643ac7842c7ff727f1b116821d9870bb724ab47108fedcb6d0b2b99bde75515d

Analysis

max time kernel
147s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06-07-2024 16:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28c9111963ed724562914a09bd88941a_JaffaCakes118.exe
Size

801KB
MD5

28c9111963ed724562914a09bd88941a
SHA1

2768b62003eadf910ac45c86fe57d25b7d5e7930
SHA256

643ac7842c7ff727f1b116821d9870bb724ab47108fedcb6d0b2b99bde75515d
SHA512

3cfc8046e9a59a14679f90462dd3added140c5ec1fe448e71f9c981e74d1964b9834ae9f0d0521a314904d82fe5c8dcaf72607340c12249efcd42f4d3ce37d5e
SSDEEP

24576:c8nxN/c0oQ5IGwacnTV7KRLrcSu47oC7Zu7Al7GC7Zu7fI76C7Zu7N57xC7Zu7Xp:bxNfotFnB7K9rZu47oC7Zu7Al7GC7Zu3

Score

10^/10

evasion

Malware Config

Signatures

Modifies security service 2 TTPs 22 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe

Executes dropped EXE 10 IoCs

pid	Process
2996	devsvc.exe
1844	devsvc.exe
2516	devsvc.exe
836	devsvc.exe
1512	devsvc.exe
2112	devsvc.exe
2568	devsvc.exe
2380	devsvc.exe
1948	devsvc.exe
2704	devsvc.exe

Identifies Wine through registry keys 2 TTPs 11 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	devsvc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	devsvc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	devsvc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	devsvc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	devsvc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	devsvc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	28c9111963ed724562914a09bd88941a_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	devsvc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	devsvc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	devsvc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	devsvc.exe

Loads dropped DLL 20 IoCs

pid	Process
2688	28c9111963ed724562914a09bd88941a_JaffaCakes118.exe
2688	28c9111963ed724562914a09bd88941a_JaffaCakes118.exe
2996	devsvc.exe
2996	devsvc.exe
1844	devsvc.exe
1844	devsvc.exe
2516	devsvc.exe
2516	devsvc.exe
836	devsvc.exe
836	devsvc.exe
1512	devsvc.exe
1512	devsvc.exe
2112	devsvc.exe
2112	devsvc.exe
2568	devsvc.exe
2568	devsvc.exe
2380	devsvc.exe
2380	devsvc.exe
1948	devsvc.exe
1948	devsvc.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\devsvc.exe	devsvc.exe
File opened for modification	C:\Windows\SysWOW64\devsvc.exe	devsvc.exe
File created	C:\Windows\SysWOW64\devsvc.exe	devsvc.exe
File created	C:\Windows\SysWOW64\devsvc.exe	28c9111963ed724562914a09bd88941a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\devsvc.exe	28c9111963ed724562914a09bd88941a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\devsvc.exe	devsvc.exe
File opened for modification	C:\Windows\SysWOW64\devsvc.exe	devsvc.exe
File opened for modification	C:\Windows\SysWOW64\devsvc.exe	devsvc.exe
File opened for modification	C:\Windows\SysWOW64\devsvc.exe	devsvc.exe
File opened for modification	C:\Windows\SysWOW64\devsvc.exe	devsvc.exe
File opened for modification	C:\Windows\SysWOW64\devsvc.exe	devsvc.exe
File created	C:\Windows\SysWOW64\devsvc.exe	devsvc.exe
File created	C:\Windows\SysWOW64\devsvc.exe	devsvc.exe
File created	C:\Windows\SysWOW64\devsvc.exe	devsvc.exe
File opened for modification	C:\Windows\SysWOW64\devsvc.exe	devsvc.exe
File created	C:\Windows\SysWOW64\devsvc.exe	devsvc.exe
File created	C:\Windows\SysWOW64\devsvc.exe	devsvc.exe
File created	C:\Windows\SysWOW64\devsvc.exe	devsvc.exe
File created	C:\Windows\SysWOW64\devsvc.exe	devsvc.exe
File created	C:\Windows\SysWOW64\devsvc.exe	devsvc.exe
File opened for modification	C:\Windows\SysWOW64\devsvc.exe	devsvc.exe
File opened for modification	C:\Windows\SysWOW64\devsvc.exe	devsvc.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs

pid	Process
2688	28c9111963ed724562914a09bd88941a_JaffaCakes118.exe
2996	devsvc.exe
1844	devsvc.exe
2516	devsvc.exe
836	devsvc.exe
1512	devsvc.exe
2112	devsvc.exe
2568	devsvc.exe
2380	devsvc.exe
1948	devsvc.exe
2704	devsvc.exe

