a9c4cea64ecebdb1de9326876b2051bb1e3d25d8199d5d8830d21daae7a36fb8

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 03:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
Size

2.8MB
MD5

a970c591be6af64b82d8285bfd648f58
SHA1

ba8ab2bf06b68a720b18708a3ced9d518f9abc78
SHA256

a9c4cea64ecebdb1de9326876b2051bb1e3d25d8199d5d8830d21daae7a36fb8
SHA512

32946e50f0ad97536ee984619a5c64924b38d2f1c0f7cb013c96a6d7a35b4d2ef651719f50105bc6256c9d4ca29803ab8bf1ff87b9139da17e8470c2eaa4fc17
SSDEEP

49152:7bSr72mlm51EiRwGn7GPF7BmXF9Hqvb9V7i/Fm6sqqrhf5+NrtzEy87NU5FXXzNm:zsoq7F

Score

7^/10

collection credential_access defense_evasion discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Executes dropped EXE 23 IoCs

pid	Process
2352	teste1_p.exe
2552	q1.exe
2748	miragge.exe
2196	fFollower.exe
2632	avto.exe
2628	6_ldry3no.exe
2096	4_pinnew.exe
2332	2_load.exe
2928	1your_exe.exe
1140	ope3E70.exe
2816	1275673347.exe
2496	svchosty.exe
1556	fFollower.exe
2024	svchosty.exe
1540	svchosty.exe
1772	svchosty.exe
1708	svchosty.exe
916	svchosty.exe
2412	svchosty.exe
1940	svchosty.exe
2688	svchosty.exe
804	svchosty.exe
2560	fFollower.exe

Loads dropped DLL 64 IoCs

pid	Process
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
3032	WerFault.exe
3032	WerFault.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
1140	ope3E70.exe
1140	ope3E70.exe
1140	ope3E70.exe
1140	ope3E70.exe
2196	fFollower.exe
2496	svchosty.exe
3032	WerFault.exe
2024	svchosty.exe
1540	svchosty.exe
1772	svchosty.exe
1708	svchosty.exe
916	svchosty.exe
2412	svchosty.exe
1940	svchosty.exe
2688	svchosty.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	4_pinnew.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\wvwvtqsys = "rundll32.exe \"mlihfe.dll\",DllRegisterServer"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Local\Temp\ope3E70.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ope3E70.exe "	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\lsass = "C:\\Windows\\lsass.exe"	teste1_p.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\netc = "C:\\Windows\\svc.exe"	avto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gebbbasys = "rundll32.exe \"mlihfe.dll\",DllRegisterServer"	rundll32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f00300000006d006c0069006800660065002e0064006c006c0000000000	rundll32.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\errorPageStrings[1]	fFollower.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\navcancl[1]	fFollower.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\background_gradient[1]	fFollower.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\background_gradient[2]	fFollower.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\bullet[2]	fFollower.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\info_48[2]	fFollower.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\httpErrorPagesScripts[1]	fFollower.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\bullet[2]	fFollower.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\httpErrorPagesScripts[2]	fFollower.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ErrorPageTemplate[1]	fFollower.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\errorPageStrings[1]	fFollower.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\httpErrorPagesScripts[1]	fFollower.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\httpErrorPagesScripts[2]	fFollower.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\info_48[2]	fFollower.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\navcancl[1]	fFollower.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\background_gradient[1]	fFollower.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\background_gradient[2]	fFollower.exe
File created	C:\Windows\SysWOW64\mlihfe.dll	miragge.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\bullet[1]	fFollower.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\info_48[1]	fFollower.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\info_48[1]	fFollower.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\bullet[1]	fFollower.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\navcancl[2]	fFollower.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\navcancl[2]	fFollower.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	fFollower.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ErrorPageTemplate[1]	fFollower.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT	fFollower.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\svc.exe	avto.exe
File opened for modification	C:\Windows\svc.exe	avto.exe
File created	C:\Windows\lsass.exe	teste1_p.exe
File opened for modification	C:\Windows\lsass.exe	teste1_p.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3032	2628	WerFault.exe	34

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fFollower.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ope3E70.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fFollower.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2_load.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	q1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fFollower.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1your_exe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6_ldry3no.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	teste1_p.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	miragge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	q1.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	svchosty.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	svchosty.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	svchosty.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	svchosty.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	svchosty.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	svchosty.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	teste1_p.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	svchosty.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	svchosty.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	svchosty.exe

