latentbot | 9b0d3e63e3167214577b30e6f2e19034414f2f565c708f689de51390fe0c772e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15-08-2024 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c1c607c7085f6819346979715dda033_JaffaCakes118.exe
Size

981KB
MD5

9c1c607c7085f6819346979715dda033
SHA1

166414beefabaf1866cfdfea8a72b222dcc674dc
SHA256

9b0d3e63e3167214577b30e6f2e19034414f2f565c708f689de51390fe0c772e
SHA512

f1824dd69f9250664c71ae28d5b1045c6551abc5af61f9f44cc0f877de722acb7100d72486584df614979dc27222dba1e1dbeddd02161afc633fab68670176b9
SSDEEP

24576:T/////76QhEtOa5VxNmfFWBlI9G4hOkjIIkGhBLE:fREtO8xNmwB293rIvqB

Score

10^/10

latentbot discovery evasion persistence trojan

Malware Config

Extracted

Family

latentbot

1rockanimal.zapto.org

2rockanimal.zapto.org

3rockanimal.zapto.org

4rockanimal.zapto.org

5rockanimal.zapto.org

6rockanimal.zapto.org

7rockanimal.zapto.org

8rockanimal.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot

Modifies firewall policy service 3 TTPs 10 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

reg.exereg.exereg.exereg.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\b5Srg.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b5Srg.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\IGTN21UM2I.exe = "C:\\Users\\Admin\\AppData\\Roaming\\IGTN21UM2I.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

9c1c607c7085f6819346979715dda033_JaffaCakes118.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe

Executes dropped EXE 3 IoCs

Processes:

TUza5.exeb5Srg.exebUnQwWvf.exe

pid	Process
2116	TUza5.exe
964	b5Srg.exe
2428	bUnQwWvf.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

TUza5.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Desktop Windows Manager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dwm.exe"	TUza5.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

9c1c607c7085f6819346979715dda033_JaffaCakes118.exe

description	pid	Process	procid_target
PID 4436 set thread context of 964	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

reg.execsc.execvtres.execmd.execmd.exe9c1c607c7085f6819346979715dda033_JaffaCakes118.execvtres.exeb5Srg.execmd.execmd.exereg.exereg.execsc.exeTUza5.exebUnQwWvf.exereg.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5Srg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TUza5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bUnQwWvf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exe

pid	Process
5068	reg.exe
2456	reg.exe
3208	reg.exe
1568	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

bUnQwWvf.exe

pid	Process
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe
2428	bUnQwWvf.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes:

9c1c607c7085f6819346979715dda033_JaffaCakes118.exeb5Srg.exebUnQwWvf.exe

description	pid	Process
Token: SeDebugPrivilege	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe
Token: 1	964	b5Srg.exe
Token: SeCreateTokenPrivilege	964	b5Srg.exe
Token: SeAssignPrimaryTokenPrivilege	964	b5Srg.exe
Token: SeLockMemoryPrivilege	964	b5Srg.exe
Token: SeIncreaseQuotaPrivilege	964	b5Srg.exe
Token: SeMachineAccountPrivilege	964	b5Srg.exe
Token: SeTcbPrivilege	964	b5Srg.exe
Token: SeSecurityPrivilege	964	b5Srg.exe
Token: SeTakeOwnershipPrivilege	964	b5Srg.exe
Token: SeLoadDriverPrivilege	964	b5Srg.exe
Token: SeSystemProfilePrivilege	964	b5Srg.exe
Token: SeSystemtimePrivilege	964	b5Srg.exe
Token: SeProfSingleProcessPrivilege	964	b5Srg.exe
Token: SeIncBasePriorityPrivilege	964	b5Srg.exe
Token: SeCreatePagefilePrivilege	964	b5Srg.exe
Token: SeCreatePermanentPrivilege	964	b5Srg.exe
Token: SeBackupPrivilege	964	b5Srg.exe
Token: SeRestorePrivilege	964	b5Srg.exe
Token: SeShutdownPrivilege	964	b5Srg.exe
Token: SeDebugPrivilege	964	b5Srg.exe
Token: SeAuditPrivilege	964	b5Srg.exe
Token: SeSystemEnvironmentPrivilege	964	b5Srg.exe
Token: SeChangeNotifyPrivilege	964	b5Srg.exe
Token: SeRemoteShutdownPrivilege	964	b5Srg.exe
Token: SeUndockPrivilege	964	b5Srg.exe
Token: SeSyncAgentPrivilege	964	b5Srg.exe
Token: SeEnableDelegationPrivilege	964	b5Srg.exe
Token: SeManageVolumePrivilege	964	b5Srg.exe
Token: SeImpersonatePrivilege	964	b5Srg.exe
Token: SeCreateGlobalPrivilege	964	b5Srg.exe
Token: 31	964	b5Srg.exe
Token: 32	964	b5Srg.exe
Token: 33	964	b5Srg.exe
Token: 34	964	b5Srg.exe
Token: 35	964	b5Srg.exe
Token: SeDebugPrivilege	2428	bUnQwWvf.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

