Overview

overview

10

Static

static

3

4314d785ce...18.exe

windows7-x64

10

4314d785ce...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-07-2024 19:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4314d785cea1470e12518301d08c1d79_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    4314d785cea1470e12518301d08c1d79

  • SHA1

    0e618872304d49e9eb8687155600bd134af80118

  • SHA256

    f81ff37c86e302b80b85a566a5801a99958acc1fc4ddc08d08c04d3a34b1ca7a

  • SHA512

    ab13980789d22746ac5e4db93345c86d0e48ccffcfc167a32ec467fd0dfacb7ffe9c0d6695d0147e914c3d8c67e715f1eac2be1b22ccd5ee0f1fe3e63ae066ef

  • SSDEEP

    24576:5MqeaXUpR4wQV6icoEC3mfgjKcUemuZ+5:5MqhXUf4lkoEUagGcUerE5

Score
10/10
salitybackdoorevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 3 TTPs 3 IoCs
    evasion
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 6 IoCs
    evasiontrojan
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 37 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 11 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:792
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:800
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:388
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:3052
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:3112
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:3152
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3356
                  • C:\Users\Admin\AppData\Local\Temp\4314d785cea1470e12518301d08c1d79_JaffaCakes118.exe
                    "C:\Users\Admin\AppData\Local\Temp\4314d785cea1470e12518301d08c1d79_JaffaCakes118.exe"
                    2⤵
                    • Checks computer location settings
                    • Suspicious use of WriteProcessMemory
                    PID:628
                    • C:\Users\Admin\AppData\Local\Temp\~sfx0055108380\BaTurajA v7.0.exe
                      "C:\Users\Admin\AppData\Local\Temp\~sfx0055108380\BaTurajA v7.0.exe"
                      3⤵
                      • Modifies firewall policy service
                      • UAC bypass
                      • Windows security bypass
                      • Executes dropped EXE
                      • Windows security modification
                      • Checks whether UAC is enabled
                      • Enumerates connected drives
                      • Drops autorun.inf file
                      • Drops file in Program Files directory
                      • Drops file in Windows directory
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:4624
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://cheaterbaturaja.blogspot.com/
                        4⤵
                        • Enumerates system info in registry
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of WriteProcessMemory
                        PID:3144
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb99dc46f8,0x7ffb99dc4708,0x7ffb99dc4718
                          5⤵
                            PID:3024
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,266772498597103973,17445164024792563801,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
                            5⤵
                              PID:440
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,266772498597103973,17445164024792563801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
                              5⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4404
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,266772498597103973,17445164024792563801,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:8
                              5⤵
                                PID:2688
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,266772498597103973,17445164024792563801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
                                5⤵
                                  PID:408
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,266772498597103973,17445164024792563801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
                                  5⤵
                                    PID:2192
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,266772498597103973,17445164024792563801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
                                    5⤵
                                      PID:1256
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,266772498597103973,17445164024792563801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
                                      5⤵
                                        PID:3608
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,266772498597103973,17445164024792563801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
                                        5⤵
                                          PID:3464
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,266772498597103973,17445164024792563801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
                                          5⤵
                                            PID:4436
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,266772498597103973,17445164024792563801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5952 /prefetch:8
                                            5⤵
                                              PID:5000
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,266772498597103973,17445164024792563801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5952 /prefetch:8
                                              5⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4872
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,266772498597103973,17445164024792563801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2588 /prefetch:1
                                              5⤵
                                                PID:3868
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,266772498597103973,17445164024792563801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
                                                5⤵
                                                  PID:4676
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,266772498597103973,17445164024792563801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
                                                  5⤵
                                                    PID:924
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,266772498597103973,17445164024792563801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
                                                    5⤵
                                                      PID:5000
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,266772498597103973,17445164024792563801,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5060 /prefetch:2
                                                      5⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:3060
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://cheaterbaturaja.blogspot.com/
                                                    4⤵
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3964
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb99dc46f8,0x7ffb99dc4708,0x7ffb99dc4718
                                                      5⤵
                                                        PID:2372
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,11878185895188537226,3905858646982146807,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
                                                        5⤵
                                                          PID:1524
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,11878185895188537226,3905858646982146807,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
                                                          5⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:4076
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                  1⤵
                                                    PID:3540
                                                  • C:\Windows\system32\DllHost.exe
                                                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                    1⤵
                                                      PID:3720
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:3812
                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                        1⤵
                                                          PID:3880
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:3984
                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                            1⤵
                                                              PID:3140
                                                            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                                                              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                                                              1⤵
                                                                PID:1048
                                                              • C:\Windows\System32\RuntimeBroker.exe
                                                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                1⤵
                                                                  PID:2856
                                                                • C:\Windows\system32\backgroundTaskHost.exe
                                                                  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
                                                                  1⤵
                                                                    PID:4768
                                                                  • C:\Windows\system32\backgroundTaskHost.exe
                                                                    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                    1⤵
                                                                      PID:5056
                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                      1⤵
                                                                        PID:3576
                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                        1⤵
                                                                          PID:1032
                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                          1⤵
                                                                            PID:4164
                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                            1⤵
                                                                              PID:4672
                                                                            • C:\Windows\System32\RuntimeBroker.exe
                                                                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                              1⤵
                                                                                PID:3012
                                                                              • C:\Windows\system32\DllHost.exe
                                                                                C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                1⤵
                                                                                  PID:1132