Modifies data under HKEY_USERS 29 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	fFollower.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	fFollower.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	fFollower.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{033C53F2-54BC-4024-B9B3-0B7E2CB177AB}\WpadDecisionReason = "1"	fFollower.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-5d-0c-ca-14-11	fFollower.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	fFollower.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	fFollower.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main	fFollower.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-5d-0c-ca-14-11\WpadDecisionTime = 4087c5a6e9f1da01	fFollower.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{033C53F2-54BC-4024-B9B3-0B7E2CB177AB}\a6-5d-0c-ca-14-11	fFollower.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-5d-0c-ca-14-11\WpadDecision = "0"	fFollower.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	fFollower.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	fFollower.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	fFollower.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	fFollower.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	fFollower.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f007b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	fFollower.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-5d-0c-ca-14-11\WpadDecisionReason = "1"	fFollower.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-5d-0c-ca-14-11\WpadDecisionTime = 200d1aa1e9f1da01	fFollower.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{033C53F2-54BC-4024-B9B3-0B7E2CB177AB}\WpadDecision = "0"	fFollower.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	fFollower.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f007b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	fFollower.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{033C53F2-54BC-4024-B9B3-0B7E2CB177AB}\WpadDecisionTime = 4087c5a6e9f1da01	fFollower.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	fFollower.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	fFollower.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{033C53F2-54BC-4024-B9B3-0B7E2CB177AB}\WpadDecisionTime = 200d1aa1e9f1da01	fFollower.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-5d-0c-ca-14-11\WpadDetectedUrl	fFollower.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{033C53F2-54BC-4024-B9B3-0B7E2CB177AB}	fFollower.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{033C53F2-54BC-4024-B9B3-0B7E2CB177AB}\WpadNetworkName = "Network 3"	fFollower.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2096	4_pinnew.exe
2096	4_pinnew.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2096	4_pinnew.exe
Token: SeDebugPrivilege	2256	rundll32.exe
Token: SeDebugPrivilege	2256	rundll32.exe
Token: SeDebugPrivilege	2256	rundll32.exe
Token: SeDebugPrivilege	2256	rundll32.exe
Token: SeDebugPrivilege	2256	rundll32.exe
Token: SeDebugPrivilege	2256	rundll32.exe
Token: SeDebugPrivilege	2256	rundll32.exe
Token: SeDebugPrivilege	2256	rundll32.exe
Token: 33	2980	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2980	AUDIODG.EXE
Token: 33	2980	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2980	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2928	1your_exe.exe

