1c8908033d27c8e951ccacc5f72edb872e0b1e2368aeaeda40dd6c0f3e2b7b9c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 02:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
Size

1.9MB
MD5

69eb7b85c4fe5838842a29069050de5a
SHA1

68aec318350caf1f71ba6590913a7a03f88592e7
SHA256

1c8908033d27c8e951ccacc5f72edb872e0b1e2368aeaeda40dd6c0f3e2b7b9c
SHA512

b9948a093e9700c7fe434e06c94fbd7c787b32f02b29679a4e626a969e203bf10bef718334c2a817f2cbf77da26b631b8fdb265a031f11790b766266d64e2479
SSDEEP

3072:2pZp75DchnX/eJuaBD1YOEe5hyZx3R6KZjwA/pWpliQCIntmjOkh5:2vp75c/ecaDIECkmWplcIntmjOkh

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\recovery = "C:\\Windows\\system32\\netlibmon.exe"	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\ = "Themes Setup"	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\StubPath = "rundll32.exe C:\\Windows\\system32\\themeuichk.dll,ThemesSetupInstallCheck"	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\IconsBinary = 43003a005c00570069006e0064006f00770073005c00730079007300740065006d00330032005c00730071006c007300790073006d0073002e006500780065000000	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\Version = "1,1,1,2"	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\ComponentID = "DOTNETFRAMEWORKS"	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\DontAsk = "2"	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\IsInstalled = "1"	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe

Executes dropped EXE 15 IoCs

pid	Process
2480	sqlidenv.exe
1396	smss.exe
2944	smss.exe
2448	smss.exe
1856	smss.exe
4480	smss.exe
1660	smss.exe
3108	smss.exe
1596	smss.exe
556	smss.exe
3404	smss.exe
3368	smss.exe
3940	smss.exe
1348	smss.exe
3388	smss.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\recovery = "C:\\Windows\\system32\\netlibmon.exe"	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ = "AcroIEHelperStub"	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\NoExplorer = "1"	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\pcsrvid.exe	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\pcsrvid.exe	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\srvudfras.exe	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sqlsysms.exe	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ctfcfgdns.exe	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\netlibmon.exe	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\winpptpsys.exe	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\winpptpsys.exe	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ctfcfgdns.exe	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\fsntwin.ocx	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fsntwin.ocx	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\srvudfras.exe	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\sqlsysms.exe	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\netlibmon.exe	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4144	2480	WerFault.exe	97

