51101d0364db593d038389bf492e5b14166d5f2fd5618b692a389434a8f8eaa7

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
Size 184KB
Sample240617-gp4k1a1fml
SHA256 51101d0364db593d038389bf492e5b14166d5f2fd5618b692a389434a8f8eaa7
MD5 b716ecf681cd8ba430cf20639914013b
SHA1 e497f9f94d896d362de3ae85d4d298b644767553
SHA512 5113dfc381dea2996feca51c77ca759d76542781caa96276da4211a23f0906bee9f98ee12bebd1485c34949a0934545826b3326dd2510fedc5b586a1b8f43fdc
SSDEEP 3072:Z41IBtQnE7OhssdWJ5jy392aCmCbBqlp7h8k1F+XrG0N83CKt5+oVzjOYhRBcc:Xqvhssdu5jyYaCmCQj7hBCXrG0N835zf
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

defense_evasion execution impact persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Executes dropped EXE 2 IoCs

pid	Process
5040	ivyba.exe
5056	ivyba.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{B3F02842-70B3-6651-2C5A-69E29CFB16ED} = "C:\\Users\\Admin\\AppData\\Roaming\\Yniq\\ivyba.exe"	Explorer.EXE

Suspicious use of NtSetInformationThreadHideFromDebugger 25 IoCs

pid	Process
3524	Explorer.EXE
3524	Explorer.EXE
3524	Explorer.EXE
3524	Explorer.EXE
5056	ivyba.exe
5056	ivyba.exe
5056	ivyba.exe
5056	ivyba.exe
3276	RuntimeBroker.exe
3276	RuntimeBroker.exe
3276	RuntimeBroker.exe
3276	RuntimeBroker.exe
868	RuntimeBroker.exe
868	RuntimeBroker.exe
868	RuntimeBroker.exe
868	RuntimeBroker.exe
60	DllHost.exe
60	DllHost.exe
60	DllHost.exe
60	DllHost.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
5056	ivyba.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3416 set thread context of 1044	3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe	89
PID 5040 set thread context of 5056	5040	ivyba.exe	93

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
3708	vssadmin.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings\MuiCache	backgroundTaskHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
5040	ivyba.exe
5040	ivyba.exe
5040	ivyba.exe
5040	ivyba.exe
5040	ivyba.exe
5040	ivyba.exe
5040	ivyba.exe
5040	ivyba.exe
5040	ivyba.exe
5040	ivyba.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeBackupPrivilege	2160	vssvc.exe
Token: SeRestorePrivilege	2160	vssvc.exe
Token: SeAuditPrivilege	2160	vssvc.exe
Token: SeShutdownPrivilege	3524	Explorer.EXE
Token: SeCreatePagefilePrivilege	3524	Explorer.EXE
Token: SeShutdownPrivilege	3524	Explorer.EXE
Token: SeCreatePagefilePrivilege	3524	Explorer.EXE
Token: SeShutdownPrivilege	3524	Explorer.EXE
Token: SeCreatePagefilePrivilege	3524	Explorer.EXE
Token: SeShutdownPrivilege	3524	Explorer.EXE
Token: SeCreatePagefilePrivilege	3524	Explorer.EXE
Token: SeShutdownPrivilege	3524	Explorer.EXE
Token: SeCreatePagefilePrivilege	3524	Explorer.EXE

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3524	Explorer.EXE
3524	Explorer.EXE
3524	Explorer.EXE
3524	Explorer.EXE
3524	Explorer.EXE