Suspicious use of SetWindowsHookEx 29 IoCs

pid	Process
2552	q1.exe
2552	q1.exe
2352	teste1_p.exe
2352	teste1_p.exe
2196	fFollower.exe
2632	avto.exe
2632	avto.exe
1556	fFollower.exe
2688	svchosty.exe
2688	svchosty.exe
1940	svchosty.exe
1940	svchosty.exe
2412	svchosty.exe
2412	svchosty.exe
916	svchosty.exe
916	svchosty.exe
1708	svchosty.exe
1708	svchosty.exe
1772	svchosty.exe
1772	svchosty.exe
1540	svchosty.exe
1540	svchosty.exe
2024	svchosty.exe
2024	svchosty.exe
2496	svchosty.exe
2496	svchosty.exe
2560	fFollower.exe
2560	fFollower.exe
2560	fFollower.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2352	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	29
PID 2508 wrote to memory of 2352	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	29
PID 2508 wrote to memory of 2352	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	29
PID 2508 wrote to memory of 2352	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	29
PID 2508 wrote to memory of 2552	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	30
PID 2508 wrote to memory of 2552	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	30
PID 2508 wrote to memory of 2552	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	30
PID 2508 wrote to memory of 2552	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	30
PID 2508 wrote to memory of 2748	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2748	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2748	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2748	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2748	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2748	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2748	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	31
PID 2508 wrote to memory of 2196	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	32
PID 2508 wrote to memory of 2196	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	32
PID 2508 wrote to memory of 2196	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	32
PID 2508 wrote to memory of 2196	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	32
PID 2508 wrote to memory of 2632	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	33
PID 2508 wrote to memory of 2632	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	33
PID 2508 wrote to memory of 2632	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	33
PID 2508 wrote to memory of 2632	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	33
PID 2508 wrote to memory of 2628	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	34
PID 2508 wrote to memory of 2628	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	34
PID 2508 wrote to memory of 2628	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	34
PID 2508 wrote to memory of 2628	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	34
PID 2508 wrote to memory of 2096	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	35
PID 2508 wrote to memory of 2096	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	35
PID 2508 wrote to memory of 2096	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	35
PID 2508 wrote to memory of 2096	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	35
PID 2628 wrote to memory of 3032	2628	6_ldry3no.exe	36
PID 2628 wrote to memory of 3032	2628	6_ldry3no.exe	36
PID 2628 wrote to memory of 3032	2628	6_ldry3no.exe	36
PID 2628 wrote to memory of 3032	2628	6_ldry3no.exe	36
PID 2508 wrote to memory of 2332	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	37
PID 2508 wrote to memory of 2332	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	37
PID 2508 wrote to memory of 2332	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	37
PID 2508 wrote to memory of 2332	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	37
PID 2508 wrote to memory of 2928	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	38
PID 2508 wrote to memory of 2928	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	38
PID 2508 wrote to memory of 2928	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	38
PID 2508 wrote to memory of 2928	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	38
PID 2508 wrote to memory of 1140	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	39
PID 2508 wrote to memory of 1140	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	39
PID 2508 wrote to memory of 1140	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	39
PID 2508 wrote to memory of 1140	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	39
PID 2508 wrote to memory of 2816	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	40
PID 2508 wrote to memory of 2816	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	40
PID 2508 wrote to memory of 2816	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	40
PID 2508 wrote to memory of 2816	2508	a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe	40
PID 1140 wrote to memory of 2496	1140	ope3E70.exe	41
PID 1140 wrote to memory of 2496	1140	ope3E70.exe	41
PID 1140 wrote to memory of 2496	1140	ope3E70.exe	41
PID 1140 wrote to memory of 2496	1140	ope3E70.exe	41
PID 2196 wrote to memory of 1556	2196	fFollower.exe	42
PID 2196 wrote to memory of 1556	2196	fFollower.exe	42
PID 2196 wrote to memory of 1556	2196	fFollower.exe	42
PID 2196 wrote to memory of 1556	2196	fFollower.exe	42
PID 2496 wrote to memory of 2024	2496	svchosty.exe	43
PID 2496 wrote to memory of 2024	2496	svchosty.exe	43
PID 2496 wrote to memory of 2024	2496	svchosty.exe	43
PID 2496 wrote to memory of 2024	2496	svchosty.exe	43
PID 2024 wrote to memory of 1540	2024	svchosty.exe	44

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	4_pinnew.exe

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:396

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1284

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1388

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1604

C:\Users\Admin\AppData\Local\Temp\a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a970c591be6af64b82d8285bfd648f58_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Users\Admin\AppData\Local\Temp\teste1_p.exe
  "C:\Users\Admin\AppData\Local\Temp\teste1_p.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2352
- C:\Users\Admin\AppData\Local\Temp\q1.exe
  "C:\Users\Admin\AppData\Local\Temp\q1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2552
- C:\Users\Admin\AppData\Local\Temp\miragge.exe
  "C:\Users\Admin\AppData\Local\Temp\miragge.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2748
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\system32\mlihfe.dll",a
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Boot or Logon Autostart Execution: Authentication Package
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2256
- C:\Users\Admin\AppData\Local\Temp\fFollower.exe
  "C:\Users\Admin\AppData\Local\Temp\fFollower.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Users\Admin\AppData\Local\Temp\fFollower.exe
    C:\Users\Admin\AppData\Local\Temp\fFollower.exe /install /silent
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1556
- C:\Users\Admin\AppData\Local\Temp\avto.exe
  "C:\Users\Admin\AppData\Local\Temp\avto.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2632
- C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe
  "C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 148
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:3032
- C:\Users\Admin\AppData\Local\Temp\4_pinnew.exe
  "C:\Users\Admin\AppData\Local\Temp\4_pinnew.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_win_path
  PID:2096
- C:\Users\Admin\AppData\Local\Temp\2_load.exe
  "C:\Users\Admin\AppData\Local\Temp\2_load.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2332
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c del "C:\Users\Admin\AppData\Local\Temp\2_load.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2716
- C:\Users\Admin\AppData\Local\Temp\1your_exe.exe
  "C:\Users\Admin\AppData\Local\Temp\1your_exe.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2928
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1YOUR_~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1200
- C:\Users\Admin\AppData\Local\Temp\ope3E70.exe
  "C:\Users\Admin\AppData\Local\Temp\ope3E70.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Users\Admin\AppData\Local\Temp\svchosty.exe
    "C:\Users\Admin\AppData\Local\Temp\svchosty.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\svchosty.exe
      C:\Users\Admin\AppData\Local\Temp\svchosty.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\svchosty.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchosty.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\svchosty.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchosty.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\svchosty.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchosty.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\svchosty.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchosty.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\svchosty.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchosty.exe
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\svchosty.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchosty.exe
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\svchosty.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchosty.exe
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\svchosty.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchosty.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:804
- C:\Users\Admin\AppData\Local\Temp\1275673347.exe
  "C:\Users\Admin\AppData\Local\Temp\1275673347.exe"
  2⤵
  - Executes dropped EXE
  PID:2816

