Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 16:39
Static task
static1
Behavioral task
behavioral1
Sample
685d347a2901d1d069ec61491e6b7db0_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
685d347a2901d1d069ec61491e6b7db0_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
685d347a2901d1d069ec61491e6b7db0_JaffaCakes118.exe
-
Size
58KB
-
MD5
685d347a2901d1d069ec61491e6b7db0
-
SHA1
b1dd243ffeb88d4dcc340906062507eb3a4815c3
-
SHA256
55b371e81cfc2a7f336c5d7ad36a08e9cd0fac36945a3e91d8bd4949f5d747bd
-
SHA512
5c05bc6a47d0e149f0b921a06af35effcbe4df6e5fc56d4bb7a2a312220f0b5f72b9a413769fbbd671fdc5a1b1510c6a9d07faba627fbcac5c05f2f1cea00412
-
SSDEEP
768:0dICxZk/89MpVT7woQJcW/bnqC03T/yEwSndA/zJmnPi3Jnv:0TYd5QJc/vaSybs4
Malware Config
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Executes dropped EXE 1 IoCs
pid Process 2352 wmimgmt.exe -
Loads dropped DLL 2 IoCs
pid Process 2708 685d347a2901d1d069ec61491e6b7db0_JaffaCakes118.exe 2708 685d347a2901d1d069ec61491e6b7db0_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: wmimgmt.exe -
pid Process 1000 ARP.EXE -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2624 tasklist.exe -
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
-
System Location Discovery: System Language Discovery 1 TTPs 53 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ARP.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NETSTAT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ipconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NETSTAT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmimgmt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systeminfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 685d347a2901d1d069ec61491e6b7db0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ROUTE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 280 PING.EXE 1324 findstr.exe -
System Network Connections Discovery 1 TTPs 1 IoCs
Attempt to get a listing of network connections.
pid Process 2028 NETSTAT.EXE -
Discovers systems in the same network 1 TTPs 4 IoCs
pid Process 2400 net.exe 2304 net.exe 2396 net.exe 576 net.exe -
Gathers network information 2 TTPs 3 IoCs
Uses commandline utility to view network configuration.
pid Process 2092 ipconfig.exe 2028 NETSTAT.EXE 1232 NETSTAT.EXE -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 1620 systeminfo.exe -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 280 PING.EXE -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeBackupPrivilege 2708 685d347a2901d1d069ec61491e6b7db0_JaffaCakes118.exe Token: SeBackupPrivilege 2708 685d347a2901d1d069ec61491e6b7db0_JaffaCakes118.exe Token: SeRestorePrivilege 2708 685d347a2901d1d069ec61491e6b7db0_JaffaCakes118.exe Token: SeBackupPrivilege 2708 685d347a2901d1d069ec61491e6b7db0_JaffaCakes118.exe Token: SeRestorePrivilege 2708 685d347a2901d1d069ec61491e6b7db0_JaffaCakes118.exe Token: SeBackupPrivilege 2708 685d347a2901d1d069ec61491e6b7db0_JaffaCakes118.exe Token: SeRestorePrivilege 2708 685d347a2901d1d069ec61491e6b7db0_JaffaCakes118.exe Token: SeBackupPrivilege 2708 685d347a2901d1d069ec61491e6b7db0_JaffaCakes118.exe Token: SeRestorePrivilege 2708 685d347a2901d1d069ec61491e6b7db0_JaffaCakes118.exe Token: SeBackupPrivilege 2708 685d347a2901d1d069ec61491e6b7db0_JaffaCakes118.exe Token: SeRestorePrivilege 2708 685d347a2901d1d069ec61491e6b7db0_JaffaCakes118.exe Token: SeDebugPrivilege 2624 tasklist.exe Token: SeDebugPrivilege 2028 NETSTAT.EXE Token: SeBackupPrivilege 2352 wmimgmt.exe Token: SeBackupPrivilege 2352 wmimgmt.exe Token: SeBackupPrivilege 2352 wmimgmt.exe Token: SeBackupPrivilege 2352 wmimgmt.exe Token: SeBackupPrivilege 2352 