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3524	Explorer.EXE
3524	Explorer.EXE
3524	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 1044	3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe	89
PID 3416 wrote to memory of 1044	3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe	89
PID 3416 wrote to memory of 1044	3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe	89
PID 3416 wrote to memory of 1044	3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe	89
PID 3416 wrote to memory of 1044	3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe	89
PID 3416 wrote to memory of 1044	3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe	89
PID 3416 wrote to memory of 1044	3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe	89
PID 3416 wrote to memory of 1044	3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe	89
PID 3416 wrote to memory of 1044	3416	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe	89
PID 1044 wrote to memory of 5040	1044	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe	90
PID 1044 wrote to memory of 5040	1044	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe	90
PID 1044 wrote to memory of 324	1044	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe	91
PID 1044 wrote to memory of 324	1044	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe	91
PID 1044 wrote to memory of 324	1044	b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe	91
PID 5040 wrote to memory of 5056	5040	ivyba.exe	93
PID 5040 wrote to memory of 5056	5040	ivyba.exe	93
PID 5040 wrote to memory of 5056	5040	ivyba.exe	93
PID 5040 wrote to memory of 5056	5040	ivyba.exe	93
PID 5040 wrote to memory of 5056	5040	ivyba.exe	93
PID 5040 wrote to memory of 5056	5040	ivyba.exe	93
PID 5040 wrote to memory of 5056	5040	ivyba.exe	93
PID 5040 wrote to memory of 5056	5040	ivyba.exe	93
PID 5040 wrote to memory of 5056	5040	ivyba.exe	93
PID 5056 wrote to memory of 2520	5056	ivyba.exe	42
PID 5056 wrote to memory of 2520	5056	ivyba.exe	42
PID 5056 wrote to memory of 2520	5056	ivyba.exe	42
PID 5056 wrote to memory of 2560	5056	ivyba.exe	43
PID 5056 wrote to memory of 2560	5056	ivyba.exe	43
PID 5056 wrote to memory of 2560	5056	ivyba.exe	43
PID 5056 wrote to memory of 2648	5056	ivyba.exe	44
PID 5056 wrote to memory of 2648	5056	ivyba.exe	44
PID 5056 wrote to memory of 2648	5056	ivyba.exe	44
PID 5056 wrote to memory of 3524	5056	ivyba.exe	56
PID 5056 wrote to memory of 3524	5056	ivyba.exe	56
PID 5056 wrote to memory of 3524	5056	ivyba.exe	56
PID 3524 wrote to memory of 3708	3524	Explorer.EXE	94
PID 3524 wrote to memory of 3708	3524	Explorer.EXE	94
PID 5056 wrote to memory of 3648	5056	ivyba.exe	57
PID 5056 wrote to memory of 3648	5056	ivyba.exe	57
PID 5056 wrote to memory of 3648	5056	ivyba.exe	57
PID 5056 wrote to memory of 3836	5056	ivyba.exe	58
PID 5056 wrote to memory of 3836	5056	ivyba.exe	58
PID 5056 wrote to memory of 3836	5056	ivyba.exe	58
PID 5056 wrote to memory of 3980	5056	ivyba.exe	59
PID 5056 wrote to memory of 3980	5056	ivyba.exe	59
PID 5056 wrote to memory of 3980	5056	ivyba.exe	59
PID 5056 wrote to memory of 4048	5056	ivyba.exe	60
PID 5056 wrote to memory of 4048	5056	ivyba.exe	60
PID 5056 wrote to memory of 4048	5056	ivyba.exe	60
PID 5056 wrote to memory of 940	5056	ivyba.exe	61
PID 5056 wrote to memory of 940	5056	ivyba.exe	61
PID 5056 wrote to memory of 940	5056	ivyba.exe	61
PID 5056 wrote to memory of 3952	5056	ivyba.exe	62
PID 5056 wrote to memory of 3952	5056	ivyba.exe	62
PID 5056 wrote to memory of 3952	5056	ivyba.exe	62
PID 5056 wrote to memory of 2436	5056	ivyba.exe	74
PID 5056 wrote to memory of 2436	5056	ivyba.exe	74
PID 5056 wrote to memory of 2436	5056	ivyba.exe	74
PID 5056 wrote to memory of 5096	5056	ivyba.exe	76
PID 5056 wrote to memory of 5096	5056	ivyba.exe	76
PID 5056 wrote to memory of 5096	5056	ivyba.exe	76
PID 5056 wrote to memory of 4000	5056	ivyba.exe	77
PID 5056 wrote to memory of 4000	5056	ivyba.exe	77
PID 5056 wrote to memory of 4000	5056	ivyba.exe	77

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2560

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2648

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Users\Admin\AppData\Local\Temp\b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Users\Admin\AppData\Local\Temp\b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b716ecf681cd8ba430cf20639914013b_JaffaCakes118.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1044
  - - C:\Users\Admin\AppData\Roaming\Yniq\ivyba.exe
      "C:\Users\Admin\AppData\Roaming\Yniq\ivyba.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5040
    - - C:\Users\Admin\AppData\Roaming\Yniq\ivyba.exe
        
