Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20/06/2024, 17:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe
-
Size
3.4MB
-
MD5
08545b44439c2869ba8c0b8a4d8f96fc
-
SHA1
7be7630dffd313b939562ab98fa4f9d3f06cb531
-
SHA256
d1c1067e4cfdf3c30d3f13eadce8a72bbf32317ee67939db7a4fcc04d2d2e0fb
-
SHA512
4c74c75ead9e6d72665120e8f18b52a6f32ee1b5342d66d4773e1a103d3e07f834f7fc5ba4c1c89d5c7189ee3ea7894b7825b291b36d8a228ea62e24218c56b1
-
SSDEEP
49152:jocuK7GiCs9h6oArnSIQ1zTRESF5+9u9jM5dgzhywgDjuHBjTkrHyUuTQf/I4GZS:nQlrS/Lmu9hN8juhjQS+I4GZKKQ
Score
7/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000e00000001214d-8.dat acprotect behavioral1/files/0x000800000001451c-42.dat acprotect -
Deletes itself 1 IoCs
pid Process 2576 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2460 Windows:msvchost.pif -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Wine 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe Key opened \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Wine Windows:msvchost.pif -
Loads dropped DLL 4 IoCs
pid Process 1276 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe 2736 regsvr32.exe 1276 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe 2460 Windows:msvchost.pif -
resource yara_rule behavioral1/files/0x000e00000001214d-8.dat upx behavioral1/memory/1276-21-0x0000000010000000-0x0000000010014000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows:msvchost.pif" Windows:msvchost.pif Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows:msvchost.pif" Windows:msvchost.pif -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\zlib.dll 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mswinsck.ocx 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\jpg.dll 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\win.com 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\zlib.dll Windows:msvchost.pif File opened for modification C:\Windows\SysWOW64\mswinsck.ocx Windows:msvchost.pif File opened for modification C:\Windows\SysWOW64\jpg.dll Windows:msvchost.pif -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID\ = "MSWinsock.Winsock.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version\ = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\ = "Microsoft WinSock Control, version 6.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\ = "Microsoft WinSock Control, version 6.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\ = "Winsock General Property Page Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS\ = "2" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID\ = "MSWinsock.Winsock" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer\ = "MSWinsock.Winsock.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32 regsvr32.exe -
NTFS ADS 3 IoCs
description ioc Process File opened for modification C:\Windows:msvchost.pif 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe File created C:\Windows:msvchost.pif 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe File opened for modification C:\Windows:msvchost.pif Windows:msvchost.pif -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1276 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe 1276 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe 1276 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe 1276 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe 1276 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe 1276 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1276 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe 2460 Windows:msvchost.pif 2460 Windows:msvchost.pif -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1276 wrote to memory of 2736 1276 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe 29 PID 1276 wrote to memory of 2736 1276 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe 29 PID 1276 wrote to memory of 2736 1276 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe 29 PID 1276 wrote to memory of 2736 1276 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe 29 PID 1276 wrote to memory of 2736 1276 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe 29 PID 1276 wrote to memory of 2736 1276 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe 29 PID 1276 wrote to memory of 2736 1276 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe 29 PID 1276 wrote to memory of 2576 1276 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe 30 PID 1276 wrote to memory of 2576 1276 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe 30 PID 1276 wrote to memory of 2576 1276 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe 30 PID 1276 wrote to memory of 2576 1276 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe 30 PID 1276 wrote to memory of 2460 1276 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe 32 PID 1276 wrote to memory of 2460 1276 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe 32 PID 1276 wrote to memory of 2460 1276 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe 32 PID 1276 wrote to memory of 2460 1276 08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\08545b44439c2869ba8c0b8a4d8f96fc_JaffaCakes118.exe"1⤵
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\system32\mswinsck.ocx"2⤵
- Loads dropped DLL
- Modifies registry class
PID:2736
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Roaming\1.bat2⤵
- Deletes itself
PID:2576
-
-
C:\Windows:msvchost.pifC:\Windows:msvchost.pif2⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2460
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
209B
MD538293a475156af94601b015219c64b14
SHA1f67b0c5ff298068111c0bea8b14cfaae31650d26
SHA256bcb718e0a2ff4d3f6d6d5e7e985f16e216ab39aac3d8a01560b01e7e60f21c9f
SHA5129cda1ab617d4d71c2bfb917f09acb8838657de196221489cce9eff15f69ff0512cdb2d4a70a8a2ca568f0add820622ce55481ed9947b4b87fea1b394b2832ce6
-
Filesize
3.4MB
MD508545b44439c2869ba8c0b8a4d8f96fc
SHA17be7630dffd313b939562ab98fa4f9d3f06cb531
SHA256d1c1067e4cfdf3c30d3f13eadce8a72bbf32317ee67939db7a4fcc04d2d2e0fb
SHA5124c74c75ead9e6d72665120e8f18b52a6f32ee1b5342d66d4773e1a103d3e07f834f7fc5ba4c1c89d5c7189ee3ea7894b7825b291b36d8a228ea62e24218c56b1
-
Filesize
51KB
MD54eda362e326609a0a80e2736b67607ab
SHA164aa572d16f7cd6e6bd2296f2c96ad1604c713d1
SHA256061e9f721af9a538dcfd96d13cb3deef1479b5785f566818c34c3faa585d650a
SHA512f23f6a5c362808aef98516dcf12e3eeefd8498c812c27f96820d7d086694641cb4eefc7970b4750a0e4a5a0be1f90ac8981fc2f028e7085d50bd44bd4880c51d
-
Filesize
105KB
MD59484c04258830aa3c2f2a70eb041414c
SHA1b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA256bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
SHA5129d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
-
Filesize
27KB
MD5200d52d81e9b4b05fa58ce5fbe511dba
SHA1c0d809ee93816d87388ed4e7fd6fca93d70294d2
SHA256d4fe89dc2e7775f4ef0dfc70ed6999b8f09635326e05e08a274d464d1814c617
SHA5127b1df70d76855d65cf246051e7b9f7119720a695d41ace1eb00e45e93e6de80d083b953269166bdee7137dbd9f3e5681e36bb036f151cea383c10d82957f39c5