                                                                                Network

                                                                                MITRE ATT&CK Enterprise v15

                                                                                Reconnaissance

                                                                                Resource Development

                                                                                Initial Access

                                                                                Replication Through Removable Media

                                                                                1
                                                                                T1091

                                                                                Execution

                                                                                Persistence

                                                                                Create or Modify System Process

                                                                                1
                                                                                T1543

                                                                                Windows Service

                                                                                1
                                                                                T1543.003

                                                                                Privilege Escalation

                                                                                Abuse Elevation Control Mechanism

                                                                                1
                                                                                T1548

                                                                                Bypass User Account Control

                                                                                1
                                                                                T1548.002

                                                                                Create or Modify System Process

                                                                                1
                                                                                T1543

                                                                                Windows Service

                                                                                1
                                                                                T1543.003

                                                                                Defense Evasion

                                                                                Abuse Elevation Control Mechanism

                                                                                1
                                                                                T1548

                                                                                Bypass User Account Control

                                                                                1
                                                                                T1548.002

                                                                                Impair Defenses

                                                                                4
                                                                                T1562

                                                                                Disable or Modify System Firewall

                                                                                1
                                                                                T1562.004

                                                                                Disable or Modify Tools

                                                                                3
                                                                                T1562.001

                                                                                Modify Registry

                                                                                5
                                                                                T1112

                                                                                Credential Access

                                                                                Discovery

                                                                                Peripheral Device Discovery

                                                                                1
                                                                                T1120

                                                                                Query Registry

                                                                                3
                                                                                T1012

                                                                                System Information Discovery

                                                                                5
                                                                                T1082

                                                                                Lateral Movement

                                                                                Replication Through Removable Media

                                                                                1
                                                                                T1091

                                                                                Collection

                                                                                Command and Control

                                                                                Exfiltration

                                                                                Impact

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                  Filesize

                                                                                  152B

                                                                                  MD5

                                                                                  3ee50fb26a9d3f096c47ff8696c24321

                                                                                  SHA1

                                                                                  a8c83e798d2a8b31fec0820560525e80dfa4fe66

                                                                                  SHA256

                                                                                  d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f

                                                                                  SHA512

                                                                                  479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                  Filesize

                                                                                  152B

                                                                                  MD5

                                                                                  eaaad45aced1889a90a8aa4c39f92659

                                                                                  SHA1

                                                                                  5c0130d9e8d1a64c97924090d9a5258b8a31b83c

                                                                                  SHA256

                                                                                  5e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b

                                                                                  SHA512

                                                                                  0db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                  Filesize