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlidenv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\VersionIndependentProgID	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\InprocServer32	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\InprocServer32\ = "C:\\Windows\\SysWow64\\fsntwin.ocx"	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\InprocServer32\ThreadingModel = "Apartment"	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ProgID\ = "AcroIEHelperShim.AcroIEHelperShimObj.1"	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\VersionIndependentProgID\ = "AcroIEHelperShim.AcroIEHelperShimObj"	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ = "Adobe PDF Link Helper"	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ProgID	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2232	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
2232	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
2480	sqlidenv.exe
2480	sqlidenv.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2232	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
Token: SeDebugPrivilege	2480	sqlidenv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2480	2232	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe	97
PID 2232 wrote to memory of 2480	2232	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe	97
PID 2232 wrote to memory of 2480	2232	69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe	97
PID 2480 wrote to memory of 4888	2480	sqlidenv.exe	99
PID 2480 wrote to memory of 4888	2480	sqlidenv.exe	99
PID 2480 wrote to memory of 4888	2480	sqlidenv.exe	99
PID 4888 wrote to memory of 1396	4888	cmd.exe	101
PID 4888 wrote to memory of 1396	4888	cmd.exe	101
PID 4888 wrote to memory of 1396	4888	cmd.exe	101
PID 4888 wrote to memory of 1268	4888	cmd.exe	102
PID 4888 wrote to memory of 1268	4888	cmd.exe	102
PID 4888 wrote to memory of 1268	4888	cmd.exe	102
PID 4888 wrote to memory of 2944	4888	cmd.exe	103
PID 4888 wrote to memory of 2944	4888	cmd.exe	103
PID 4888 wrote to memory of 2944	4888	cmd.exe	103
PID 4888 wrote to memory of 4520	4888	cmd.exe	111
PID 4888 wrote to memory of 4520	4888	cmd.exe	111
PID 4888 wrote to memory of 4520	4888	cmd.exe	111
PID 4888 wrote to memory of 2448	4888	cmd.exe	112
PID 4888 wrote to memory of 2448	4888	cmd.exe	112
PID 4888 wrote to memory of 2448	4888	cmd.exe	112
PID 4888 wrote to memory of 1532	4888	cmd.exe	117
PID 4888 wrote to memory of 1532	4888	cmd.exe	117
PID 4888 wrote to memory of 1532	4888	cmd.exe	117
PID 4888 wrote to memory of 1856	4888	cmd.exe	118
PID 4888 wrote to memory of 1856	4888	cmd.exe	118
PID 4888 wrote to memory of 1856	4888	cmd.exe	118
PID 4888 wrote to memory of 3448	4888	cmd.exe	119
PID 4888 wrote to memory of 3448	4888	cmd.exe	119
PID 4888 wrote to memory of 3448	4888	cmd.exe	119
PID 4888 wrote to memory of 4480	4888	cmd.exe	120
PID 4888 wrote to memory of 4480	4888	cmd.exe	120
PID 4888 wrote to memory of 4480	4888	cmd.exe	120
PID 4888 wrote to memory of 4988	4888	cmd.exe	121
PID 4888 wrote to memory of 4988	4888	cmd.exe	121
PID 4888 wrote to memory of 4988	4888	cmd.exe	121
PID 4888 wrote to memory of 1660	4888	cmd.exe	122
PID 4888 wrote to memory of 1660	4888	cmd.exe	122
PID 4888 wrote to memory of 1660	4888	cmd.exe	122
PID 4888 wrote to memory of 3584	4888	cmd.exe	123
PID 4888 wrote to memory of 3584	4888	cmd.exe	123
PID 4888 wrote to memory of 3584	4888	cmd.exe	123
PID 4888 wrote to memory of 3108	4888	cmd.exe	124
PID 4888 wrote to memory of 3108	4888	cmd.exe	124
PID 4888 wrote to memory of 3108	4888	cmd.exe	124
PID 4888 wrote to memory of 880	4888	cmd.exe	125
PID 4888 wrote to memory of 880	4888	cmd.exe	125
PID 4888 wrote to memory of 880	4888	cmd.exe	125
PID 4888 wrote to memory of 1596	4888	cmd.exe	126
PID 4888 wrote to memory of 1596	4888	cmd.exe	126
PID 4888 wrote to memory of 1596	4888	cmd.exe	126
PID 4888 wrote to memory of 3936	4888	cmd.exe	127
PID 4888 wrote to memory of 3936	4888	cmd.exe	127
PID 4888 wrote to memory of 3936	4888	cmd.exe	127
PID 4888 wrote to memory of 556	4888	cmd.exe	128
PID 4888 wrote to memory of 556	4888	cmd.exe	128
PID 4888 wrote to memory of 556	4888	cmd.exe	128
PID 4888 wrote to memory of 2416	4888	cmd.exe	129
PID 4888 wrote to memory of 2416	4888	cmd.exe	129
PID 4888 wrote to memory of 2416	4888	cmd.exe	129
PID 4888 wrote to memory of 3404	4888	cmd.exe	130
PID 4888 wrote to memory of 3404	4888	cmd.exe	130
PID 4888 wrote to memory of 3404	4888	cmd.exe	130
PID 4888 wrote to memory of 1360	4888	cmd.exe	131

Views/modifies file attributes 1 TTPs 13 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3448	attrib.exe
3936	attrib.exe
2416	attrib.exe
880	attrib.exe
3360	attrib.exe
1268	attrib.exe
4520	attrib.exe
1532	attrib.exe
3584	attrib.exe
1548	attrib.exe
1912	attrib.exe
4988	attrib.exe
1360	attrib.exe

