Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11-08-2024 00:47
Behavioral task
behavioral1
Sample
8857b84e74bd78ad49f04f6f8d0ce65a_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
8857b84e74bd78ad49f04f6f8d0ce65a_JaffaCakes118.exe
-
Size
1.6MB
-
MD5
8857b84e74bd78ad49f04f6f8d0ce65a
-
SHA1
b9516b7c3e012535e0d75d01bf66cd661fbaeda0
-
SHA256
3f48a0ac6fd7487e22566c17ca1eda2bc9bede54adb53cc12bcd6a6afd23cc71
-
SHA512
4818fb05aa0f43ae4ebd1fe39331a4eaacd9213ba5a8921407a221eceec7b5f2ce9fd5299a24837d0e84e4adb4b1a328190631678b32da19ab6695308ab2ae61
-
SSDEEP
49152:zPOhSRsMd24IAMVS5fBizT8JIJwzm1P/zqawHC44sv:7Oad24IBVpoqum1P/zqE44sv
Malware Config
Extracted
darkcomet
Guest16
black-ghost.no-ip.info:1604
192.168.1.2:1604
DC_MUTEX-3M3BF1V
-
gencode
fXTP1ELrNGMR
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
Cheat Counter Strike.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts Cheat Counter Strike.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
Processes:
A new game and fun.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SavService.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\op_mon.exe A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\acs.exe A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgfws8.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpfsrv.exe A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastUI.exe A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnsx.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcagent.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcproxy.exe A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcNASvc.exe A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SavService.exe A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32gui.exe A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgam.exe A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msksrver.exe A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sched.exe A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfp.exe A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2service.exe A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgwdsvc.exe A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnsx.exe A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TFTray.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardxkickoff.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\afwServ.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TFService.exe A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcNASvc.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msksrver.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdagent.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ALsvc.exe A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\op_mon.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TFTray.exe A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcsysmon.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardxservice.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgwdsvc.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TFService.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcproxy.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32gui.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgtray.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ALMon.exe A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regedit.exe A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastUI.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ALsvc.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regedit.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgfws8.exe A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgtray.exe A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avmailc.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwebgrd.exe A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwebgrd.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardxkickoff.exe A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\acs.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sched.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfp.exe\Debugger = "C:\\Windows\\MugeWara.exe" A new game and fun.exe -