wmimgmt.exe Token: SeBackupPrivilege 2352 wmimgmt.exe Token: SeRestorePrivilege 2352 wmimgmt.exe Token: SeBackupPrivilege 2352 wmimgmt.exe Token: SeBackupPrivilege 2352 wmimgmt.exe Token: SeBackupPrivilege 2352 wmimgmt.exe Token: SeBackupPrivilege 2352 wmimgmt.exe Token: SeBackupPrivilege 2352 wmimgmt.exe Token: SeBackupPrivilege 2352 wmimgmt.exe Token: SeBackupPrivilege 2352 wmimgmt.exe Token: SeBackupPrivilege 2352 wmimgmt.exe Token: SeBackupPrivilege 2352 wmimgmt.exe Token: SeBackupPrivilege 2352 wmimgmt.exe Token: SeBackupPrivilege 2352 wmimgmt.exe Token: SeBackupPrivilege 2352 wmimgmt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2352 2708 685d347a2901d1d069ec61491e6b7db0_JaffaCakes118.exe 30 PID 2708 wrote to memory of 2352 2708 685d347a2901d1d069ec61491e6b7db0_JaffaCakes118.exe 30 PID 2708 wrote to memory of 2352 2708 685d347a2901d1d069ec61491e6b7db0_JaffaCakes118.exe 30 PID 2708 wrote to memory of 2352 2708 685d347a2901d1d069ec61491e6b7db0_JaffaCakes118.exe 30 PID 2352 wrote to memory of 2760 2352 wmimgmt.exe 31 PID 2352 wrote to memory of 2760 2352 wmimgmt.exe 31 PID 2352 wrote to memory of 2760 2352 wmimgmt.exe 31 PID 2352 wrote to memory of 2760 2352 wmimgmt.exe 31 PID 2760 wrote to memory of 2252 2760 cmd.exe 33 PID 2760 wrote to memory of 2252 2760 cmd.exe 33 PID 2760 wrote to memory of 2252 2760 cmd.exe 33 PID 2760 wrote to memory of 2252 2760 cmd.exe 33 PID 2760 wrote to memory of 2744 2760 cmd.exe 34 PID 2760 wrote to memory of 2744 2760 cmd.exe 34 PID 2760 wrote to memory of 2744 2760 cmd.exe 34 PID 2760 wrote to memory of 2744 2760 cmd.exe 34 PID 2760 wrote to memory of 2752 2760 cmd.exe 35 PID 2760 wrote to memory of 2752 2760 cmd.exe 35 PID 2760 wrote to memory of 2752 2760 cmd.exe 35 PID 2760 wrote to memory of 2752 2760 cmd.exe 35 PID 2752 wrote to memory of 2620 2752 net.exe 36 PID 2752 wrote to memory of 2620 2752 net.exe 36 PID 2752 wrote to memory of 2620 2752 net.exe 36 PID 2752 wrote to memory of 2620 2752 net.exe 36 PID 2760 wrote to memory of 2572 2760 cmd.exe 37 PID 2760 wrote to memory of 2572 2760 cmd.exe 37 PID 2760 wrote to memory of 2572 2760 cmd.exe 37 PID 2760 wrote to memory of 2572 2760 cmd.exe 37 PID 2572 wrote to memory of 2568 2572 net.exe 38 PID 2572 wrote to memory of 2568 2572 net.exe 38 PID 2572 wrote to memory of 2568 2572 net.exe 38 PID 2572 wrote to memory of 2568 2572 net.exe 38 PID 2760 wrote to memory of 2624 2760 cmd.exe 39 PID 2760 wrote to memory of 2624 2760 cmd.exe 39 PID 2760 wrote to memory of 2624 2760 cmd.exe 39 PID 2760 wrote to memory of 2624 2760 cmd.exe 39 PID 2760 wrote to memory of 1620 2760 cmd.exe 41 PID 2760 wrote to memory of 1620 2760 cmd.exe 41 PID 2760 wrote to memory of 1620 2760 cmd.exe 41 PID 2760 wrote to memory of 1620 2760 cmd.exe 41 PID 2760 wrote to memory of 2960 2760 cmd.exe 43 PID 2760 wrote to memory of 2960 2760 cmd.exe 43 PID 2760 wrote to memory of 2960 2760 cmd.exe 43 PID 2760 wrote to memory of 2960 2760 cmd.exe 43 PID 2760 wrote to memory of 1972 2760 cmd.exe 44 PID 2760 wrote to memory of 1972 2760 cmd.exe 44 PID 2760 wrote to memory of 1972 2760 cmd.exe 44 PID 2760 wrote to memory of 1972 2760 cmd.exe 44 PID 2760 wrote to memory of 1180 2760 cmd.exe 45 PID 2760 wrote to memory of 1180 2760 cmd.exe 45 PID 2760 wrote to memory of 1180 2760 cmd.exe 45 PID 2760 wrote to memory of 1180 2760 cmd.exe 45 PID 2760 wrote to memory of 2904 2760 cmd.exe 46 PID 2760 wrote to memory of 2904 2760 cmd.exe 46 PID 2760 wrote to memory of 2904 2760 cmd.exe 46 PID 2760 wrote to memory of 2904 2760 cmd.exe 46 PID 2760 wrote to memory of 2268 2760 cmd.exe 47 PID 2760 wrote to memory of 2268 2760 cmd.exe 47 PID 2760 wrote to memory of 2268 2760 cmd.exe 47 PID 2760 wrote to memory of 2268 2760 cmd.exe 47 PID 2760 wrote to memory of 2280 2760 cmd.exe 48 PID 2760 wrote to memory of 2280 2760 cmd.exe 48 PID 2760 wrote to memory of 2280 2760 cmd.exe 48 PID 2760 wrote to memory of 2280 2760 cmd.exe 48