b5Srg.exe

pid	Process
964	b5Srg.exe
964	b5Srg.exe
964	b5Srg.exe
964	b5Srg.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

9c1c607c7085f6819346979715dda033_JaffaCakes118.execsc.execsc.exeb5Srg.execmd.execmd.execmd.execmd.exe

description	pid	Process	procid_target
PID 4436 wrote to memory of 3560	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	84
PID 4436 wrote to memory of 3560	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	84
PID 4436 wrote to memory of 3560	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	84
PID 3560 wrote to memory of 2232	3560	csc.exe	88
PID 3560 wrote to memory of 2232	3560	csc.exe	88
PID 3560 wrote to memory of 2232	3560	csc.exe	88
PID 4436 wrote to memory of 2116	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	90
PID 4436 wrote to memory of 2116	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	90
PID 4436 wrote to memory of 2116	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	90
PID 4436 wrote to memory of 3224	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	91
PID 4436 wrote to memory of 3224	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	91
PID 4436 wrote to memory of 3224	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	91
PID 4436 wrote to memory of 964	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	93
PID 4436 wrote to memory of 964	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	93
PID 4436 wrote to memory of 964	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	93
PID 4436 wrote to memory of 964	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	93
PID 4436 wrote to memory of 964	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	93
PID 4436 wrote to memory of 964	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	93
PID 4436 wrote to memory of 964	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	93
PID 4436 wrote to memory of 964	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	93
PID 3224 wrote to memory of 396	3224	csc.exe	94
PID 3224 wrote to memory of 396	3224	csc.exe	94
PID 3224 wrote to memory of 396	3224	csc.exe	94
PID 4436 wrote to memory of 2428	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	95
PID 4436 wrote to memory of 2428	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	95
PID 4436 wrote to memory of 2428	4436	9c1c607c7085f6819346979715dda033_JaffaCakes118.exe	95
PID 964 wrote to memory of 4628	964	b5Srg.exe	96
PID 964 wrote to memory of 4628	964	b5Srg.exe	96
PID 964 wrote to memory of 4628	964	b5Srg.exe	96
PID 964 wrote to memory of 2168	964	b5Srg.exe	97
PID 964 wrote to memory of 2168	964	b5Srg.exe	97
PID 964 wrote to memory of 2168	964	b5Srg.exe	97
PID 964 wrote to memory of 4732	964	b5Srg.exe	98
PID 964 wrote to memory of 4732	964	b5Srg.exe	98
PID 964 wrote to memory of 4732	964	b5Srg.exe	98
PID 964 wrote to memory of 412	964	b5Srg.exe	99
PID 964 wrote to memory of 412	964	b5Srg.exe	99
PID 964 wrote to memory of 412	964	b5Srg.exe	99
PID 4628 wrote to memory of 5068	4628	cmd.exe	104
PID 4628 wrote to memory of 5068	4628	cmd.exe	104
PID 4628 wrote to memory of 5068	4628	cmd.exe	104
PID 2168 wrote to memory of 2456	2168	cmd.exe	105
PID 2168 wrote to memory of 2456	2168	cmd.exe	105
PID 2168 wrote to memory of 2456	2168	cmd.exe	105
PID 412 wrote to memory of 3208	412	cmd.exe	106
PID 412 wrote to memory of 3208	412	cmd.exe	106
PID 412 wrote to memory of 3208	412	cmd.exe	106
PID 4732 wrote to memory of 1568	4732	cmd.exe	107
PID 4732 wrote to memory of 1568	4732	cmd.exe	107
PID 4732 wrote to memory of 1568	4732	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\9c1c607c7085f6819346979715dda033_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9c1c607c7085f6819346979715dda033_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wcdxdyq_.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3560
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5E4D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5E4C.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2232
- C:\Users\Admin\AppData\Local\Temp\TUza5.exe
  "C:\Users\Admin\AppData\Local\Temp\TUza5.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2116
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xegjfq0n.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES61E7.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC61E6.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:396
- C:\Users\Admin\AppData\Local\Temp\b5Srg.exe
  C:\Users\Admin\AppData\Local\Temp\b5Srg.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4628
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:5068
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\b5Srg.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\b5Srg.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\b5Srg.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\b5Srg.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2456
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1568
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\IGTN21UM2I.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IGTN21UM2I.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:412
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\IGTN21UM2I.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IGTN21UM2I.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3208
- C:\Users\Admin\AppData\Local\Temp\bUnQwWvf.exe
  "C:\Users\Admin\AppData\Local\Temp\bUnQwWvf.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES5E4D.tmp