C:\Users\Admin\AppData\Local\Temp\fFollower.exe
C:\Users\Admin\AppData\Local\Temp\fFollower.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2560

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x5c4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5J67VDZD\rvqxfn[1].htm

Filesize
125B

MD5
45a9a2084a44d18bd0f446d6855908e4

SHA1
2b00aab2d6fd2e8fe429facce198d7093559adf1

SHA256
2ef87fbd5f3ec904bc116f3654421f4c53dc5438bbf36fa029dc8af8813f9646

SHA512
5e5d0c962cfa6faffafd32e10d1e38d90e12c184ab77d72907108b98bf73bdee685300c44ffae937203c7f74ecb8110794b542a4c3ba4831c9b3bafc77dc4d84

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ErrorPageTemplate[1]

Filesize
2KB

MD5
f4fe1cb77e758e1ba56b8a8ec20417c5

SHA1
f4eda06901edb98633a686b11d02f4925f827bf0

SHA256
8d018639281b33da8eb3ce0b21d11e1d414e59024c3689f92be8904eb5779b5f

SHA512
62514ab345b6648c5442200a8e9530dfb88a0355e262069e0a694289c39a4a1c06c6143e5961074bfac219949102a416c09733f24e8468984b96843dc222b436

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\background_gradient[1]

Filesize
453B

MD5
20f0110ed5e4e0d5384a496e4880139b

SHA1
51f5fc61d8bf19100df0f8aadaa57fcd9c086255

SHA256
1471693be91e53c2640fe7baeecbc624530b088444222d93f2815dfce1865d5b

SHA512
5f52c117e346111d99d3b642926139178a80b9ec03147c00e27f07aab47fe38e9319fe983444f3e0e36def1e86dd7c56c25e44b14efdc3f13b45ededa064db5a

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\bullet[1]

Filesize
447B

MD5
26f971d87ca00e23bd2d064524aef838

SHA1
7440beff2f4f8fabc9315608a13bf26cabad27d9

SHA256
1d8e5fd3c1fd384c0a7507e7283c7fe8f65015e521b84569132a7eabedc9d41d

SHA512
c62eb51be301bb96c80539d66a73cd17ca2021d5d816233853a37db72e04050271e581cc99652f3d8469b390003ca6c62dad2a9d57164c620b7777ae99aa1b15

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\errorPageStrings[1]

Filesize
2KB

MD5
e3e4a98353f119b80b323302f26b78fa

SHA1
20ee35a370cdd3a8a7d04b506410300fd0a6a864

SHA256
9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66

SHA512
d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\httpErrorPagesScripts[1]

Filesize
8KB

MD5
3f57b781cb3ef114dd0b665151571b7b

SHA1
ce6a63f996df3a1cccb81720e21204b825e0238c

SHA256
46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad

SHA512
8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\info_48[1]

Filesize
4KB

MD5
5565250fcc163aa3a79f0b746416ce69

SHA1
b97cc66471fcdee07d0ee36c7fb03f342c231f8f

SHA256
51129c6c98a82ea491f89857c31146ecec14c4af184517450a7a20c699c84859

SHA512
e60ea153b0fece4d311769391d3b763b14b9a140105a36a13dad23c2906735eaab9092236deb8c68ef078e8864d6e288bef7ef1731c1e9f1ad9b0170b95ac134

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\navcancl[1]

Filesize
2KB

MD5
4bcfe9f8db04948cddb5e31fe6a7f984

SHA1
42464c70fc16f3f361c2419751acd57d51613cdf

SHA256
bee0439fcf31de76d6e2d7fd377a24a34ac8763d5bf4114da5e1663009e24228

SHA512
bb0ef3d32310644285f4062ad5f27f30649c04c5a442361a5dbe3672bd8cb585160187070872a31d9f30b70397d81449623510365a371e73bda580e00eef0e4e