                                                                                  360B

                                                                                  MD5

                                                                                  7857fd010dd69b4f530e06cdb783352f

                                                                                  SHA1

                                                                                  71313de781263efb893e6f76fa8cfe3c35e04f1e

                                                                                  SHA256

                                                                                  2546b727918bef3004aeffccc2700db375b39e9534cc23c559122039c9c859a1

                                                                                  SHA512

                                                                                  f71536d668d196f617614a1fa917539f88fe5b5571bd66e381dbb9c65040152cc5c4de276ac68749b2e0f8e82112fac464c7ca0b94288a63741c465d1430c7cd

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                  Filesize

                                                                                  3KB

                                                                                  MD5

                                                                                  046d5f67e1750e2c5f7de4c80cddd329

                                                                                  SHA1

                                                                                  73a189fb15e7de2eeea2269b5b18858b2f7e2bf0

                                                                                  SHA256

                                                                                  33888ccc805552116c2dd2116d73301fb14e8bd286d5bc676b97fe9f4a2f0011

                                                                                  SHA512

                                                                                  d893d537feeef71da794d21faa1d3c89a26d2e3fce21928db2aa2b8b15e1c07e8433cd4b59b3e68fa9781e7bcdf304ac5b0c076955f5b1fbd4ed8b5d280dab30

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                  Filesize

                                                                                  6KB

                                                                                  MD5

                                                                                  ba2eebe0af6d659e09ba68636df62250

                                                                                  SHA1

                                                                                  83bbbcd4572778fe219698d8ebdd7c0f6f9b7d6c

                                                                                  SHA256

                                                                                  fa06259c53c5c30c1caee194e86c5572bb046c0af2bd52d0af8b4a7ee2e1c6b6

                                                                                  SHA512

                                                                                  0b074da13234977434204bbf592a1972a1469e6ba0c1d5a80fc012ae58f4d236deec2f5fad5ec63b21a3863001fa6c71badd1e6826abe756bee95704af2cb908

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                  Filesize

                                                                                  8KB

                                                                                  MD5

                                                                                  f1c3a4b19dfc16e0ba87ebc65af3f26c

                                                                                  SHA1

                                                                                  0b4801b1795c6bf4b5028a3670ff677bbe9b9479

                                                                                  SHA256

                                                                                  28a65fae1b4dd682c81671e2af3f7102184311b5a6fc7e0b30f50c6c0e23b809

                                                                                  SHA512

                                                                                  6fe8bfa1456f8e7c531de5e96d0c43cebcd461b8a402e1f47f730c33e2229e5065c0a39ba13e545ece47ced362631ba1f61ce18e08dab05e5b3761055e8c5381

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                  Filesize

                                                                                  16B

                                                                                  MD5

                                                                                  6752a1d65b201c13b62ea44016eb221f

                                                                                  SHA1

                                                                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                  SHA256

                                                                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                  SHA512

                                                                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                  Filesize

                                                                                  8KB

                                                                                  MD5

                                                                                  011264d51bc2cb14182a9defd6710799

                                                                                  SHA1

                                                                                  94a9f1633a5c28e1f9a684f84b827d2bdb96baf7

                                                                                  SHA256

                                                                                  2d978dfbee20042044b27e306cd641f5102b359c3a569939edead8caa2c1ec7c

                                                                                  SHA512

                                                                                  8343b982a48709da3babedade8ed67f69ff683bd86884cfbdcef467e330c9c6b76c08f00e8febe81fb4432c0dcec86b041006380868b1ffb1d5dba2738759cdd

