32d262678e6d4dfc8d1c7e526054cee75a36a874bd8bc9b9f6e657f68ec8f1ea

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 23:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe
Size

92KB
MD5

3f595b1921a904b90529846fa57a4190
SHA1

b17f21d4cc0d9c21418e5b25da3029425fd0126c
SHA256

32d262678e6d4dfc8d1c7e526054cee75a36a874bd8bc9b9f6e657f68ec8f1ea
SHA512

6fec913d6d8dee3c1fd01f11b5d399f43013e8582c82e3e6cc55e6069ad24f1b47b2e3e6d9e1ddc6b21a947aaa817f18af35adb6d3ad0a1159bf2df27d7cdb7b
SSDEEP

1536:VdyDm3xH/6TpJ7hrpmkhucjmzjHHqXojhbZLF96lotSoDTRnwvpw:/M8xHSPxg/jqXoN1WldcBUw

Score

7^/10

evasion

Malware Config

Signatures

Checks computer location settings 2 TTPs 20 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	qeijdsfhst.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	qeijdsfhst.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	qeijdsfhst.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	qeijdsfhst.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	qeijdsfhst.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	qeijdsfhst.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	qeijdsfhst.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	qeijdsfhst.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	qeijdsfhst.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	qeijdsfhst.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	qeijdsfhst.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	qeijdsfhst.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	qeijdsfhst.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	qeijdsfhst.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	qeijdsfhst.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	qeijdsfhst.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	qeijdsfhst.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	qeijdsfhst.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	qeijdsfhst.exe

Executes dropped EXE 39 IoCs

pid	Process
2224	qeijdsfhst.exe
2556	qeijdsfhst.exe
996	qeijdsfhst.exe
4252	qeijdsfhst.exe
2452	qeijdsfhst.exe
3452	qeijdsfhst.exe
2300	qeijdsfhst.exe
3120	qeijdsfhst.exe
1712	qeijdsfhst.exe
3880	qeijdsfhst.exe
3212	qeijdsfhst.exe
472	qeijdsfhst.exe
4472	qeijdsfhst.exe
4008	qeijdsfhst.exe
4400	qeijdsfhst.exe
4612	qeijdsfhst.exe
2964	qeijdsfhst.exe
2100	qeijdsfhst.exe
1044	qeijdsfhst.exe
3024	qeijdsfhst.exe
1264	qeijdsfhst.exe
4344	qeijdsfhst.exe
2708	qeijdsfhst.exe
2640	qeijdsfhst.exe
3088	qeijdsfhst.exe
1720	qeijdsfhst.exe
632	qeijdsfhst.exe
868	qeijdsfhst.exe
212	qeijdsfhst.exe
3528	qeijdsfhst.exe
4412	qeijdsfhst.exe
4504	qeijdsfhst.exe
400	qeijdsfhst.exe
4812	qeijdsfhst.exe
4628	qeijdsfhst.exe
4996	qeijdsfhst.exe
4636	qeijdsfhst.exe
2832	qeijdsfhst.exe
408	qeijdsfhst.exe

Identifies Wine through registry keys 2 TTPs 21 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	qeijdsfhst.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	qeijdsfhst.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	qeijdsfhst.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	qeijdsfhst.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	qeijdsfhst.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	qeijdsfhst.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	qeijdsfhst.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	qeijdsfhst.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	qeijdsfhst.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	qeijdsfhst.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	qeijdsfhst.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	qeijdsfhst.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	qeijdsfhst.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	qeijdsfhst.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	qeijdsfhst.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	qeijdsfhst.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	qeijdsfhst.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	qeijdsfhst.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	qeijdsfhst.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	qeijdsfhst.exe