Processes
-
C:\Users\Admin\AppData\Local\Temp\685d347a2901d1d069ec61491e6b7db0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\685d347a2901d1d069ec61491e6b7db0_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\ProgramData\Application Data\wmimgmt.exe"C:\ProgramData\Application Data\wmimgmt.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /v:on /c C:\Users\Admin\AppData\Local\Temp\ghi.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\findstr.exefindstr /s "YM.CGP_" "C:\Users\Admin"\..\*.txt4⤵
- System Location Discovery: System Language Discovery
PID:2252
-
-
C:\Windows\SysWOW64\chcp.comchcp4⤵
- System Location Discovery: System Language Discovery
PID:2744
-
-
C:\Windows\SysWOW64\net.exenet user4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user5⤵
- System Location Discovery: System Language Discovery
PID:2620
-
-
-
C:\Windows\SysWOW64\net.exenet localgroup administrators4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup administrators5⤵
- System Location Discovery: System Language Discovery
PID:2568
-
-
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
-
C:\Windows\SysWOW64\systeminfo.exesysteminfo4⤵
- System Location Discovery: System Language Discovery
- Gathers system information
PID:1620
-
-
C:\Windows\SysWOW64\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer"4⤵
- System Location Discovery: System Language Discovery
PID:2960
-
-
C:\Windows\SysWOW64\find.exefind "REG_"4⤵
- System Location Discovery: System Language Discovery
PID:1972
-
-
C:\Windows\SysWOW64\reg.exereg query HKEY_CURRENT_USER\Software\Microsoft\Office4⤵
- System Location Discovery: System Language Discovery
PID:1180
-
-
C:\Windows\SysWOW64\reg.exereg query HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Common\UserInfo4⤵
- System Location Discovery: System Language Discovery
PID:2904
-
-
C:\Windows\SysWOW64\reg.exereg query HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Common\UserInfo4⤵
- System Location Discovery: System Language Discovery
PID:2268
-
-
C:\Windows\SysWOW64\reg.exereg query HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Common\UserInfo4⤵
- System Location Discovery: System Language Discovery
PID:2280
-
-
C:\Windows\SysWOW64\reg.exereg query HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Common\UserInfo4⤵
- System Location Discovery: System Language Discovery
PID:1688
-
-
C:\Windows\SysWOW64\reg.exereg query HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\UserInfo4⤵
- System Location Discovery: System Language Discovery
PID:1036
-
-
C:\Windows\SysWOW64\reg.exereg query HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Common\UserInfo4⤵
- System Location Discovery: System Language Discovery
PID:396
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all4⤵
- System Location Discovery: System Language Discovery
- Gathers network information
PID:2092
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -ano4⤵
- System Location Discovery: System Language Discovery
- System Network Connections Discovery
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
-
C:\Windows\SysWOW64\ARP.EXEarp -a4⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:1000
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -r4⤵
- System Location Discovery: System Language Discovery
- Gathers network information