Runs .reg file with regedit 11 IoCs

pid	Process
2300	regedit.exe
1584	regedit.exe
2704	regedit.exe
1900	regedit.exe
2364	regedit.exe
1000	regedit.exe
1908	regedit.exe
2212	regedit.exe
1000	regedit.exe
2844	regedit.exe
2276	regedit.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2688	28c9111963ed724562914a09bd88941a_JaffaCakes118.exe
2996	devsvc.exe
1844	devsvc.exe
2516	devsvc.exe
836	devsvc.exe
1512	devsvc.exe
2112	devsvc.exe
2568	devsvc.exe
2380	devsvc.exe
1948	devsvc.exe
2704	devsvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2544	2688	28c9111963ed724562914a09bd88941a_JaffaCakes118.exe	30
PID 2688 wrote to memory of 2544	2688	28c9111963ed724562914a09bd88941a_JaffaCakes118.exe	30
PID 2688 wrote to memory of 2544	2688	28c9111963ed724562914a09bd88941a_JaffaCakes118.exe	30
PID 2688 wrote to memory of 2544	2688	28c9111963ed724562914a09bd88941a_JaffaCakes118.exe	30
PID 2544 wrote to memory of 2300	2544	cmd.exe	31
PID 2544 wrote to memory of 2300	2544	cmd.exe	31
PID 2544 wrote to memory of 2300	2544	cmd.exe	31
PID 2544 wrote to memory of 2300	2544	cmd.exe	31
PID 2688 wrote to memory of 2996	2688	28c9111963ed724562914a09bd88941a_JaffaCakes118.exe	32
PID 2688 wrote to memory of 2996	2688	28c9111963ed724562914a09bd88941a_JaffaCakes118.exe	32
PID 2688 wrote to memory of 2996	2688	28c9111963ed724562914a09bd88941a_JaffaCakes118.exe	32
PID 2688 wrote to memory of 2996	2688	28c9111963ed724562914a09bd88941a_JaffaCakes118.exe	32
PID 2996 wrote to memory of 2168	2996	devsvc.exe	34
PID 2996 wrote to memory of 2168	2996	devsvc.exe	34
PID 2996 wrote to memory of 2168	2996	devsvc.exe	34
PID 2996 wrote to memory of 2168	2996	devsvc.exe	34
PID 2168 wrote to memory of 1908	2168	cmd.exe	35
PID 2168 wrote to memory of 1908	2168	cmd.exe	35
PID 2168 wrote to memory of 1908	2168	cmd.exe	35
PID 2168 wrote to memory of 1908	2168	cmd.exe	35
PID 2996 wrote to memory of 1844	2996	devsvc.exe	36
PID 2996 wrote to memory of 1844	2996	devsvc.exe	36
PID 2996 wrote to memory of 1844	2996	devsvc.exe	36
PID 2996 wrote to memory of 1844	2996	devsvc.exe	36
PID 1844 wrote to memory of 2876	1844	devsvc.exe	37
PID 1844 wrote to memory of 2876	1844	devsvc.exe	37
PID 1844 wrote to memory of 2876	1844	devsvc.exe	37
PID 1844 wrote to memory of 2876	1844	devsvc.exe	37
PID 2876 wrote to memory of 1584	2876	cmd.exe	38
PID 2876 wrote to memory of 1584	2876	cmd.exe	38
PID 2876 wrote to memory of 1584	2876	cmd.exe	38
PID 2876 wrote to memory of 1584	2876	cmd.exe	38
PID 1844 wrote to memory of 2516	1844	devsvc.exe	39
PID 1844 wrote to memory of 2516	1844	devsvc.exe	39
PID 1844 wrote to memory of 2516	1844	devsvc.exe	39
PID 1844 wrote to memory of 2516	1844	devsvc.exe	39
PID 2516 wrote to memory of 1872	2516	devsvc.exe	40
PID 2516 wrote to memory of 1872	2516	devsvc.exe	40
PID 2516 wrote to memory of 1872	2516	devsvc.exe	40
PID 2516 wrote to memory of 1872	2516	devsvc.exe	40
PID 1872 wrote to memory of 2212	1872	cmd.exe	41
PID 1872 wrote to memory of 2212	1872	cmd.exe	41
PID 1872 wrote to memory of 2212	1872	cmd.exe	41
PID 1872 wrote to memory of 2212	1872	cmd.exe	41
PID 2516 wrote to memory of 836	2516	devsvc.exe	42
PID 2516 wrote to memory of 836	2516	devsvc.exe	42
PID 2516 wrote to memory of 836	2516	devsvc.exe	42
PID 2516 wrote to memory of 836	2516	devsvc.exe	42
PID 836 wrote to memory of 2052	836	devsvc.exe	43
PID 836 wrote to memory of 2052	836	devsvc.exe	43
PID 836 wrote to memory of 2052	836	devsvc.exe	43
PID 836 wrote to memory of 2052	836	devsvc.exe	43
PID 2052 wrote to memory of 1000	2052	cmd.exe	44
PID 2052 wrote to memory of 1000	2052	cmd.exe	44
PID 2052 wrote to memory of 1000	2052	cmd.exe	44
PID 2052 wrote to memory of 1000	2052	cmd.exe	44
PID 836 wrote to memory of 1512	836	devsvc.exe	45
PID 836 wrote to memory of 1512	836	devsvc.exe	45
PID 836 wrote to memory of 1512	836	devsvc.exe	45
PID 836 wrote to memory of 1512	836	devsvc.exe	45
PID 1512 wrote to memory of 108	1512	devsvc.exe	46
PID 1512 wrote to memory of 108	1512	devsvc.exe	46
PID 1512 wrote to memory of 108	1512	devsvc.exe	46
PID 1512 wrote to memory of 108	1512	devsvc.exe	46

