Overview
overview
10Static
static
3a4bcc3d83d...18.exe
windows7-x64
10a4bcc3d83d...18.exe
windows10-2004-x64
10$PLUGINSDI...st.dll
windows7-x64
3$PLUGINSDI...st.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$PLUGINSDI...ry.dll
windows7-x64
3$PLUGINSDI...ry.dll
windows10-2004-x64
3$_1_/Beasley.exe
windows7-x64
10$_1_/Beasley.exe
windows10-2004-x64
10$_1_/libeay32.dll
windows7-x64
3$_1_/libeay32.dll
windows10-2004-x64
3$_1_/ssleay32.dll
windows7-x64
3$_1_/ssleay32.dll
windows10-2004-x64
3Analysis
- max time kernel
143s - max time network
149s - platform
windows7_x64 - resource
win7-20240729-en - resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system - submitted
18/08/2024, 00:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISList.dll
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISList.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/registry.dll
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/registry.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
$_1_/Beasley.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral14
Sample
$_1_/Beasley.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral15
Sample
$_1_/libeay32.dll
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
$_1_/libeay32.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
$_1_/ssleay32.dll
Resource
win7-20240729-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
$_1_/ssleay32.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe
- Size 4.1MB
- Sample240818-a2nxrawcqa
- SHA256 ed20ff85f5df587140e0780e16a5eb28df94e1b6330c8256de39d94b5a772e83
- MD5 a4bcc3d83db92af30efb92b91c173fde
- SHA1 d3a18f9612dbc77563af00d4320b434f13b1384c
- SHA512 99e9f24ffe81c093b7278b130d76377efd4c37a6bd8882729b25f87821433ee45247e3e441627786bf37b4331a366c41df66092f0653d6a4597fde3abdf14547
- SSDEEP 98304:6WE8PHm2xRsBxIhM3wuu1NzJxUMkQDmBziWl:6WLPG2DOJwb1xJ+Z37
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\International\Geo\Nation Beasley.exe Key value queried \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\International\Geo\Nation Beasley.exe - Executes dropped EXE 3 IoCs
pid Process 3068 Beasley.exe 1860 Beasley.exe 1492 Beasley.exe - Loads dropped DLL 64 IoCs
pid Process 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Cosmopolitanize\Beasley.exe a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe File created C:\Program Files\Cosmopolitanize\ssleay32.dll a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe File created C:\Program Files\Cosmopolitanize\libeay32.dll a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Beasley.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Beasley.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Beasley.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2896 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3068 Beasley.exe Token: SeTakeOwnershipPrivilege 1860 Beasley.exe Token: SeTcbPrivilege 1860 Beasley.exe Token: SeTcbPrivilege 1860 Beasley.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3068 Beasley.exe 3068 Beasley.exe 3068 Beasley.exe 3068 Beasley.exe 1860 Beasley.exe 1860 Beasley.exe 1860 Beasley.exe 1860 Beasley.exe 1492 Beasley.exe 1492 Beasley.exe 1492 Beasley.exe 1492 Beasley.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2888 wrote to memory of 3068 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 30 PID 2888 wrote to memory of 3068 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 30 PID 2888 wrote to memory of 3068 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 30 PID 2888 wrote to memory of 3068 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 30 PID 2888 wrote to memory of 372 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 33 PID 2888 wrote to memory of 372 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 33 PID 2888 wrote to memory of 372 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 33 PID 2888 wrote to memory of 372 2888 a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe 33 PID 372 wrote to memory of 2896 372 cmd.exe 35 PID 372 wrote to memory of 2896 372 cmd.exe 35 PID 372 wrote to memory of 2896 372 cmd.exe 35 PID 372 wrote to memory of 2896 372 cmd.exe 35 PID 372 wrote to memory of 1116 372 cmd.exe 36 PID 372 wrote to memory of 1116 372 cmd.exe 36 PID 372 wrote to memory of 1116 372 cmd.exe 36 PID 372 wrote to memory of 1116 372 cmd.exe 36 PID 372 wrote to memory of 2644 372 cmd.exe 37 PID 372 wrote to memory of 2644 372 cmd.exe 37 PID 372 wrote to memory of 2644 372 cmd.exe 37 PID 372 wrote to memory of 2644 372 cmd.exe 37 PID 276 wrote to memory of 1492 276 taskeng.exe 39 PID 276 wrote to memory of 1492 276 taskeng.exe 39 PID 276 wrote to memory of 1492 276 taskeng.exe 39 PID 276 wrote to memory of 1492 276 taskeng.