ddb430d00afb7bc830f83519c749306dbc59fb8384b181c48522629d9c408302

Analysis

max time kernel
149s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 05:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
Size

386KB
MD5

a1508d6acaa0907f088ba7a4dcf8746e
SHA1

0458c6b5581e6a6ab92ea98ed2264675dce4d95c
SHA256

ddb430d00afb7bc830f83519c749306dbc59fb8384b181c48522629d9c408302
SHA512

ffe51e7d578afb7f11c1b4c66a8801a67f970f4e9cfb29f76a1e5091e6370a2a165605c8532cceb009d700da8f183c37671e2c381fcf07224143940986180d0c
SSDEEP

6144:IU+BcxCxy+7LFOuUK4ERbwrQcTt14nIggVrVhuhJbdZjTG8NH:lYFy+7LFH4EoPggVJwHvjq8NH

Score

8^/10

bootkit discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	330d.exe

Executes dropped EXE 4 IoCs

pid	Process
2608	330d.exe
3284	330d.exe
1660	330d.exe
4108	mtv.exe

Loads dropped DLL 33 IoCs

pid	Process
3988	regsvr32.exe
4260	regsvr32.exe
3156	rundll32.exe
4960	rundll32.exe
4116	regsvr32.exe
1056	regsvr32.exe
4788	regsvr32.exe
2852	regsvr32.exe
3248	regsvr32.exe
1820	regsvr32.exe
2320	regsvr32.exe
2704	regsvr32.exe
4816	regsvr32.exe
2820	regsvr32.exe
4204	regsvr32.exe
4116	regsvr32.exe
4024	regsvr32.exe
1396	regsvr32.exe
1864	regsvr32.exe
4552	regsvr32.exe
932	regsvr32.exe
4508	regsvr32.exe
1516	regsvr32.exe
2220	regsvr32.exe
3680	regsvr32.exe
4932	regsvr32.exe
1392	regsvr32.exe
3220	regsvr32.exe
4208	regsvr32.exe
3084	regsvr32.exe
3692	regsvr32.exe
2108	regsvr32.exe
2044	regsvr32.exe

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File opened for modification	\??\PhysicalDrive0	330d.exe
File opened for modification	\??\PhysicalDrive0	rundll32.exe

