Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 14:30
Static task
static1
Behavioral task
behavioral1
Sample
7473fdfeb623fc989f42dbb402828ac0_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
7473fdfeb623fc989f42dbb402828ac0_JaffaCakes118.exe
-
Size
912KB
-
MD5
7473fdfeb623fc989f42dbb402828ac0
-
SHA1
c49242af2edb687f7b027eeace6b77ea71ed6352
-
SHA256
98a2efa80d6dc8d5711dbd62bee42abdfb6eae318e8a14fb0dc98741c8b4cb26
-
SHA512
0c3bc38912a9ea67051fa30873d6804fc2dc9ab26d065ee36608a6dfdf1f8f1fe12f761eba9da3651f40ee489dd2020107043e2e1d9ebdd1ace23ddcc6a4d5ce
-
SSDEEP
12288:d09ZiUV4fv3HtHbPZLSkPK41m+fF+vKCQjvJ6SRWYmEVs5m7kVe6SBCF2KnjOaan:69Z5KX3Ro9+1O+soypRVG
Malware Config
Extracted
cybergate
v1.07.5
Cyber
tutodereaperdark.no-ip.biz:82
B0BIF63072RPG2
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Winlog
-
install_file
Winlogon.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
The software wil go in the little moment !
-
message_box_title
Windows
-
password
123456
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
vbc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run vbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Winlog\\Winlogon.exe" vbc.exe Key created \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run vbc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Winlog\\Winlogon.exe" vbc.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Processes:
explorer.exevbc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{78D1YYF4-74J5-5QCV-66JT-141BVVD7OSXU}\StubPath = "C:\\Windows\\system32\\Winlog\\Winlogon.exe" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{78D1YYF4-74J5-5QCV-66JT-141BVVD7OSXU} vbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{78D1YYF4-74J5-5QCV-66JT-141BVVD7OSXU}\StubPath = "C:\\Windows\\system32\\Winlog\\Winlogon.exe Restart" vbc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{78D1YYF4-74J5-5QCV-66JT-141BVVD7OSXU} explorer.exe -
Executes dropped EXE 29 IoCs
Processes:
Winlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exepid process 1864 Winlogon.exe 4412 Winlogon.exe 3132 Winlogon.exe 2564 Winlogon.exe 380 Winlogon.exe 1640 Winlogon.exe 3488 Winlogon.exe 2616 Winlogon.exe 4316 Winlogon.exe 1016 Winlogon.exe 2272 Winlogon.exe 2004 Winlogon.exe 2964 Winlogon.exe 2404 Winlogon.exe 392 Winlogon.exe 3128 Winlogon.exe 3164 Winlogon.exe 1020 Winlogon.exe 5056 Winlogon.exe 2236 Winlogon.exe 616 Winlogon.exe 1616 Winlogon.exe 2252 Winlogon.exe 364 Winlogon.exe 4988 Winlogon.exe 1072 Winlogon.exe 3480 Winlogon.exe 1568 Winlogon.exe 2764 Winlogon.exe -
Processes:
resource yara_rule behavioral2/memory/420-11-0x0000000010410000-0x0000000010475000-memory.dmp upx behavioral2/memory/420-15-0x0000000010480000-0x00000000104E5000-memory.dmp upx -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\Winlog\\Winlogon.exe" vbc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\Winlog\\Winlogon.exe" vbc.exe -
Drops file in System32 directory 2 IoCs
Processes:
vbc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe vbc.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
7473fdfeb623fc989f42dbb402828ac0_JaffaCakes118.exedescription pid process target process PID 2248 set thread context of 420 2248 7473fdfeb623fc989f42dbb402828ac0_JaffaCakes118.exe vbc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3864 2348 WerFault.exe vbc.exe -
System Location Discovery: System Language Discovery 1 TTPs 32 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Winlogon.exeWinlogon.exevbc.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeexplorer.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exe7473fdfeb623fc989f42dbb402828ac0_JaffaCakes118.exeWinlogon.exeWinlogon.exeWinlogon.exeWinlogon.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7473fdfeb623fc989f42dbb402828ac0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