        "C:\Users\Admin\AppData\Roaming\Yniq\ivyba.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of WriteProcessMemory
        
        PID:5056
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp_921dcf2d.bat"
      4⤵
      PID:324
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4856
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3708
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3648

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3836

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3980

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4048

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:940

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3952

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:2436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff8390dceb8,0x7ff8390dcec4,0x7ff8390dced0
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2264,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1948,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:3
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2400,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4296,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=1328 /prefetch:8
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4800

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1912

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
- Modifies registry class
PID:3920

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2160

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3276

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:868

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:60

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 364050b2b5030ae2215c0e1c3150f05c2ce754ba812d8e8fb027e7dd28a38835
MD5 37982fe42d06e1498f956025eda08b35
SHA1 2a251185663d2b4c3c89b4a278788f1f828ec523
SHA512 0b3236beb6593d08834e1699cbe9a1d5ca5aeb398c7146bf35bd68d9eeec46681c18660009332100e8ce3fe4ab560a510d4ebaa0d6c8cb33863bdabe014ee611
SSDEEP 768:OuhOl0ko5o3dgh1YMgG7z87B8S0fzocuE2ODBZ7jn+6f:OQ6H3OTz87B8v0cuEhD77r+6f
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp_921dcf2d.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp_921dcf2d.bat
Size 272B
SHA256 47a010f6f8a380ba25ae110c72973d102421686df0ce4b403444b5e276c7cd23
MD5 d3cddb94abd7eb7d2b84c72adbc403c2
SHA1 47134518eab7cd41bd9fdfdfe6caae508eda88d5
SHA512 687315da37ea8505843656e325e9b8af515bcf45e6e42c80b2def4bd6ea1b817b166fddef0c9cdc6f259456d1f88f7f9a69c4da7066b45303123abd7970fa9f7
MD5 SHA1 SHA512

Submit Download

ivyba.exe

Path C:\Users\Admin\AppData\Roaming\Yniq\ivyba.exe
Size 67KB
SHA256 6dd665ef6df9077262b41eb875451f998854e8d35e40cd095053f29ebc921d28
MD5 f82f0eedaa3221bfd5414f012037305f
SHA1 d0aeac5d319299efc06744af19cf2a705f107da2
SHA512 8727008280ca2419aeb15887f28d97a838dab0f518ac082970104f98e097ff3b83a3b0770ec4e9d7aea71834f9dc8fce9afc25891d9e6d7f050aa86f3767c592
SSDEEP 1536:6lM3UCxVlATYPI3M4BmLl8vajTPI2J+p06F1bRauX:l3UCxETcI3M4BmEajTPpJ+Vnl
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/424-69-0x0000025416450000-0x0000025416467000-memory.dmp

Download

memory/424-64-0x0000025416450000-0x0000025416467000-memory.dmp

Download

memory/940-57-0x000001D1A5BE0000-0x000001D1A5BF7000-memory.dmp

Download

memory/1044-11-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1044-0-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1044-3-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1044-2-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1912-60-0x0000020AFE1A0000-0x0000020AFE1B7000-memory.dmp