Drops file in System32 directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\330e.dll	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\330d.exe	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\a3do.dlltmp	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Ì$-123106929	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\70l8.dlltmp	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\0aa3.dll	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\da3r.dll	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\da3r.dlltmp	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\03as.dll	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\00dc	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\30e6.dll	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\70l8.dll	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\0dr0.exe	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\03ca.dll	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\33u6.exe	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\03ca.dlltmp	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\0ddd.exe	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\a3do.dll	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\a3do.dll	330d.exe
File opened for modification	C:\Windows\SysWOW64\s.exe	mtv.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\d06d.flv	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File opened for modification	C:\Windows\aa0d.bmp	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File opened for modification	C:\Windows\686d.exe	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File created	C:\Windows\Tasks\ms.job	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File opened for modification	C:\Windows\4acu.bmp	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File opened for modification	C:\Windows\64a.bmp	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File opened for modification	C:\Windows\864.exe	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File opened for modification	C:\Windows\686.flv	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File opened for modification	C:\Windows\068u.bmp	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File opened for modification	C:\Windows\068d.exe	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File opened for modification	C:\Windows\068d.flv	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File opened for modification	C:\Windows\0d06.exe	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
File opened for modification	C:\Windows\733a.flv	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mtv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	330d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	330d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1660	330d.exe
1660	330d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4108	mtv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 1704	1288	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe	84
PID 1288 wrote to memory of 1704	1288	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe	84
PID 1288 wrote to memory of 1704	1288	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe	84
PID 1288 wrote to memory of 4476	1288	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe	85
PID 1288 wrote to memory of 4476	1288	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe	85
PID 1288 wrote to memory of 4476	1288	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe	85
PID 1288 wrote to memory of 3960	1288	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe	86
PID 1288 wrote to memory of 3960	1288	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe	86
PID 1288 wrote to memory of 3960	1288	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe	86
PID 1288 wrote to memory of 4912	1288	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe	88
PID 1288 wrote to memory of 4912	1288	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe	88
PID 1288 wrote to memory of 4912	1288	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe	88
PID 1288 wrote to memory of 3988	1288	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe	89
PID 1288 wrote to memory of 3988	1288	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe	89
PID 1288 wrote to memory of 3988	1288	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe	89
PID 1288 wrote to memory of 2608	1288	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe	91
PID 1288 wrote to memory of 2608	1288	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe	91
PID 1288 wrote to memory of 2608	1288	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe	91
PID 1288 wrote to memory of 3284	1288	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe	94
PID 1288 wrote to memory of 3284	1288	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe	94
PID 1288 wrote to memory of 3284	1288	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe	94
PID 1288 wrote to memory of 4108	1288	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe	99
PID 1288 wrote to memory of 4108	1288	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe	99
PID 1288 wrote to memory of 4108	1288	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe	99
PID 1660 wrote to memory of 4260	1660	330d.exe	100
PID 1660 wrote to memory of 4260	1660	330d.exe	100
PID 1660 wrote to memory of 4260	1660	330d.exe	100
PID 1660 wrote to memory of 3156	1660	330d.exe	101
PID 1660 wrote to memory of 3156	1660	330d.exe	101
PID 1660 wrote to memory of 3156	1660	330d.exe	101
PID 1288 wrote to memory of 4960	1288	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe	102
PID 1288 wrote to memory of 4960	1288	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe	102
PID 1288 wrote to memory of 4960	1288	a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe	102
PID 1660 wrote to memory of 4116	1660	330d.exe	108
PID 1660 wrote to memory of 4116	1660	330d.exe	108
PID 1660 wrote to memory of 4116	1660	330d.exe	108
PID 1660 wrote to memory of 1056	1660	330d.exe	111
PID 1660 wrote to memory of 1056	1660	330d.exe	111
PID 1660 wrote to memory of 1056	1660	330d.exe	111
PID 1660 wrote to memory of 4788	1660	330d.exe	112
PID 1660 wrote to memory of 4788	1660	330d.exe	112
PID 1660 wrote to memory of 4788	1660	330d.exe	112
PID 1660 wrote to memory of 2852	1660	330d.exe	113
PID 1660 wrote to memory of 2852	1660	330d.exe	113
PID 1660 wrote to memory of 2852	1660	330d.exe	113
PID 1660 wrote to memory of 3248	1660	330d.exe	114
PID 1660 wrote to memory of 3248	1660	330d.exe	114
PID 1660 wrote to memory of 3248	1660	330d.exe	114
PID 1660 wrote to memory of 1820	1660	330d.exe	120
PID 1660 wrote to memory of 1820	1660	330d.exe	120
PID 1660 wrote to memory of 1820	1660	330d.exe	120
PID 1660 wrote to memory of 2320	1660	330d.exe	121
PID 1660 wrote to memory of 2320	1660	330d.exe	121
PID 1660 wrote to memory of 2320	1660	330d.exe	121
PID 1660 wrote to memory of 2704	1660	330d.exe	122
PID 1660 wrote to memory of 2704	1660	330d.exe	122
PID 1660 wrote to memory of 2704	1660	330d.exe	122
PID 1660 wrote to memory of 4816	1660	330d.exe	123
PID 1660 wrote to memory of 4816	1660	330d.exe	123
PID 1660 wrote to memory of 4816	1660	330d.exe	123
PID 1660 wrote to memory of 2820	1660	330d.exe	124
PID 1660 wrote to memory of 2820	1660	330d.exe	124
PID 1660 wrote to memory of 2820	1660	330d.exe	124
PID 1660 wrote to memory of 4204	1660	330d.exe	125

C:\Users\Admin\AppData\Local\Temp\a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a1508d6acaa0907f088ba7a4dcf8746e_JaffaCakes118.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32/70l8.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1704
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32/03ca.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4476
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32/da3r.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3960
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32/a3do.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4912
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3988
- C:\Windows\SysWOW64\330d.exe
  C:\Windows\system32/330d.exe -i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2608
- C:\Windows\SysWOW64\330d.exe
  C:\Windows\system32/330d.exe -s
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Users\Admin\AppData\Local\Temp\h8nil4o8\mtv.exe
  C:\Users\Admin\AppData\Local\Temp\h8nil4o8\mtv.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4108
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32 C:\Windows\system32/330e.dll, Always
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4960