vbc.exepid process 420 vbc.exe 420 vbc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
explorer.exedescription pid process Token: SeBackupPrivilege 2652 explorer.exe Token: SeRestorePrivilege 2652 explorer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
vbc.exepid process 420 vbc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7473fdfeb623fc989f42dbb402828ac0_JaffaCakes118.exevbc.exedescription pid process target process PID 2248 wrote to memory of 420 2248 7473fdfeb623fc989f42dbb402828ac0_JaffaCakes118.exe vbc.exe PID 2248 wrote to memory of 420 2248 7473fdfeb623fc989f42dbb402828ac0_JaffaCakes118.exe vbc.exe PID 2248 wrote to memory of 420 2248 7473fdfeb623fc989f42dbb402828ac0_JaffaCakes118.exe vbc.exe PID 2248 wrote to memory of 420 2248 7473fdfeb623fc989f42dbb402828ac0_JaffaCakes118.exe vbc.exe PID 2248 wrote to memory of 420 2248 7473fdfeb623fc989f42dbb402828ac0_JaffaCakes118.exe vbc.exe PID 2248 wrote to memory of 420 2248 7473fdfeb623fc989f42dbb402828ac0_JaffaCakes118.exe vbc.exe PID 2248 wrote to memory of 420 2248 7473fdfeb623fc989f42dbb402828ac0_JaffaCakes118.exe vbc.exe PID 2248 wrote to memory of 420 2248 7473fdfeb623fc989f42dbb402828ac0_JaffaCakes118.exe vbc.exe PID 2248 wrote to memory of 420 2248 7473fdfeb623fc989f42dbb402828ac0_JaffaCakes118.exe vbc.exe PID 2248 wrote to memory of 420 2248 7473fdfeb623fc989f42dbb402828ac0_JaffaCakes118.exe vbc.exe PID 2248 wrote to memory of 420 2248 7473fdfeb623fc989f42dbb402828ac0_JaffaCakes118.exe vbc.exe PID 2248 wrote to memory of 420 2248 7473fdfeb623fc989f42dbb402828ac0_JaffaCakes118.exe vbc.exe PID 2248 wrote to memory of 420 2248 7473fdfeb623fc989f42dbb402828ac0_JaffaCakes118.exe vbc.exe PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE PID 420 wrote to memory of 3344 420 vbc.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\7473fdfeb623fc989f42dbb402828ac0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7473fdfeb623fc989f42dbb402828ac0_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe3⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 765⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2348 -ip 23481⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Admin2.txtFilesize
224KB
MD577a08af7dae46498834f6490a8af7585
SHA131ea29f5bbfbaa7b64d3d09a5383a0ad82241613
SHA256adcca8a3ed9d625d3c78567b776add73381e6b3253617117b626f46ca728fd3e
SHA5126b58e12c68fcaa66ebf6441f5d981af10506ba165efc9e261de8ea508cb8033c8c71a76e771469f5f580d689e2243dd19663d1968568e9d1891138a149195ed6
-
C:\Windows\SysWOW64\Winlog\Winlogon.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
memory/420-11-0x0000000010410000-0x0000000010475000-memory.dmpFilesize
404KB
-
memory/420-15-0x0000000010480000-0x00000000104E5000-memory.dmpFilesize
404KB
-
memory/420-4-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/420-5-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/420-7-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/420-95-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/420-3-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2248-0-0x0000000074AE2000-0x0000000074AE3000-memory.dmpFilesize
4KB
-
memory/2248-2-0x0000000074AE0000-0x0000000075091000-memory.dmpFilesize
5.7MB
-
memory/2248-1-0x0000000074AE0000-0x0000000075091000-memory.dmpFilesize
5.7MB
-
memory/2248-8-0x0000000074AE0000-0x0000000075091000-memory.dmpFilesize
5.7MB
-
memory/2652-17-0x0000000000C90000-0x0000000000C91000-memory.dmpFilesize
4KB
-
memory/2652-16-0x00000000009D0000-0x00000000009D1000-memory.dmpFilesize
4KB
-
memory/2652-40-0x00000000001D0000-0x0000000000603000-memory.dmpFilesize
4.2MB