Download Submit
\Users\Admin\AppData\Local\Temp\1275673347.exe

Filesize
96KB

MD5
481317e395c99048099d7cac6cee51f6

SHA1
2acdfe506b32c1fbfd8ee2b04745b23c44b74e78

SHA256
7488cc79107e3b1a60669ad8e63aadc796202b1856aab4d540bbe4fbd8741c79

SHA512
7bbdf30ae0c3455685262f668ad70675fdda99703395a9d4aacfec20687886bf833c1fd045bcf395eb28d0d2387d5ab8f1e981f644c5a51441efd8993a023424

Download Submit
\Users\Admin\AppData\Local\Temp\1your_exe.exe

Filesize
22KB

MD5
e167b560b55f79b3a5e03270e93d3cfd

SHA1
3b027a5edcac28170e4abb9fae48328f7a441b9d

SHA256
0407fe93dda5e53b82e450b81ec682d3a64d5b031ee8ca73261443e0c7e9bcf9

SHA512
bef5683cd9187dfd3bcca865698a69c2eb9fa4760139f15a16eadc47487ad90171acdd8da48cbc62858eb79ee66909f363c51bcedda4ac5813322fb052b5a3d8

Download Submit
\Users\Admin\AppData\Local\Temp\2_load.exe

Filesize
13KB

MD5
21202ea609c5764bf6f24a7c8344a394

SHA1
ce937acd57b5c0a0efa039fc246624cd310ba841

SHA256
14c2265eba1e05758b6f64f20953310cfd0791ae25674c4b1425775edc8e1df3

SHA512
9fb2875a1f8497d959413803d49e82503d0a356bce9d3419fc40e03d3ee55f05f24327b25b40626ab8a8535ab21963cbde13fcb05d096fe67ba69c6349296eac

Download Submit
\Users\Admin\AppData\Local\Temp\4_pinnew.exe

Filesize
38KB

MD5
4f4285d6e5169fb72e11bb98d53c7243

SHA1
ce1b58617d4eedab42386484c5f7b6f72d33dc53

SHA256
5c7574c3bb7c489a47325ab11c787ab763a67c700d12439d75b49d1a84e88041

SHA512
eab548f9344b9107fdda1140e477bec562b77788764a2aae68e5761d842891552f2e66a7ddd21ec0c2b66f6b000d87e93b80f19af602d1d2003373196d0540c3

Download Submit
\Users\Admin\AppData\Local\Temp\6_ldry3no.exe

Filesize
82KB

MD5
53de5be5e645ba76ad8411eaa74744c1

SHA1
0d94a6a0293820c4e90fcdb6007146e74a24f0ef

SHA256
799dccbddbf417014c3aeca48371d9df76389bb6cf2880a08be582d7f65178d4

SHA512
710f05537267b3ce2b16db2408f8241fb09fb56ac2c85f6ab1592bd32d646c6bb9161a34f194ae7d2b1895a3fca88593f431a9a74c18d1ad1b86c0e97e1bc10f

Download Submit
\Users\Admin\AppData\Local\Temp\avto.exe

Filesize
288KB

MD5
9ee0b6e663e779957d1d7bde833a16b9

SHA1
06f64375d3c2d1c5f245ef0d05f8e1a9693a9370

SHA256
93ec99341172ff4cec39dd36ecc07f95256966dd16f310de8722ea51c1af3c78

SHA512
abb05a9d620d9bc36e9923783c76b83b0a5d52cde0299d2c4cb6fb060bfdb977deff499af643cc17cc6bd73eaccbb8118a021c2b7bf30dbe7e8a23aa1fb675ee

Download Submit
\Users\Admin\AppData\Local\Temp\fFollower.exe

Filesize
406KB

MD5
06c859d93ff64a10e2ff5fbf66551674

SHA1
91bb34d719ac399f71801e932357c11f2022ae57

SHA256
5793c4702a132ff09bcd9fb6f2ff460e7cc08af41a756f08e22fec8a39ba05e0

SHA512
18ef5abd1fa1c8dc019de915513eea3ead7d1e829a57efdf49a839fe58f0cf35fe7ff67b10dabf975c1ae7cc1e6502a963845108a55414d0ef59b3e9534be506