Filesize
1KB

MD5
07e36d5ed52635fa5c7c81bd3e1766fa

SHA1
1a55adfc9b47b68c5da98ffca47f6f5bffef4643

SHA256
2e2331b093254846301a6aba7a2762b78dc287fd48a3e2bdfa9817eb02ba265c

SHA512
b91b5a47b345126e252bab5486d469ebb25fbaa018a2d1fe70759ed61e562174408c3143b5ef82e8bc00c5d1f7c6004d8d86033e84c9651467f47b4602b29743

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES61E7.tmp

Filesize
1KB

MD5
5a7b3fffaa2cb55ebcb133ba2f0da41c

SHA1
8278e1d13bb3d84b20016b64e82165901afba331

SHA256
4e524c1b261516a2ed7a114adf0a3d7eca187ea83744fa5bf3caa327ddeea3b1

SHA512
862b580c09d77a14b1b883021ff774aa2a6c602188bed76cf78efeff234c5edb0106754d6afda47d58bf1338f46c53492258d4ccadba3af815f9fffa624374d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\TUza5.exe

Filesize
4KB

MD5
af37074c1df8e232fbf969543e583a92

SHA1
7492b6f4f8614593cd1abe410c9dc3ddc4f10d4e

SHA256
be987422ba33c67a33e90b3f3b42a5996310a7981edbd327387a718267e6ae1c

SHA512
c3fa033bf8bbc497be26d03e5070599c099806fbe242def43ab7e9a3bc694468231c646cb463d0749972d2a024f33bd782e584f5d608d414c1e340a98372e979

Download Submit
C:\Users\Admin\AppData\Local\Temp\b5Srg.exe

Filesize
34KB

MD5
e118330b4629b12368d91b9df6488be0

SHA1
ce90218c7e3b90df2a3409ec253048bb6472c2fd

SHA256
3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9

SHA512
ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\bUnQwWvf.exe

Filesize
20KB

MD5
3e6330b83cd70ddc73fddd1b3c8ce926

SHA1
4a5ff9bf3c0cf67926d75b832c3825bbcc26bd40

SHA256
6e4d8c0695cc1ccada850b1c9732787185a849d793de36b86644a21c11b55f36

SHA512
2c5b13493b18329232efa081c2a2b40901210169d59f8e57e35cc7392d01ebeff959811c385b599d669b5cc63368654a92988f85e6aabcc2c234fc495777d9b7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC5E4C.tmp

Filesize
636B

MD5
729f44c1955f67140715900aafbe8403

SHA1
f97f52197cdff16634475f1272a6bd5893133206

SHA256
36b00dbac3ff22f0d514c99721c3320c95ecaf0e80f80171b40eb0752bc754a6

SHA512
142446e606cbad39d89122c409acdef22d9af77ea1332483af08a1069a4308a4b31a8c0809bbcec6a379a98ccb4d4e1d63c50bdbba1ad3e72595de884bd8a5f2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC61E6.tmp

Filesize
652B

MD5
a37aac35a137cd5aa3c2c294239a51a6

SHA1
56f6d5860ade02a365e6443d43d09975cf4cf339

SHA256
1c3207eeb9c0edf7c1234c30b941c38091d9f1afaf6fde9697c18d1393cb8c79

SHA512
f6e945e250eb41d9c99091317581004abce8cc921614fbb37d0fcaa2ce87f65c47d04a9995e46d15430658e73c85e1f4c7777d36a84c45ccc1a85ae59305fd50