PID:1232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print5⤵
- System Location Discovery: System Language Discovery
PID:892 -
C:\Windows\SysWOW64\ROUTE.EXEC:\Windows\system32\route.exe print6⤵
- System Location Discovery: System Language Discovery
PID:2892
-
-
-
-
C:\Windows\SysWOW64\net.exenet start4⤵
- System Location Discovery: System Language Discovery
PID:2836 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start5⤵
- System Location Discovery: System Language Discovery
PID:2920
-
-
-
C:\Windows\SysWOW64\net.exenet use4⤵
- System Location Discovery: System Language Discovery
PID:2276
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo n"4⤵
- System Location Discovery: System Language Discovery
PID:2160
-
-
C:\Windows\SysWOW64\net.exenet share4⤵
- System Location Discovery: System Language Discovery
PID:448 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 share5⤵
- System Location Discovery: System Language Discovery
PID:1080
-
-
-
C:\Windows\SysWOW64\net.exenet view /domain4⤵
- System Location Discovery: System Language Discovery
- Discovers systems in the same network
PID:576
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "4⤵
- System Location Discovery: System Language Discovery
PID:1320
-
-
C:\Windows\SysWOW64\find.exefind /i /v "------"4⤵
- System Location Discovery: System Language Discovery
PID:1364
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "4⤵
- System Location Discovery: System Language Discovery
PID:2184
-
-
C:\Windows\SysWOW64\find.exefind /i /v "domain"4⤵
- System Location Discovery: System Language Discovery
PID:712
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "4⤵
- System Location Discovery: System Language Discovery
PID:536
-
-
C:\Windows\SysWOW64\find.exefind /i /v "¬A╛╣"4⤵
- System Location Discovery: System Language Discovery
PID:604
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "4⤵
- System Location Discovery: System Language Discovery
PID:1152
-
-
C:\Windows\SysWOW64\find.exefind /i /v "░⌡ªµª¿"4⤵
- System Location Discovery: System Language Discovery
PID:2368
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "4⤵
- System Location Discovery: System Language Discovery
PID:2372
-
-
C:\Windows\SysWOW64\find.exefind /i /v "├ⁿ┴ε"4⤵
- System Location Discovery: System Language Discovery
PID:2532
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "4⤵
- System Location Discovery: System Language Discovery
PID:2364
-
-
C:\Windows\SysWOW64\find.exefind /i /v "completed successfully"4⤵
- System Location Discovery: System Language Discovery
PID:2128
-
-
C:\Windows\SysWOW64\net.exenet view /domain:"WORKGROUP"4⤵
- System Location Discovery: System Language Discovery
- Discovers systems in the same network
PID:2400
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\workgrp.tmp "4⤵
- System Location Discovery: System Language Discovery
PID:2024
-
-
C:\Windows\SysWOW64\find.exefind "\\"4⤵
- System Location Discovery: System Language Discovery
PID:2240
-
-
C:\Windows\SysWOW64\net.exenet view \\WHMFPZKA4⤵
- System Location Discovery: System Language Discovery
- Discovers systems in the same network
PID:2304
-
-
C:\Windows\SysWOW64\net.exenet view \\WHMFPZKA4⤵
- System Location Discovery: System Language Discovery
- Discovers systems in the same network
PID:2396
-
-
C:\Windows\SysWOW64\find.exefind "Disk"4⤵
- System Location Discovery: System Language Discovery
PID:1804
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 WHMFPZKA4⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:280
-
-
C:\Windows\SysWOW64\findstr.exefindstr /i "Pinging Reply Request Unknown"4⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1324