Suspicious use of SetThreadContext 20 IoCs

description	pid	Process	procid_target
PID 4004 set thread context of 1892	4004	3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe	86
PID 2224 set thread context of 2556	2224	qeijdsfhst.exe	88
PID 996 set thread context of 4252	996	qeijdsfhst.exe	90
PID 2452 set thread context of 3452	2452	qeijdsfhst.exe	92
PID 2300 set thread context of 3120	2300	qeijdsfhst.exe	96
PID 1712 set thread context of 3880	1712	qeijdsfhst.exe	98
PID 3212 set thread context of 472	3212	qeijdsfhst.exe	102
PID 4472 set thread context of 4008	4472	qeijdsfhst.exe	104
PID 4400 set thread context of 4612	4400	qeijdsfhst.exe	106
PID 2964 set thread context of 2100	2964	qeijdsfhst.exe	108
PID 1044 set thread context of 3024	1044	qeijdsfhst.exe	110
PID 1264 set thread context of 4344	1264	qeijdsfhst.exe	112
PID 2708 set thread context of 2640	2708	qeijdsfhst.exe	114
PID 3088 set thread context of 1720	3088	qeijdsfhst.exe	116
PID 632 set thread context of 868	632	qeijdsfhst.exe	118
PID 212 set thread context of 3528	212	qeijdsfhst.exe	120
PID 4412 set thread context of 4504	4412	qeijdsfhst.exe	122
PID 400 set thread context of 4812	400	qeijdsfhst.exe	124
PID 4628 set thread context of 4996	4628	qeijdsfhst.exe	126
PID 4636 set thread context of 2832	4636	qeijdsfhst.exe	128