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resource.resources

Filesize
15KB

MD5
d0294b85a3cb4ef59a5565a2e6b1209f

SHA1
0c9f87cd89f2388d9d16d25533ac4dfe59ef0874

SHA256
35f139b7ff1909d42b09123c4fce94bfdbf0a944bc2d482f31d4edcd44ee3b09

SHA512
aef43cc881516364dcd6fdcba34e44448ff91e2cfe6849b36aef868ed7fde432662c3a32e14887e7f5f3f2cbad2a30aa6dcc15377f636bfbf8f394e8d14b7f06

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wcdxdyq_.0.cs

Filesize
1KB

MD5
e940e1d28d80e3124599d150cc8fb399

SHA1
8b8e9390e582e50f9370a5fc14bc85da793b36ba

SHA256
73e91506323efce31ff4b24197e6d8e527453a3308dd9d78e38602feb31abad6

SHA512
23ee20cc5ca65e67e9d4651b5f90d7c786d84712ec726c4bd725ce40f5241289249fa243b21bb5564aa335e6080f8f775e9eaa47289f8f8c623d44beda25bfd9

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wcdxdyq_.cmdline

Filesize
258B

MD5
ad27da9c50cec16b335b38ee5ae88497

SHA1
eda1037ed4e94bf453b9aca4057651e0c0bc1db4

SHA256
8065e96b1bdb785a07d0a4f0d4e8839e837336abc15afc31e712ef9e5a965253

SHA512
b28c29f9c87dd3bae749d128e58c39c54153b9db519568b7a35bf23099235e6e90de629488588f083a462fa667dbe782b30240b3cdb00dc529c3461f7cfd73ce

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\xegjfq0n.0.cs

Filesize
4KB

MD5
a84f64a4a43951ab36bf4000ad289ac2

SHA1
e1fea253ebc0ffa061b76021d1056a5781b4fde7

SHA256
0c9cfff90b6fcefc52829e30b79b83f33c91c9f7a7cf1d1d325e9019c7873b64

SHA512
a0732fd769dc42831eab918c979eb4d9207e8e6ee52883aebdfad138c93f5b211705a145bbf1945de00ecd30ca559ceee64bdb178c98718810291dcf37757ab6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\xegjfq0n.cmdline

Filesize
321B

MD5
990c66a61178b6d8ad4bd242f9514a4f

SHA1
6b55335f1d2b623232cd1fbcb22122a911c0b056

SHA256
983e49b7e2a5b1bdeb15be96e6ae13fb6ec0d8e167ffa368945fba8f06a79542

SHA512
8de9f39b72170d4c3765d92a5274a8c09467feef65a50d2e7bfcc11fbd5f748813e80e344aee5b5e59802f508064e71b0b8a73252d1f366e331ee7ad43c306e2

Download Submit
memory/964-62-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/964-55-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/964-56-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/964-61-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/964-30-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/964-36-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/964-54-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/964-63-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/964-67-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2116-53-0x00000000750C0000-0x0000000075671000-memory.dmp

Filesize
5.7MB

Download
memory/2116-25-0x00000000750C0000-0x0000000075671000-memory.dmp

Filesize
5.7MB

Download
memory/2116-24-0x00000000750C0000-0x0000000075671000-memory.dmp

Filesize
5.7MB

Download
memory/3224-44-0x00000000750C0000-0x0000000075671000-memory.dmp

Filesize
5.7MB

Download
memory/3224-37-0x00000000750C0000-0x0000000075671000-memory.dmp

Filesize
5.7MB

Download
memory/3560-15-0x00000000750C0000-0x0000000075671000-memory.dmp

Filesize
5.7MB

Download
memory/3560-8-0x00000000750C0000-0x0000000075671000-memory.dmp

Filesize
5.7MB

Download
memory/4436-52-0x00000000750C0000-0x0000000075671000-memory.dmp

Filesize
5.7MB

Download
memory/4436-0-0x00000000750C2000-0x00000000750C3000-memory.dmp

Filesize
4KB

Download
memory/4436-2-0x00000000750C0000-0x0000000075671000-memory.dmp

Filesize
5.7MB

Download
memory/4436-1-0x00000000750C0000-0x0000000075671000-memory.dmp

Filesize
5.7MB

Download