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                  Filesize

                                                                                  11KB

                                                                                  MD5

                                                                                  33a3ae7b6b0a60e2b6b49837d2b3f322

                                                                                  SHA1

                                                                                  f0f680aba10d1fbd1d3194f1d32a4177d059d098

                                                                                  SHA256

                                                                                  863d934a703d62872c57ca56a520943a95da39a6d7611df16874c44832b46018

                                                                                  SHA512

                                                                                  7e95fb1c2b4f8da927d06ca6be65a702dfdf0dac571bb33cdef159b16a8e148c30d4cd96e48a454164fc8ab3de9255d63024ce803765f89bc8dbd8623ac724bf

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Temp\~sfx0055108380\BaTurajA v7.0.exe
                                                                                  Filesize

                                                                                  212KB

                                                                                  MD5

                                                                                  9fd2e7510214e121f0f06899ec4a5aa7

                                                                                  SHA1

                                                                                  1b89d29c21874ed4845491be310294565d9aff2e

                                                                                  SHA256

                                                                                  a4d2d7df4f2279e5d133712cc6b0c6de6baa81c451a2ea31facf7923c69cac70

                                                                                  SHA512

                                                                                  b151cc02ac09009a387072d66c84afece0220f636f795a405e52a7ce80a443e70a02eea55959eace66b1c267827789898d9f22e3e6c3522e00eb237e773de86d

                                                                                  Download Submit

                                                                                • C:\nucc.pif
                                                                                  Filesize

                                                                                  97KB

                                                                                  MD5

                                                                                  b5c817a52d9e47518b14fdd53eacafae

                                                                                  SHA1

                                                                                  fc10bd6e1c66bcadac74e427398d3d6b7c62364b

                                                                                  SHA256

                                                                                  3999bdd799cdfc773c9db9d6ab3a287b8d7fad644a0cb999630d3821f5ce0546

                                                                                  SHA512

                                                                                  a0f42a6020a71bf0285fd3a72101141f7b0eb116bdb3ab75d4fc58c09aa05d9ee59f8a88d12870d27579900d75ecc7d4734537d366dd3759d48820767b46b19b

                                                                                  Download Submit

                                                                                • memory/628-38-0x00000000032A0000-0x00000000032A1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/628-195-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                  Filesize

                                                                                  1.1MB

                                                                                  Download

                                                                                • memory/628-45-0x0000000003250000-0x0000000003252000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                  Download

                                                                                • memory/628-272-0x0000000003250000-0x0000000003252000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                  Download

                                                                                • memory/628-37-0x0000000003250000-0x0000000003252000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                  Download

                                                                                • memory/628-43-0x0000000003250000-0x0000000003252000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                  Download

                                                                                • memory/4624-88-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-22-0x0000000005850000-0x0000000005851000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4624-44-0x0000000005EF0000-0x0000000005EF2000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                  Download

                                                                                • memory/4624-28-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-48-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-29-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-42-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-20-0x0000000005820000-0x0000000005821000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4624-62-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-63-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-47-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-30-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-46-0x0000000005EF0000-0x0000000005EF2000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                  Download

                                                                                • memory/4624-41-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-36-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-94-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-104-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-168-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-171-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-176-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-27-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-177-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-21-0x0000000005830000-0x0000000005831000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4624-40-0x0000000006660000-0x0000000006661000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4624-196-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-197-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-23-0x0000000005860000-0x0000000005861000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4624-213-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-216-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-220-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-222-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-223-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-225-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-231-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-232-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-234-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-238-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-239-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-251-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-252-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-254-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-256-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-259-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-24-0x0000000005870000-0x0000000005871000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4624-273-0x0000000005EF0000-0x0000000005EF2000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                  Download

                                                                                • memory/4624-25-0x0000000004220000-0x0000000004221000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4624-19-0x0000000002AC0000-0x0000000003B7A000-memory.dmp

                                                                                  Filesize

                                                                                  16.7MB

                                                                                  Download

                                                                                • memory/4624-13-0x0000000000400000-0x0000000000436000-memory.dmp

                                                                                  Filesize

                                                                                  216KB

                                                                                  Download