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\qeijdsfhst.exe	qeijdsfhst.exe
File created	\??\c:\windows\qeijdsfhst.exe	qeijdsfhst.exe
File opened for modification	\??\c:\windows\qeijdsfhst.exe	qeijdsfhst.exe
File created	\??\c:\windows\qeijdsfhst.exe	qeijdsfhst.exe
File created	\??\c:\windows\qeijdsfhst.exe	qeijdsfhst.exe
File opened for modification	\??\c:\windows\qeijdsfhst.exe	qeijdsfhst.exe
File opened for modification	\??\c:\windows\qeijdsfhst.exe	qeijdsfhst.exe
File created	\??\c:\windows\qeijdsfhst.exe	qeijdsfhst.exe
File opened for modification	\??\c:\windows\qeijdsfhst.exe	qeijdsfhst.exe
File opened for modification	\??\c:\windows\qeijdsfhst.exe	qeijdsfhst.exe
File created	\??\c:\windows\qeijdsfhst.exe	qeijdsfhst.exe
File opened for modification	\??\c:\windows\qeijdsfhst.exe	qeijdsfhst.exe
File created	\??\c:\windows\qeijdsfhst.exe	qeijdsfhst.exe
File created	\??\c:\windows\qeijdsfhst.exe	3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe
File opened for modification	\??\c:\windows\qeijdsfhst.exe	3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe
File created	\??\c:\windows\qeijdsfhst.exe	qeijdsfhst.exe
File created	\??\c:\windows\qeijdsfhst.exe	qeijdsfhst.exe
File opened for modification	\??\c:\windows\qeijdsfhst.exe	qeijdsfhst.exe
File created	\??\c:\windows\qeijdsfhst.exe	qeijdsfhst.exe
File created	\??\c:\windows\qeijdsfhst.exe	qeijdsfhst.exe
File opened for modification	\??\c:\windows\qeijdsfhst.exe	qeijdsfhst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4004	3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe
4004	3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe
2224	qeijdsfhst.exe
2224	qeijdsfhst.exe
996	qeijdsfhst.exe
996	qeijdsfhst.exe
2452	qeijdsfhst.exe
2452	qeijdsfhst.exe
2300	qeijdsfhst.exe
2300	qeijdsfhst.exe
1712	qeijdsfhst.exe
1712	qeijdsfhst.exe
3212	qeijdsfhst.exe
3212	qeijdsfhst.exe
4472	qeijdsfhst.exe
4472	qeijdsfhst.exe
4400	qeijdsfhst.exe
4400	qeijdsfhst.exe
2964	qeijdsfhst.exe
2964	qeijdsfhst.exe
1044	qeijdsfhst.exe
1044	qeijdsfhst.exe
1264	qeijdsfhst.exe
1264	qeijdsfhst.exe
2708	qeijdsfhst.exe
2708	qeijdsfhst.exe
3088	qeijdsfhst.exe
3088	qeijdsfhst.exe
632	qeijdsfhst.exe
632	qeijdsfhst.exe
212	qeijdsfhst.exe
212	qeijdsfhst.exe
4412	qeijdsfhst.exe
4412	qeijdsfhst.exe
400	qeijdsfhst.exe
400	qeijdsfhst.exe
4628	qeijdsfhst.exe
4628	qeijdsfhst.exe
4636	qeijdsfhst.exe
4636	qeijdsfhst.exe
408	qeijdsfhst.exe
408	qeijdsfhst.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 1892	4004	3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe	86
PID 4004 wrote to memory of 1892	4004	3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe	86
PID 4004 wrote to memory of 1892	4004	3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe	86
PID 4004 wrote to memory of 1892	4004	3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe	86
PID 4004 wrote to memory of 1892	4004	3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe	86
PID 4004 wrote to memory of 1892	4004	3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe	86
PID 4004 wrote to memory of 1892	4004	3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe	86
PID 4004 wrote to memory of 1892	4004	3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe	86
PID 4004 wrote to memory of 1892	4004	3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe	86
PID 4004 wrote to memory of 1892	4004	3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe	86
PID 4004 wrote to memory of 1892	4004	3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe	86
PID 4004 wrote to memory of 1892	4004	3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe	86
PID 4004 wrote to memory of 1892	4004	3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe	86
PID 4004 wrote to memory of 1892	4004	3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe	86
PID 1892 wrote to memory of 2224	1892	3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe	87
PID 1892 wrote to memory of 2224	1892	3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe	87
PID 1892 wrote to memory of 2224	1892	3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe	87
PID 2224 wrote to memory of 2556	2224	qeijdsfhst.exe	88
PID 2224 wrote to memory of 2556	2224	qeijdsfhst.exe	88
PID 2224 wrote to memory of 2556	2224	qeijdsfhst.exe	88
PID 2224 wrote to memory of 2556	2224	qeijdsfhst.exe	88
PID 2224 wrote to memory of 2556	2224	qeijdsfhst.exe	88
PID 2224 wrote to memory of 2556	2224	qeijdsfhst.exe	88
PID 2224 wrote to memory of 2556	2224	qeijdsfhst.exe	88
PID 2224 wrote to memory of 2556	2224	qeijdsfhst.exe	88
PID 2224 wrote to memory of 2556	2224	qeijdsfhst.exe	88
PID 2224 wrote to memory of 2556	2224	qeijdsfhst.exe	88
PID 2224 wrote to memory of 2556	2224	qeijdsfhst.exe	88
PID 2224 wrote to memory of 2556	2224	qeijdsfhst.exe	88
PID 2224 wrote to memory of 2556	2224	qeijdsfhst.exe	88
PID 2224 wrote to memory of 2556	2224	qeijdsfhst.exe	88
PID 2556 wrote to memory of 996	2556	qeijdsfhst.exe	89
PID 2556 wrote to memory of 996	2556	qeijdsfhst.exe	89
PID 2556 wrote to memory of 996	2556	qeijdsfhst.exe	89
PID 996 wrote to memory of 4252	996	qeijdsfhst.exe	90
PID 996 wrote to memory of 4252	996	qeijdsfhst.exe	90
PID 996 wrote to memory of 4252	996	qeijdsfhst.exe	90
PID 996 wrote to memory of 4252	996	qeijdsfhst.exe	90
PID 996 wrote to memory of 4252	996	qeijdsfhst.exe	90
PID 996 wrote to memory of 4252	996	qeijdsfhst.exe	90
PID 996 wrote to memory of 4252	996	qeijdsfhst.exe	90
PID 996 wrote to memory of 4252	996	qeijdsfhst.exe	90
PID 996 wrote to memory of 4252	996	qeijdsfhst.exe	90
PID 996 wrote to memory of 4252	996	qeijdsfhst.exe	90
PID 996 wrote to memory of 4252	996	qeijdsfhst.exe	90
PID 996 wrote to memory of 4252	996	qeijdsfhst.exe	90
PID 996 wrote to memory of 4252	996	qeijdsfhst.exe	90
PID 996 wrote to memory of 4252	996	qeijdsfhst.exe	90
PID 4252 wrote to memory of 2452	4252	qeijdsfhst.exe	91
PID 4252 wrote to memory of 2452	4252	qeijdsfhst.exe	91
PID 4252 wrote to memory of 2452	4252	qeijdsfhst.exe	91
PID 2452 wrote to memory of 3452	2452	qeijdsfhst.exe	92
PID 2452 wrote to memory of 3452	2452	qeijdsfhst.exe	92
PID 2452 wrote to memory of 3452	2452	qeijdsfhst.exe	92
PID 2452 wrote to memory of 3452	2452	qeijdsfhst.exe	92
PID 2452 wrote to memory of 3452	2452	qeijdsfhst.exe	92
PID 2452 wrote to memory of 3452	2452	qeijdsfhst.exe	92
PID 2452 wrote to memory of 3452	2452	qeijdsfhst.exe	92
PID 2452 wrote to memory of 3452	2452	qeijdsfhst.exe	92
PID 2452 wrote to memory of 3452	2452	qeijdsfhst.exe	92
PID 2452 wrote to memory of 3452	2452	qeijdsfhst.exe	92
PID 2452 wrote to memory of 3452	2452	qeijdsfhst.exe	92
PID 2452 wrote to memory of 3452	2452	qeijdsfhst.exe	92
PID 2452 wrote to memory of 3452	2452	qeijdsfhst.exe	92