C:\Users\Admin\AppData\Local\Temp\28c9111963ed724562914a09bd88941a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\28c9111963ed724562914a09bd88941a_JaffaCakes118.exe"
1⤵
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\a.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\SysWOW64\regedit.exe
    REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
    3⤵
    - Modifies security service
    - Runs .reg file with regedit
    PID:2300
- C:\Windows\SysWOW64\devsvc.exe
  C:\Windows\system32\devsvc.exe 660 "C:\Users\Admin\AppData\Local\Temp\28c9111963ed724562914a09bd88941a_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c c:\a.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Windows\SysWOW64\regedit.exe
      REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
      4⤵
      Modifies security service
      Runs .reg file with regedit
      PID:1908
- - C:\Windows\SysWOW64\devsvc.exe
    C:\Windows\system32\devsvc.exe 748 "C:\Windows\SysWOW64\devsvc.exe"
    3⤵
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1844
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c c:\a.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2876
    - - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        5⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1584
  - - C:\Windows\SysWOW64\devsvc.exe
      C:\Windows\system32\devsvc.exe 744 "C:\Windows\SysWOW64\devsvc.exe"
      4⤵
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2516
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1872
      - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        6⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2212
    - - C:\Windows\SysWOW64\devsvc.exe
        
        C:\Windows\system32\devsvc.exe 756 "C:\Windows\SysWOW64\devsvc.exe"
        5⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:836
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        7⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1000
      - C:\Windows\SysWOW64\devsvc.exe
        
        C:\Windows\system32\devsvc.exe 752 "C:\Windows\SysWOW64\devsvc.exe"
        6⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1512
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        7⤵
        
        PID:108
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        8⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2704
        
        C:\Windows\SysWOW64\devsvc.exe
        
        C:\Windows\system32\devsvc.exe 736 "C:\Windows\SysWOW64\devsvc.exe"
        7⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:2112
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        8⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        9⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1900
        
        C:\Windows\SysWOW64\devsvc.exe
        
        C:\Windows\system32\devsvc.exe 764 "C:\Windows\SysWOW64\devsvc.exe"
        8⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:2568
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        9⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        10⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2844
        