Download

memory/1912-67-0x0000020AFE1A0000-0x0000020AFE1B7000-memory.dmp

Download

memory/2436-66-0x000001E127D80000-0x000001E127D97000-memory.dmp

Download

memory/2436-59-0x000001E127D80000-0x000001E127D97000-memory.dmp

Download

memory/2520-50-0x0000028B2C590000-0x0000028B2C5A7000-memory.dmp

Download

memory/2520-28-0x0000028B2C590000-0x0000028B2C5A7000-memory.dmp

Download

memory/2560-30-0x00000280BB7B0000-0x00000280BB7C7000-memory.dmp

Download

memory/2560-52-0x00000280BB7B0000-0x00000280BB7C7000-memory.dmp

Download

memory/2648-31-0x000002B9691E0000-0x000002B9691F7000-memory.dmp

Download

memory/2648-51-0x000002B9691E0000-0x000002B9691F7000-memory.dmp

Download

memory/3524-41-0x0000000002580000-0x0000000002597000-memory.dmp

Download

memory/3524-38-0x0000000002580000-0x0000000002597000-memory.dmp

Download

memory/3524-33-0x0000000002580000-0x0000000002597000-memory.dmp

Download

memory/3524-42-0x0000000002580000-0x0000000002597000-memory.dmp

Download

memory/3524-39-0x0000000002580000-0x0000000002597000-memory.dmp

Download

memory/3524-40-0x0000000002580000-0x0000000002597000-memory.dmp

Download

memory/3648-45-0x00000255F12E0000-0x00000255F12F7000-memory.dmp

Download

memory/3648-53-0x00000255F12E0000-0x00000255F12F7000-memory.dmp

Download

memory/3708-71-0x0000025527E90000-0x0000025527EA7000-memory.dmp

Download

memory/3708-63-0x0000025527E90000-0x0000025527EA7000-memory.dmp

Download

memory/3836-46-0x0000019EA3870000-0x0000019EA3887000-memory.dmp

Download

memory/3836-54-0x0000019EA3870000-0x0000019EA3887000-memory.dmp

Download

memory/3920-61-0x000001D542F70000-0x000001D542F87000-memory.dmp

Download

memory/3920-72-0x000001D542F70000-0x000001D542F87000-memory.dmp

Download

memory/3952-58-0x000001D3DD130000-0x000001D3DD147000-memory.dmp

Download

memory/3952-65-0x000001D3DD130000-0x000001D3DD147000-memory.dmp

Download

memory/3980-47-0x00000283696F0000-0x0000028369707000-memory.dmp

Download

memory/3980-55-0x00000283696F0000-0x0000028369707000-memory.dmp

Download

memory/4048-48-0x0000025AE0050000-0x0000025AE0067000-memory.dmp

Download

memory/4048-56-0x0000025AE0050000-0x0000025AE0067000-memory.dmp

Download

memory/4856-62-0x000001DA55500000-0x000001DA55517000-memory.dmp

Download

memory/4856-68-0x000001DA55500000-0x000001DA55517000-memory.dmp

Download

memory/5040-26-0x0000000001000000-0x000000000110B000-memory.dmp

Download

memory/5040-25-0x0000000000ED0000-0x0000000000FFA000-memory.dmp

Download

memory/5040-29-0x00000000013B0000-0x00000000014B0000-memory.dmp

Download

memory/5040-34-0x0000000001270000-0x00000000012A1000-memory.dmp

Download

memory/5040-36-0x0000000002D00000-0x0000000002D34000-memory.dmp

Download

memory/5040-15-0x0000000000570000-0x000000000062E000-memory.dmp

Download

memory/5040-27-0x0000000001110000-0x00000000011AD000-memory.dmp

Download

memory/5040-37-0x0000000002D40000-0x0000000002D67000-memory.dmp

Download

memory/5040-24-0x0000000000E30000-0x0000000000ECB000-memory.dmp

Download

memory/5040-23-0x0000000000D90000-0x0000000000E2E000-memory.dmp

Download

memory/5040-22-0x0000000000D60000-0x0000000000D8B000-memory.dmp

Download

memory/5040-19-0x00000000009D0000-0x0000000000B71000-memory.dmp

Download

memory/5040-20-0x0000000000B80000-0x0000000000C2C000-memory.dmp

Download

memory/5040-21-0x0000000000D30000-0x0000000000D52000-memory.dmp

Download

memory/5040-17-0x0000000000170000-0x0000000000200000-memory.dmp

Download

memory/5040-16-0x0000000000630000-0x00000000008F9000-memory.dmp

Download

memory/5040-35-0x0000000001230000-0x0000000001248000-memory.dmp

Download

memory/5040-43-0x00000000030B0000-0x00000000030BC000-memory.dmp

Download

memory/5040-44-0x00000000030C0000-0x0000000003143000-memory.dmp

Download

memory/5040-32-0x00000000011B0000-0x00000000011E0000-memory.dmp

Download

memory/5056-18-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/5056-12-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/5056-75-0x0000000004B80000-0x0000000004B97000-memory.dmp

Download

memory/5056-165-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/5056-49-0x0000000000400000-0x0000000000417000-memory.dmp

Download