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Service Discovery
1Network Share Discovery
1Peripheral Device Discovery
1Permission Groups Discovery
1Local Groups
1Process Discovery
1Query Registry
1Remote System Discovery
2System Information Discovery
3System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43B
MD5f5d66157ce5873de3959fa1160ecede8
SHA13b33b3feaa3cb6af7035470e251b5dd88e09f6ee
SHA256b5dddf3d6bd47f47bd33eba71fd13bedc5ed9ed75a29dcd1d2391b9fb0705109
SHA51226bc1eaf5c92afbc5cb6380638e3e0d34b760984b609dd7f99933ee43c0eb034e0e9d03c9a142c81f4a98d65c9a91d66430bd3456bdd2308d43f952da92cdd46
-
Filesize
7KB
MD59f0f9c2cd3516782078ae7d01722e820
SHA1362bdc807a91d6a71eb716f88d414c13de30f641
SHA2564ed136d16fcfdd4636ed965106ec016627ec82c8b086cb469b7458d673da4e06
SHA512e0b3f03a0e0291f7ebedee45ffb6e40782f81db165458e34702fab0e2e0e5694f140506aee4c5695125d564c49eee27b2b5cd15a3ceed5b2e38b8a870767c547
-
Filesize
15KB
MD567d1cccf9e24d0bd915166027165a76c
SHA1a44be78105072d8bc5a814f271199377e12d7287
SHA2566474a71cb4448b2f7cc49f6e5a939ade0e98a40eb1c03631a5b57c8f01c791d7
SHA51267d4f4f822acb8e68d6b92c46f1120360a217c5df91755f40be1f327c7981184fe3ae9193a5ffeab900c8893b64e878e78c71355e705274715e93ecdc45d4de5
-
Filesize
24.9MB
MD5671d99a2c38d101f9592ecbdda17451d
SHA1711e794a1df5f65b9d58ba57389cb151316f2721
SHA256c7e16a9b31756bb4a5346c7388106d69c9915190f72f29b19d3fbd5133edef50
SHA512d22ef9301445fbee98b36ec174f784e54afb4500d8d07a732fc6fedf9d54b6aee41af167ff2868acbf6234643065b2483527b80456f3c80f257edef331955798
-
Filesize
15B
MD54ff8e80638f36abd8fb131c19425317b
SHA1358665afaf5f88dfebcdb7c56e963693c520c136
SHA2566b8ceb900443f4924efd3187693038965ad7edb488879305489aa72d78f69626
SHA512d4e6e3d789bc76102c500b46a5aa799c5ebfc432a44117aa0b7c7512439d33a423630b963fb04cda1da17a7f6517b276a3e9298c17cbf795964090f4b9e5d8f1
-
Filesize
3KB
MD5b98e8fcde49a1caee295a6bd3d264e56
SHA171c82391a8617212ad48c8d79755e71be2e20be9
SHA256e369c7e2e7ac0280882693038b213be0309c910df62f35a5159a125ecd18fb9a
SHA512fb5fa414449e7dd4ce1fedcb92487f59ed18d7fbd3146eb59ec8f7256d68551adebb7d35e859fe7b6bce5a0b042b0de1e9ee56369a8686976dd121b44ff46742
-
Filesize
153B
MD5b256c8a481b065860c2812e742f50250
SHA151ddf02764fb12d88822450e8a27f9deac85fe54
SHA256b167a692a2ff54cc5625797ddc367ba8736797130b93961d68b9150aef2f0e12
SHA512f425ae70449d16bdb05fcc7913744fb0a81ab81278735d77ce316007b8298ad3c3991a29af67b336420f7dca94702271e59186174b5b78b5cdab1f8ce0163360
-
Filesize
64B
MD5e29f80bf6f6a756e0bc6d7f5189a9bb2
SHA1acdd1032b7dc189f8e68b390fe6fd964618acd72
SHA2568bfe9f81e5c82cbfe69203c993009c22f940f20727fa8cb43773958bf0eba7c7
SHA512f390fc82bdeb43721aa08f3666a4ed7d9ad4a5c1ff91be6967336417a5a5b7968b945773f68effcbe961072b801c3681455cf98b956cd802eba24190bd54268e
-
Filesize
72B
MD559f2768506355d8bc50979f6d64ded26
SHA1b2d315b3857bec8335c526a08d08d6a1b5f5c151
SHA2567f9f3cbab32b3a5022bed245092835cb12502fa2e79d85c8c45d478918ee6569
SHA512e9aa231d19cb5f93711cd3ffee4a6bd8764b21249ed7eb06ff34bcb457cd075384a0858ea35a99280bff16c01875a4ed79598a6503fcf5262da6f0849b5b1028
-
Filesize
234B
MD5491d6bf1ec097bcdb4251d771380c889
SHA19a8be90aa9ae62dae99aa869414af0b504b20677
SHA256e3ef343510b639577abcd0c8d1a8a9070330f1a61041f6c0f5f1638c5cb4b7c7
SHA512b68726466fa541b64361e8d98cc653aac7a9547250a33d8f4a59d03a0725fdaeb950907bfcdc8c21ace621427cbca8f56a9d307e9d272dedcb1f4775e1ca99bd
-
Filesize
58KB
MD5685d347a2901d1d069ec61491e6b7db0
SHA1b1dd243ffeb88d4dcc340906062507eb3a4815c3
SHA25655b371e81cfc2a7f336c5d7ad36a08e9cd0fac36945a3e91d8bd4949f5d747bd
SHA5125c05bc6a47d0e149f0b921a06af35effcbe4df6e5fc56d4bb7a2a312220f0b5f72b9a413769fbbd671fdc5a1b1510c6a9d07faba627fbcac5c05f2f1cea00412