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a4bcc3d83db92af30efb92b91c173fde_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Program Files\Cosmopolitanize\Beasley.exe"C:\Program Files\Cosmopolitanize\Beasley.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3068 -
C:\Program Files\Cosmopolitanize\Beasley.exe"C:\Program Files\Cosmopolitanize\Beasley.exe" -second3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1860
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c SchTasks /create /f /XML %temp%\Log942.xml /TN \microsoft\windows\defrag\scheduleddefrag && schtasks /Change /TN \microsoft\windows\defrag\scheduleddefrag /ENABLE && schtasks /run /TN \microsoft\windows\defrag\scheduleddefrag2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Windows\SysWOW64\schtasks.exeSchTasks /create /f /XML C:\Users\Admin\AppData\Local\Temp\Log942.xml /TN \microsoft\windows\defrag\scheduleddefrag3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2896
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN \microsoft\windows\defrag\scheduleddefrag /ENABLE3⤵
- System Location Discovery: System Language Discovery
PID:1116
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /TN \microsoft\windows\defrag\scheduleddefrag3⤵
- System Location Discovery: System Language Discovery
PID:2644
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {1671B1BF-148E-4E8E-ADCE-DB04EB934C1E} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:276 -
C:\Program Files\Cosmopolitanize\Beasley.exe"C:\Program Files\Cosmopolitanize\Beasley.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1492
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsjB424.tmp\nsExec.dll
- Size 7KB
- SHA256 1f18f4126124b0551f3dbcd0fec7f34026f930ca509f04435657cedc32ae8c47
- MD5 f27689c513e7d12c7c974d5f8ef710d6
- SHA1 e305f2a2898d765a64c82c449dfb528665b4a892
- SHA512 734e9f3989ee47a86bee16838df7a09353c7fe085a09d77e70d281b21c5477b0b061616e72e8ac8fcb3dda1df0d5152f54dcc4c5a77f90fbf0f857557bf02fbc
- SSDEEP 96:JpmkmwmHDPVhklfSoRPB+YSvWvZckH69MSz00vQFHhAVvSGYuHnUNy2DCP:J+PVhYfSokvW2CsQFBAVaGdHnUNR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsjB424.tmp\nsProcess.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- MD5 f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files\Cosmopolitanize\Beasley.exe
- Size 11.2MB
- SHA256 a3b12707957c0875e23c202cea0268981623760072b5f7780ff62fd435311c6f
- MD5 080243eb6fff40cfd90a7e17cdb74ba8
- SHA1 78ee23e1b8e74d814d22a4288fe31f3c1a5a5495
- SHA512 ff765462a48f19aa0b984522f0507ef28c606117f44064a39c7e528906b94e88e23155a9af028d7d766cf9410481434af4afa40fe68b7e4ee73426b9275240d1
- SSDEEP 98304:56OwlI2RKvm132+y6gl70DNGyTuv+62VkYePy45nZGXzC+3ZYOx5nwtP:X6fRKvm13TyJ0DNwDnZGG+Jvx5nYP
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsjB424.tmp\NSISList.dll
- Size 105KB
- SHA256 df3621f83e9d11be45e0e617b899c4ab0241f60ed56494e892dc449482058402
- MD5 4b0617493f32b2b5fe5e838eeb885819
- SHA1 336e84380420a9caaa9c12af7c8e530135e63c57
- SHA512 5c50cf97cd9a6c699ec7928a08f77f4eaa68105e87a974432e39b637f926f0df8a95ec19bd63465fc438a4ef6349398938bc8d7651de125d13ccab89d1d49143
- SSDEEP 3072:NIgAGTHvtyzvUnB26s2oZtX0Uzi/t6zhy9:ygAuvtRno30V/t6z
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsjB424.tmp\System.dll
- Size 12KB
- SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
- MD5 8cf2ac271d7679b1d68eefc1ae0c5618
- SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
- SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
- SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsjB424.tmp\registry.dll
- Size 24KB
- SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
- MD5 2b7007ed0262ca02ef69d8990815cbeb
- SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
- SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
- SSDEEP 384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA
- MD5 SHA1 SHA512 SSDEEP