⤵
        
        PID:4148
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy
        5⤵
        
        PID:4776
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.CallingShellApp_cw5n1h2txyewy
        5⤵
        
        PID:2308
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.CapturePicker_cw5n1h2txyewy
        5⤵
        
        PID:2944
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy
        5⤵
        
        PID:1660
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
        5⤵
        
        PID:1200
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.NarratorQuickStart_8wekyb3d8bbwe
        5⤵
        
        PID:3728
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy
        5⤵
        
        PID:1968
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy
        5⤵
        
        PID:1196
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.ParentalControls_cw5n1h2txyewy
        5⤵
        
        PID:1208
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy
        5⤵
        
        PID:4136
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy
        5⤵
        
        PID:3308
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.Search_cw5n1h2txyewy
        5⤵
        
        PID:3588
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy
        5⤵
        
        PID:3348
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy
        5⤵
        
        PID:3760
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy
        5⤵
        
        PID:4312
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy
        5⤵
        
        PID:3236
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.XboxGameCallableUI_cw5n1h2txyewy
        5⤵
        
        PID:3460
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=MicrosoftWindows.Client.CBS_cw5n1h2txyewy
        5⤵
        
        PID:2268
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy
        5⤵
        
        PID:2868
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=NcsiUwpApp_8wekyb3d8bbwe
        5⤵
        
        PID:3432
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Windows.CBSPreview_cw5n1h2txyewy
        5⤵
        
        PID:1312
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=windows.immersivecontrolpanel_cw5n1h2txyewy
        5⤵
        
        PID:3384
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Windows.PrintDialog_cw5n1h2txyewy
        5⤵
        
        PID:4012
    - - C:\Windows\SysWOW64\CheckNetIsolation.exe
        
        "C:\Windows\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=windows_ie_ac_001
        5⤵
        
        PID:4368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

_setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-DTQ4P.tmp\_setup.tmp
Size 703KB
SHA256 95c06acac4fe4598840e5556f9613d43aa1039c52dac64536f59e45a70f79da6
MD5 1778c1f66ff205875a6435a33229ab3c
SHA1 5b6189159b16c6f85feed66834af3e06c0277a19
SHA512 8844de1296ce707e3c5c71823f5118f8f2e50287ace3a2ee1ec0b69df0ec48ebcf5b755db669d2cd869d345fb06a9c07b36e98eda8c32a9b26b8fe22bdc105a0
SSDEEP 12288:0QszP8NRMXpc/rPx37/zHBA66pE+4p1YR71CERdH6rN9by7HaOMebmx9Ru:0QQP8YXpc/rPx37/zHBA6plp+51CErzf
MD5 SHA1 SHA512 SSDEEP

Submit Download

a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-O4VV0.tmp\a7728562c9d2d733cac56f4eea629afb_JaffaCakes118.tmp
Size 767KB
SHA256 9b573214734e68072f9c71a28d4507483e85909d7a333879a994ac2d6e169876
MD5 e4278a3cf1183d8672e15cd3576724eb
SHA1 399f058a484503fd7a4cda740bb0e47c3e75beac
SHA512 3bf9edd0fe179079e97b31f08d5005fc02e2849768e78fd95e85c0613f7ae29e5503ee851bf34cd2fa9a021f43e42f830538cc0a232f1eacbc34813a6eb3c734
SSDEEP 12288:EsMLIMoi3rPR37dzHRA6nX0D9OKWbO7SERb5rNUK1bce07yx9ht:jMcMoi3rPR37dzHRA6G7WbuSEmK507yT
MD5 SHA1 SHA512 SSDEEP

Submit Download

_setup.exe

Path C:\Users\Admin\AppData\Local\Temp\is-O8RF4.tmp\_setup.exe
Size 3.1MB
SHA256 64c731adbe1b96cb5765203b1e215093dcf268d020b299445884a4ae62ed2d3a
MD5 a02164371a50c5ff9fa2870ef6e8cfa3
SHA1 060614723f8375ecaad8b249ff07e3be082d7f25
SHA512 6c6903f3a3092fd3d63c373189f2c06e12de032ee4fd6b80a15f58eaeb2079f3ae8a8bcdac85a358b1f9070b192b1c8260f9aa127d009b5afce475f966e91326
SSDEEP 98304:CgbTbhBxCLS0Kx/XRCsFlPsKh9ApbeicTkxchy6pA32b7SuzWl:rxBxCLS3xZCsFyBzxcE6pAGbq
MD5 SHA1 SHA512 SSDEEP

Submit Download

idp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-UR2OM.tmp\idp.dll
Size 216KB
SHA256 203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
MD5 8f995688085bced38ba7795f60a5e1d3
SHA1 5b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA512 043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35
SSDEEP 3072:6XHWOJd5D0ocxYF0+CT4zNHNpwZNjlhBKL/kg/0r4YLuztNJaFlCx:6G6tae7wZNOpiWP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/980-55-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/3224-54-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/3224-38-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/3264-53-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/3264-14-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/3264-17-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4076-22-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4076-1-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4076-3-0x0000000000401000-0x000000000040C000-memory.dmp

Download

memory/4264-7-0x0000000000400000-0x00000000004CE000-memory.dmp

Download

memory/4264-18-0x0000000000400000-0x00000000004CE000-memory.dmp

Download

memory/4520-50-0x0000000000400000-0x00000000004CE000-memory.dmp

Download

memory/4520-24-0x0000000000400000-0x00000000004CE000-memory.dmp

Download