Executes dropped EXE 3 IoCs
Processes:
Cheat Counter Strike.exesara_sexy.exeA new game and fun.exepid process 1340 Cheat Counter Strike.exe 1856 sara_sexy.exe 2852 A new game and fun.exe -
Processes:
resource yara_rule behavioral1/memory/2512-0-0x0000000000400000-0x0000000000516000-memory.dmp upx C:\Windows\sara_sexy.exe upx behavioral1/memory/2512-26-0x0000000003360000-0x0000000003418000-memory.dmp upx behavioral1/memory/2512-28-0x0000000000400000-0x0000000000516000-memory.dmp upx C:\Windows\A new game and fun.exe upx behavioral1/memory/2852-49-0x0000000000400000-0x0000000000519000-memory.dmp upx behavioral1/memory/1856-48-0x0000000000400000-0x00000000004B8000-memory.dmp upx behavioral1/memory/2852-53-0x0000000000400000-0x0000000000519000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
A new game and fun.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\MugeWara = "C:\\Windows\\MugeWara.exe" A new game and fun.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/2512-28-0x0000000000400000-0x0000000000516000-memory.dmp autoit_exe behavioral1/memory/1856-48-0x0000000000400000-0x00000000004B8000-memory.dmp autoit_exe behavioral1/memory/2852-53-0x0000000000400000-0x0000000000519000-memory.dmp autoit_exe -
Drops file in Windows directory 10 IoCs
Processes:
A new game and fun.exeDllHost.exe8857b84e74bd78ad49f04f6f8d0ce65a_JaffaCakes118.exesara_sexy.exedescription ioc process File created C:\Windows\MugeWara.exe A new game and fun.exe File opened for modification C:\Windows\9.ico DllHost.exe File opened for modification C:\Windows\sara_sexy.exe 8857b84e74bd78ad49f04f6f8d0ce65a_JaffaCakes118.exe File opened for modification C:\Windows\A new game and fun.exe sara_sexy.exe File created C:\Windows\sara_sexy.exe 8857b84e74bd78ad49f04f6f8d0ce65a_JaffaCakes118.exe File created C:\Windows\9.ico sara_sexy.exe File opened for modification C:\Windows\9.ico sara_sexy.exe File created C:\Windows\A new game and fun.exe sara_sexy.exe File created C:\Windows\Cheat Counter Strike.exe 8857b84e74bd78ad49f04f6f8d0ce65a_JaffaCakes118.exe File opened for modification C:\Windows\Cheat Counter Strike.exe 8857b84e74bd78ad49f04f6f8d0ce65a_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Cheat Counter Strike.exesara_sexy.exeDllHost.exeA new game and fun.exe8857b84e74bd78ad49f04f6f8d0ce65a_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cheat Counter Strike.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sara_sexy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A new game and fun.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8857b84e74bd78ad49f04f6f8d0ce65a_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
Cheat Counter Strike.exedescription pid process Token: SeIncreaseQuotaPrivilege 1340 Cheat Counter Strike.exe Token: SeSecurityPrivilege 1340 Cheat Counter Strike.exe Token: SeTakeOwnershipPrivilege 1340 Cheat Counter Strike.exe Token: SeLoadDriverPrivilege 1340 Cheat Counter Strike.exe Token: SeSystemProfilePrivilege 1340 Cheat Counter Strike.exe Token: SeSystemtimePrivilege 1340 Cheat Counter Strike.exe Token: SeProfSingleProcessPrivilege 1340 Cheat Counter Strike.exe Token: SeIncBasePriorityPrivilege 1340 Cheat Counter Strike.exe Token: SeCreatePagefilePrivilege 1340 Cheat Counter Strike.exe Token: SeBackupPrivilege 1340 Cheat Counter Strike.exe Token: SeRestorePrivilege 1340 Cheat Counter Strike.exe Token: SeShutdownPrivilege 1340 Cheat Counter Strike.exe Token: SeDebugPrivilege 1340 Cheat Counter Strike.exe Token: SeSystemEnvironmentPrivilege 1340 Cheat Counter Strike.exe Token: SeChangeNotifyPrivilege 1340 Cheat Counter Strike.exe Token: SeRemoteShutdownPrivilege 1340 Cheat Counter Strike.exe Token: SeUndockPrivilege 1340 Cheat Counter Strike.exe Token: SeManageVolumePrivilege 1340 Cheat Counter Strike.exe Token: SeImpersonatePrivilege 1340 Cheat Counter Strike.exe Token: SeCreateGlobalPrivilege 1340 Cheat Counter Strike.exe Token: 33 1340 Cheat Counter Strike.exe Token: 34 1340 Cheat Counter Strike.exe Token: 35 1340 Cheat Counter Strike.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