C:\Windows\SysWOW64\330d.exe
C:\Windows\SysWOW64\330d.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4260
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32 C:\Windows\system32/330e.dll,Always
  2⤵
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:3156
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4116
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1056
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4788
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2852
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3248
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1820
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2320
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2704
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4816
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2820
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4204
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4116
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4024
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1396
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1864
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4552
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:932
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4508
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1516
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2220
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3680
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4932
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1392
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3220
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4208
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3084
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3692
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2108
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32/regsvr32.exe /s "C:\Windows\system32/a3do.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\h8nil4o8\b.dll

Filesize
163KB

MD5
8193259016ed1361fed185c1618d8fe7

SHA1
4519743085da0d84fd73889740308102ca6a0ed6

SHA256
ae3c3074ac8d71645f773ee82c1268981b0dada64f61495966136cb31ec01c69

SHA512
660e249f02ddb6f5f4e89b99cb93d1edb5e1c18c92961a800c914ec92f2c2adbe9c9585158e179f8a8b96a66713e1b1c112b660d18cf9c1e20cf8de50cf9e76a

Download Submit
C:\Users\Admin\AppData\Local\Temp\h8nil4o8\mtv.exe

Filesize
152KB

MD5
2819c652266bd06922454cd5db2f5ed7

SHA1
7be5259ae25da4b1843165a5c37053b79e8df95d

SHA256
a6b48a8fc39a84917f155ca8e364dfd3f98819679ee46a6fafc95662e69bf797

SHA512
fd656d053b03757a48335853a375bd593ddd01d7add495c380df383f178ac6a8fac041f3ab90b28e1221999026dc1dd5c50d1e928fc58ee8297f0c092f2d9ebb

Download Submit
C:\Users\Admin\AppData\Local\Temp\h8nil4o8\p.dll

Filesize
456KB

MD5
2b0f207062edf3654fb843ab49760cba

SHA1
635dcacb957f5113f3104a44398e6dd6efe4ffdb

SHA256
4962ef8b40e7ab799caae95f631ad8ce929a2af511725faa65c21dc805d9f727

SHA512
2b282cfe2838ffba6ae46e83f59d35080cdab2a6ea3424565b84f3a6e9eea0005880ad5c5ef837b28f80ac02585c36166ca3b49cf2e2b5531d756e363712c7ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\h8nil4o8\s.exe

Filesize
192KB

MD5
18ee4e8c63454425a8c97858a9c53b59

SHA1
77971f324090e78af5fd3544b17b1f45efa1b2af

SHA256
afdb89ed06ce7cfb979ccb2822c358566689067d792694aa57e5d0d80cebec67

SHA512
5cc0a868adf436f2720daaf636afce41473b0ade18fef7ed906b25fbc8c54dca333b13efb9559511847de12619fbe632dc8e516f159dce76ba4f00fb67820d21

Download Submit
C:\Windows\Temp\tmp.exe

Filesize
84KB

MD5
3a516664abbc3fa0eab06b3ec0e3a0e1

SHA1
b7281a72a0d8696680facfc6d2f1d2e9f6d754d3

SHA256
8b39c0567ecd43eb35b95e99d598564e1205acced78f8d95f1eba92395e6b88d

SHA512
14040760ef727e91b128dbfe32ab847d0d271099d93b4463fa2ca303c4a075d206c6c43a9525bf3e978972fb7e5a505abbdfd1b0ce6932cfef8c97b518abad2f

Download Submit
memory/1056-116-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/1288-1-0x00000000021D0000-0x00000000021D2000-memory.dmp

Filesize
8KB

Download
memory/1288-0-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1288-106-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1392-195-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/1396-162-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/1516-180-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/1864-166-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2220-184-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2320-135-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2704-139-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2820-147-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2852-124-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/3220-199-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/3248-128-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/3680-188-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/3988-58-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/4024-158-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/4116-112-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/4204-151-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/4260-93-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/4508-176-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/4788-120-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/4816-143-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download