C:\Users\Admin\AppData\Local\Temp\3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe"
1⤵
- Identifies Wine through registry keys
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Users\Admin\AppData\Local\Temp\3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\3f595b1921a904b90529846fa57a4190_JaffaCakes118.exe
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\windows\qeijdsfhst.exe
    "C:\windows\qeijdsfhst.exe"
    3⤵
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\windows\qeijdsfhst.exe
      C:\windows\qeijdsfhst.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:2556
    - - C:\Users\Admin\appdata\local\qeijdsfhst.exe
        
        "C:\Users\Admin\appdata\local\qeijdsfhst.exe"
        5⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:996
      - C:\Users\Admin\appdata\local\qeijdsfhst.exe
        
        C:\Users\Admin\appdata\local\qeijdsfhst.exe
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4252
        
        C:\windows\qeijdsfhst.exe
        
        "C:\windows\qeijdsfhst.exe"
        7⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2452
        
        C:\windows\qeijdsfhst.exe
        
        C:\windows\qeijdsfhst.exe
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3452
        
        C:\Users\Admin\appdata\local\qeijdsfhst.exe
        
        "C:\Users\Admin\appdata\local\qeijdsfhst.exe"
        9⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:2300
        
        C:\Users\Admin\appdata\local\qeijdsfhst.exe
        
        C:\Users\Admin\appdata\local\qeijdsfhst.exe
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3120
        
        C:\windows\qeijdsfhst.exe
        
        "C:\windows\qeijdsfhst.exe"
        11⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:1712
        
        C:\windows\qeijdsfhst.exe
        
        C:\windows\qeijdsfhst.exe
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3880
        
        C:\Users\Admin\appdata\local\qeijdsfhst.exe
        
        "C:\Users\Admin\appdata\local\qeijdsfhst.exe"
        13⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:3212
        
        C:\Users\Admin\appdata\local\qeijdsfhst.exe
        
        C:\Users\Admin\appdata\local\qeijdsfhst.exe
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:472
        
        C:\windows\qeijdsfhst.exe
        
        "C:\windows\qeijdsfhst.exe"
        15⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:4472
        
        C:\windows\qeijdsfhst.exe
        
        C:\windows\qeijdsfhst.exe
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4008
        
        C:\Users\Admin\appdata\local\qeijdsfhst.exe
        
        "C:\Users\Admin\appdata\local\qeijdsfhst.exe"
        17⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:4400
        
        C:\Users\Admin\appdata\local\qeijdsfhst.exe
        
        C:\Users\Admin\appdata\local\qeijdsfhst.exe
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4612
        
        C:\windows\qeijdsfhst.exe
        
        "C:\windows\qeijdsfhst.exe"
        19⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:2964
        
        C:\windows\qeijdsfhst.exe
        
        C:\windows\qeijdsfhst.exe
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2100
        
        C:\Users\Admin\appdata\local\qeijdsfhst.exe
        
        "C:\Users\Admin\appdata\local\qeijdsfhst.exe"
        21⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:1044
        