A new game and fun.exeDllHost.exepid process 2852 A new game and fun.exe 2852 A new game and fun.exe 2852 A new game and fun.exe 2672 DllHost.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
A new game and fun.exepid process 2852 A new game and fun.exe 2852 A new game and fun.exe 2852 A new game and fun.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Cheat Counter Strike.exepid process 1340 Cheat Counter Strike.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
8857b84e74bd78ad49f04f6f8d0ce65a_JaffaCakes118.exesara_sexy.exedescription pid process target process PID 2512 wrote to memory of 1340 2512 8857b84e74bd78ad49f04f6f8d0ce65a_JaffaCakes118.exe Cheat Counter Strike.exe PID 2512 wrote to memory of 1340 2512 8857b84e74bd78ad49f04f6f8d0ce65a_JaffaCakes118.exe Cheat Counter Strike.exe PID 2512 wrote to memory of 1340 2512 8857b84e74bd78ad49f04f6f8d0ce65a_JaffaCakes118.exe Cheat Counter Strike.exe PID 2512 wrote to memory of 1340 2512 8857b84e74bd78ad49f04f6f8d0ce65a_JaffaCakes118.exe Cheat Counter Strike.exe PID 2512 wrote to memory of 1856 2512 8857b84e74bd78ad49f04f6f8d0ce65a_JaffaCakes118.exe sara_sexy.exe PID 2512 wrote to memory of 1856 2512 8857b84e74bd78ad49f04f6f8d0ce65a_JaffaCakes118.exe sara_sexy.exe PID 2512 wrote to memory of 1856 2512 8857b84e74bd78ad49f04f6f8d0ce65a_JaffaCakes118.exe sara_sexy.exe PID 2512 wrote to memory of 1856 2512 8857b84e74bd78ad49f04f6f8d0ce65a_JaffaCakes118.exe sara_sexy.exe PID 1856 wrote to memory of 2852 1856 sara_sexy.exe A new game and fun.exe PID 1856 wrote to memory of 2852 1856 sara_sexy.exe A new game and fun.exe PID 1856 wrote to memory of 2852 1856 sara_sexy.exe A new game and fun.exe PID 1856 wrote to memory of 2852 1856 sara_sexy.exe A new game and fun.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8857b84e74bd78ad49f04f6f8d0ce65a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8857b84e74bd78ad49f04f6f8d0ce65a_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\Cheat Counter Strike.exe"C:\Windows\Cheat Counter Strike.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1340 -
C:\Windows\sara_sexy.exeC:\Windows/sara_sexy.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\A new game and fun.exe"C:\Windows/A new game and fun.exe"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2852
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:2672
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD591c7c2ed9890658e1dbc71a8e616769d
SHA1ecdfa450d9e5bcbb13ad8d3052a75ec87f035180
SHA25666ae7fb55a45294ccfd55d91cacf3d9cfc9a73d8f5dc657de29c4e6570bb3262
SHA51291a59510622ab6f0f3f7a047546de6515301497540dc4af2d70b9b520811a62becc25212e35c7bcbd242985d3053244eca39d5b9273fc971501c8c3fc91deb0b
-
Filesize
472KB
MD5c454ff16ee361aa3437cbd3652bb4c89
SHA1aa18bc928ccca208f089d0527bc5fa05040e2cbe
SHA256b8e204574f58ece85b3546e30a20610eab2a3ab8d2f8102099bab2e6e19acbc7
SHA512e14b021ee5dfe7707f69ed6892482cd4e70414d531f8c725a6004073d9d05114ecebe6725cf5092e09a4a9b32faf50a47a83378aeed464bf42c2ca95292f2604
-
Filesize
663KB
MD5c0d1481589ba69abe6edde2c297ee5a2
SHA155c0da236cd39bcf9935d25a15c0c35ab257cfc6
SHA256cb1e144bca11f74425a9b52afaa443f07fca623e2a3834c142cf66c507386254
SHA51252b6ab4a235bbcc5477654e63066bf13b26e1209bf4c20a170179cf275fe42a7a5d79bb373f74151c465ad7b091d4c9ca2c86b67147ab2e8910867c1974b6349
-
Filesize
768KB
MD562cfa21a792fa76bcd8ce108afdf4517
SHA1f04702cd7c91085c840b95b2de4a6726cf13a838
SHA2566febf4f5937805e186cbddd3e257719546f40c7b4b08052640c9c6927b66c490
SHA5122a755a1ad3fe122b97c1c77b4f87ba1164ea752f3a2fda997566cdde9ed185c23668f937113013eeba8818fb015f145d951f793ab15b027ede6b72ff3769d1cc