C:\Users\Admin\AppData\Local\Temp\69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\69eb7b85c4fe5838842a29069050de5a_JaffaCakes118.exe"
1⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\sqlidenv.exe
  "C:\Users\Admin\AppData\Local\Temp\sqlidenv.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\13EC.tmp.cmd "C:\Users\Admin\AppData\Local\Temp\sqlidenv.exe""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1396
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\sqlidenv.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1268
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2944
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\sqlidenv.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2448
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\sqlidenv.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1856
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\sqlidenv.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4480
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\sqlidenv.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1660
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\sqlidenv.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3108
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\sqlidenv.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:880
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1596
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\sqlidenv.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:556
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\sqlidenv.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3404
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\sqlidenv.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1360
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3368
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\sqlidenv.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1548
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3940
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\sqlidenv.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1348
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\sqlidenv.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 604
    3⤵
    - Program crash
    PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2480 -ip 2480
1⤵
PID:1632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\13EC.tmp.cmd

Filesize
168B

MD5
e7efc2c945a798b4dab3fe50f1524592

SHA1
0bb937ccd89e40c91c0e58b376873ef909fe805b

SHA256
624acac79fdcfe30592f5321b4ab73d360f393dbcdbe8daa50fcce63c710f5dc

SHA512
e75840979404587aa15fd4d1e46707c33e32dca086ca72c7666045e14191e29857d06dc8ba737e69925c71b2e2d6a5ee3b63c36ecd2f32ae515f85a985d8f257

Download Submit
C:\Users\Admin\AppData\Local\Temp\advsec32.dll

Filesize
4KB

MD5
3adea70969f52d365c119b3d25619de9

SHA1
d303a6ddd63ce993a8432f4daab5132732748843

SHA256
c9f5a19c7b11fd866483adc93aa5bc4bd3515bd995ca79297b227e3e5ef1a665

SHA512
c4d836fcbdab4c859a6fc0f849d1e41e98c7e23fc0fe0fe0a09cb68e9a57d60b2ae9ad46762d7a5e05db28d6179bd431ef179ee1f9ff016db74cc3b1d74ed7f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\smss.exe

Filesize
18KB

MD5
b3624dd758ccecf93a1226cef252ca12

SHA1
fcf4dad8c4ad101504b1bf47cbbddbac36b558a7

SHA256
4aaa74f294c15aeb37ada8185d0dead58bd87276a01a814abc0c4b40545bf2ef

SHA512
c613d18511b00fa25fc7b1bdde10d96debb42a99b5aaab9e9826538d0e229085bb371f0197f6b1086c4f9c605f01e71287ffc5442f701a95d67c232a5f031838

Download Submit
C:\Users\Admin\AppData\Local\Temp\sqlidenv.exe

Filesize
88KB

MD5
2bd46a980dde8eaa13e3defffb87e1e0

SHA1
926046f0c727358d1a6fbdd6ff3e28bc67d5e2f6

SHA256
f6af08e31471c98adcc26f9916e26d41aa0c47ff94949d3174d55c320032be26

SHA512
45dcd587a63c6c01077d1afe27af8942b4944a11247dafe4df48150f808dd46df032d2dbf3fd9ace39d656671a7db52d8a5a9d14c2aa64ec5d6caee5a1d6d04b

Download Submit
C:\Windows\SysWOW64\sqlsysms.exe

Filesize
1.9MB

MD5
69eb7b85c4fe5838842a29069050de5a

SHA1
68aec318350caf1f71ba6590913a7a03f88592e7

SHA256
1c8908033d27c8e951ccacc5f72edb872e0b1e2368aeaeda40dd6c0f3e2b7b9c

SHA512
b9948a093e9700c7fe434e06c94fbd7c787b32f02b29679a4e626a969e203bf10bef718334c2a817f2cbf77da26b631b8fdb265a031f11790b766266d64e2479

Download Submit
memory/2232-23-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2232-35-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2232-0-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2480-36-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2480-33-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2480-46-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2480-52-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2480-60-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2480-66-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download