        C:\Windows\SysWOW64\devsvc.exe
        
        C:\Windows\system32\devsvc.exe 760 "C:\Windows\SysWOW64\devsvc.exe"
        9⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:2380
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        10⤵
        
        PID:2116
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        11⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2276
        
        C:\Windows\SysWOW64\devsvc.exe
        
        C:\Windows\system32\devsvc.exe 776 "C:\Windows\SysWOW64\devsvc.exe"
        10⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:1948
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        11⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        12⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2364
        
        C:\Windows\SysWOW64\devsvc.exe
        
        C:\Windows\system32\devsvc.exe 768 "C:\Windows\SysWOW64\devsvc.exe"
        11⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:2704
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        12⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        13⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
298B

MD5
4117e5a9c995bab9cd3bce3fc2b99a46

SHA1
80144ccbad81c2efb1df64e13d3d5f59ca4486da

SHA256
37b58c2d66ab2f896316ee0cdba30dcc9aac15a51995b8ba6c143c8ba34bf292

SHA512
bdb721bd3dea641a9b1f26b46311c05199de01c6b0d7ea2b973aa71a4f796b292a6964ddef32ba9dfc4a545768943d105f110c5d60716e0ff6f82914affb507c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
a920eceddece6cf7f3487fd8e919af34

SHA1
a6dee2d31d4cbd1b18f5d3bc971521411a699889

SHA256
ec2d3952154412db3202f5c95e4d1b02c40a7f71f4458898ddc36e827a7b32d6

SHA512
a4700af2ce477c7ce33f434cdddd4031e88c3926d05475f522a753063269fe8b6e50b649c3e939272240194951cb70ac05df533978c19839e381141535275ecc

Download Submit
C:\Windows\SysWOW64\devsvc.exe

Filesize
801KB

MD5
28c9111963ed724562914a09bd88941a

SHA1
2768b62003eadf910ac45c86fe57d25b7d5e7930

SHA256
643ac7842c7ff727f1b116821d9870bb724ab47108fedcb6d0b2b99bde75515d

SHA512
3cfc8046e9a59a14679f90462dd3added140c5ec1fe448e71f9c981e74d1964b9834ae9f0d0521a314904d82fe5c8dcaf72607340c12249efcd42f4d3ce37d5e

Download Submit
C:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
memory/836-514-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/836-630-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/836-634-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/836-511-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/1512-635-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/1512-751-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/1512-755-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/1844-383-0x0000000005180000-0x0000000005908000-memory.dmp

Filesize
7.5MB

Download
memory/1844-380-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/1844-264-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/1844-384-0x0000000005180000-0x0000000005908000-memory.dmp

Filesize
7.5MB

Download
memory/1844-388-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/1844-263-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/1948-1119-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/1948-1235-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/1948-1239-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/2112-756-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/2112-872-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/2112-876-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/2380-998-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/2380-1114-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/2380-1118-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/2516-387-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/2516-505-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/2516-513-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/2516-510-0x0000000005170000-0x00000000058F8000-memory.dmp

Filesize
7.5MB

Download
memory/2516-509-0x0000000005170000-0x00000000058F8000-memory.dmp

Filesize
7.5MB

Download
memory/2516-389-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/2568-993-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/2568-877-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/2568-997-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/2688-1-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/2688-9-0x0000000000401000-0x000000000041E000-memory.dmp

Filesize
116KB

Download
memory/2688-10-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/2688-122-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/2688-123-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/2688-132-0x00000000051B0000-0x0000000005938000-memory.dmp

Filesize
7.5MB

Download
memory/2688-131-0x00000000051B0000-0x0000000005938000-memory.dmp

Filesize
7.5MB

Download
memory/2688-0-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/2704-1240-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/2996-258-0x0000000005260000-0x00000000059E8000-memory.dmp

Filesize
7.5MB

Download
memory/2996-133-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/2996-135-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/2996-218-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/2996-137-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/2996-253-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/2996-255-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/2996-261-0x0000000000400000-0x0000000000B877A9-memory.dmp

Filesize
7.5MB

Download
memory/2996-260-0x0000000005260000-0x00000000059E8000-memory.dmp

Filesize
7.5MB

Download