        C:\Users\Admin\appdata\local\qeijdsfhst.exe
        
        C:\Users\Admin\appdata\local\qeijdsfhst.exe
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3024
        
        C:\windows\qeijdsfhst.exe
        
        "C:\windows\qeijdsfhst.exe"
        23⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:1264
        
        C:\windows\qeijdsfhst.exe
        
        C:\windows\qeijdsfhst.exe
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4344
        
        C:\Users\Admin\appdata\local\qeijdsfhst.exe
        
        "C:\Users\Admin\appdata\local\qeijdsfhst.exe"
        25⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:2708
        
        C:\Users\Admin\appdata\local\qeijdsfhst.exe
        
        C:\Users\Admin\appdata\local\qeijdsfhst.exe
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2640
        
        C:\windows\qeijdsfhst.exe
        
        "C:\windows\qeijdsfhst.exe"
        27⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:3088
        
        C:\windows\qeijdsfhst.exe
        
        C:\windows\qeijdsfhst.exe
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1720
        
        C:\Users\Admin\appdata\local\qeijdsfhst.exe
        
        "C:\Users\Admin\appdata\local\qeijdsfhst.exe"
        29⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:632
        
        C:\Users\Admin\appdata\local\qeijdsfhst.exe
        
        C:\Users\Admin\appdata\local\qeijdsfhst.exe
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:868
        
        C:\windows\qeijdsfhst.exe
        
        "C:\windows\qeijdsfhst.exe"
        31⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:212
        
        C:\windows\qeijdsfhst.exe
        
        C:\windows\qeijdsfhst.exe
        32⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3528
        
        C:\Users\Admin\appdata\local\qeijdsfhst.exe
        
        "C:\Users\Admin\appdata\local\qeijdsfhst.exe"
        33⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:4412
        
        C:\Users\Admin\appdata\local\qeijdsfhst.exe
        
        C:\Users\Admin\appdata\local\qeijdsfhst.exe
        34⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4504
        
        C:\windows\qeijdsfhst.exe
        
        "C:\windows\qeijdsfhst.exe"
        35⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:400
        
        C:\windows\qeijdsfhst.exe
        
        C:\windows\qeijdsfhst.exe
        36⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4812
        
        C:\Users\Admin\appdata\local\qeijdsfhst.exe
        
        "C:\Users\Admin\appdata\local\qeijdsfhst.exe"
        37⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:4628
        
        C:\Users\Admin\appdata\local\qeijdsfhst.exe
        
        C:\Users\Admin\appdata\local\qeijdsfhst.exe
        38⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4996
        
        C:\windows\qeijdsfhst.exe
        
        "C:\windows\qeijdsfhst.exe"
        39⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:4636
        
        C:\windows\qeijdsfhst.exe
        
        C:\windows\qeijdsfhst.exe
        40⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2832
        
        C:\Users\Admin\appdata\local\qeijdsfhst.exe
        
        "C:\Users\Admin\appdata\local\qeijdsfhst.exe"
        41⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious behavior: EnumeratesProcesses
        
        PID:408
        
        C:\Users\Admin\appdata\local\qeijdsfhst.exe
        
        C:\Users\Admin\appdata\local\qeijdsfhst.exe
        42⤵
        
        PID:244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\qeijdsfhst.exe

Filesize
92KB

MD5
3f595b1921a904b90529846fa57a4190

SHA1
b17f21d4cc0d9c21418e5b25da3029425fd0126c

SHA256
32d262678e6d4dfc8d1c7e526054cee75a36a874bd8bc9b9f6e657f68ec8f1ea

SHA512
6fec913d6d8dee3c1fd01f11b5d399f43013e8582c82e3e6cc55e6069ad24f1b47b2e3e6d9e1ddc6b21a947aaa817f18af35adb6d3ad0a1159bf2df27d7cdb7b

Download Submit
memory/472-97-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/868-208-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1720-195-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1892-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1892-1-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1892-2-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1892-3-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1892-14-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2100-138-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2556-30-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2556-19-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2556-18-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2640-180-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3024-153-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3120-68-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3452-46-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3452-55-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3880-82-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4008-111-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4252-40-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4344-166-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4612-124-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download