Download Submit
\Users\Admin\AppData\Local\Temp\miragge.exe

Filesize
131KB

MD5
eb5ef99e16e408979d0d4a2aa7bc107f

SHA1
3847fc4f39f06311991c20c2a6cf0a9178fd5b40

SHA256
e1c529aa3a5fcc7c7e97d1d21390d575e194952f88bff45aeb250446749e1d89

SHA512
22e8ef2f5c65c092ff0e7af493f3d6130cc78aea2e826677e6f8f34b2d8b29411438dd541e51ec880cef5942c81c60c50f412a20988a5f16f4cb8fbbd89662cd

Download Submit
\Users\Admin\AppData\Local\Temp\ope3E70.exe

Filesize
403KB

MD5
76a912b04174bbd59c9bf93ed5846efc

SHA1
0142a71e613d8a1f88c0bff9be4704b3df7e0c76

SHA256
fdabec00116dfe7ee8e1019623186432f7f315911cd902b68cc77f887544848c

SHA512
17a8e66f78c21698afff883c3d79ef34c044e139b13b89c25577975bcd8e4e93c51dc79846069a4eec28fa7405d05cfb1bc7c8a6f39e47e9ed83782938e9e754

Download Submit
\Users\Admin\AppData\Local\Temp\q1.exe

Filesize
287KB

MD5
95e44a25c33c5d8242e6085fbc02b7a4

SHA1
9770f29496bc4c8da7c499bc6b220891a16c004e

SHA256
3fdd52e7c0f0ec6e43f3e920a2368b4dadf845a8c314640b6f38975e2cf055dd

SHA512
222c976d30f2d51abbcf048ac45439c90e5a945a90b2996890c4a919630ff75c7c1f9712656c08d21e91dfa890dc310a08a5b0632ec3bf86a11ce9e56f861140

Download Submit
\Users\Admin\AppData\Local\Temp\svchosty.exe

Filesize
291KB

MD5
0f58fd041d61178c3aeb038e9aa8ab3e

SHA1
fdd93eefdb61854b7bfa97eb73b835ee32ee3ff9

SHA256
af07bcb366b3c768550f3a2043b2b1828d1ce1b1d0d41733b33f04302a9620db

SHA512
13ecaa1a2ae5fd58a1c204cf4988ef82ddfb48e27ed093fda25ecca64e928c1bc97e5d3a165ec6594e6202d60ca7c853dfe3fcd7c32aa467d7f9a64c28f065ba

Download Submit
\Users\Admin\AppData\Local\Temp\teste1_p.exe

Filesize
349KB

MD5
b305d3991789bf36aaed61c8ff026b3f

SHA1
e001e7dd0f0ae06bdfa90f0fb3e604d3d78a2eeb

SHA256
1aafa2d2ded9af080af38ec664c6974c1319cbeddee6aa367623c727962e0266

SHA512
9accfe156468dd9f84c3c4138f351fb513f0a4e8e1d48c56706d2057f549adc556f0cb6e4ccc741c51b7583afda20d659b53c71941aed11db8828355137197de

Download Submit
memory/396-205-0x0000000002CA0000-0x0000000002CA1000-memory.dmp

Filesize
4KB

Download
memory/804-199-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/916-232-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/916-347-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1140-193-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1540-344-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1540-229-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1556-198-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1708-346-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1708-231-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1772-345-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1772-230-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1940-234-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2024-343-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2024-228-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2096-224-0x0000000013140000-0x0000000013181000-memory.dmp

Filesize
260KB

Download
memory/2196-200-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2256-203-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2256-238-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2332-240-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/2332-225-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/2352-206-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2352-243-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2352-221-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2352-20-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2352-41-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2352-37-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2412-233-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2496-227-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2496-342-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2508-3-0x0000000000400000-0x00000000006D2000-memory.dmp

Filesize
2.8MB

Download
memory/2508-177-0x0000000000400000-0x00000000006D2000-memory.dmp

Filesize
2.8MB

Download
memory/2508-0-0x000000000065E000-0x00000000006D0000-memory.dmp

Filesize
456KB

Download
memory/2508-1-0x0000000000400000-0x00000000006D2000-memory.dmp

Filesize
2.8MB

Download
memory/2552-307-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2552-216-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2552-218-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2552-40-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2552-36-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2560-237-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2628-112-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2628-223-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2632-214-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2688-235-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2748-54-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2748-215-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2816-178-0x0000000000250000-0x0000000000269000-memory.dmp

Filesize
100KB

Download
memory/2816-201-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download