3f438081d66d742339cb61c39a8ca4f07f844287e8ab2ccee9eea8af302570dc

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 05:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba8413bd7cde42eb7e6c61144cb97ed3_JaffaCakes118.exe
Size

118KB
MD5

ba8413bd7cde42eb7e6c61144cb97ed3
SHA1

a94ae31338fbfb1b8f09a248ef1d718f89e61a70
SHA256

3f438081d66d742339cb61c39a8ca4f07f844287e8ab2ccee9eea8af302570dc
SHA512

3fb802765947d9ad0af60de54778f42a739b45c380f768cdd80acd1b2259103fbcd3a15641aec592198f52efd6315eb9b2cbd7d6350331e2977b7dafccd76e67
SSDEEP

3072:1vfb3O8b1iyxTophCbFkgq3/OsclajLjpW:1vD3O85/hScbFU/Og

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\userinit.exe"	userinit.exe

Executes dropped EXE 64 IoCs

pid	Process
2324	userinit.exe
2056	system.exe
2652	system.exe
2616	system.exe
2240	system.exe
2476	system.exe
2420	system.exe
2736	system.exe
2936	system.exe
1768	system.exe
1096	system.exe
572	system.exe
2052	system.exe
2328	system.exe
1196	system.exe
1584	system.exe
756	system.exe
904	system.exe
1804	system.exe
1176	system.exe
2480	system.exe
700	system.exe
2000	system.exe
892	system.exe
1912	system.exe
2760	system.exe
2080	system.exe
2548	system.exe
2576	system.exe
2604	system.exe
2228	system.exe
1780	system.exe
2244	system.exe
2476	system.exe
2976	system.exe
2804	system.exe
2940	system.exe
2912	system.exe
1312	system.exe
2100	system.exe
2892	system.exe
2140	system.exe
2172	system.exe
1980	system.exe
2316	system.exe
2144	system.exe
316	system.exe
1872	system.exe
868	system.exe
1688	system.exe
2956	system.exe
1680	system.exe
1036	system.exe
1716	system.exe
1028	system.exe
2000	system.exe
844	system.exe
2684	system.exe
2760	system.exe
2824	system.exe
2848	system.exe
2832	system.exe
2612	system.exe
2008	system.exe

Loads dropped DLL 64 IoCs

pid	Process
2768	Regsvr32.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe
2324	userinit.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\MSWINSCK.OCX	userinit.exe
File created	C:\Windows\SysWOW64\system.exe	userinit.exe
File opened for modification	C:\Windows\SysWOW64\system.exe	userinit.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\userinit.exe	ba8413bd7cde42eb7e6c61144cb97ed3_JaffaCakes118.exe
File opened for modification	C:\Windows\userinit.exe	ba8413bd7cde42eb7e6c61144cb97ed3_JaffaCakes118.exe
File created	C:\Windows\kdcoms.dll	userinit.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}	Regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR\	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents"	Regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\ = "Microsoft WinSock Control, version 6.0"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\ = "Microsoft WinSock Control, version 6.0"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ = "Microsoft WinSock Control, version 6.0"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Programmable	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS\ = "2"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version\ = "1.0"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\ = "0"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX, 1"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID\ = "MSWinsock.Winsock"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl"	Regsvr32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2624	ba8413bd7cde42eb7e6c61144cb97ed3_JaffaCakes118.exe
2324	userinit.exe
2324	userinit.exe
2056	system.exe
2324	userinit.exe
2652	system.exe
2324	userinit.exe
2616	system.exe
2324	userinit.exe
2240	system.exe
2324	userinit.exe
2476	system.exe
2324	userinit.exe
2420	system.exe
2324	userinit.exe
2736	system.exe
2324	userinit.exe
2936	system.exe
2324	userinit.exe
1768	system.exe
2324	userinit.exe
1096	system.exe
2324	userinit.exe
572	system.exe
2324	userinit.exe
2052	system.exe
2324	userinit.exe
2328	system.exe
2324	userinit.exe
1196	system.exe
2324	userinit.exe
1584	system.exe
2324	userinit.exe
756	system.exe
2324	userinit.exe
904	system.exe
2324	userinit.exe
1804	system.exe
2324	userinit.exe
1176	system.exe
2324	userinit.exe
2480	system.exe
2324	userinit.exe
700	system.exe
2324	userinit.exe
2000	system.exe
2324	userinit.exe
892	system.exe
2324	userinit.exe
2324	userinit.exe
2760	system.exe
2324	userinit.exe
2080	system.exe
2324	userinit.exe
2548	system.exe
2324	userinit.exe
2576	system.exe
2324	userinit.exe
2604	system.exe
2324	userinit.exe
2228	system.exe
2324	userinit.exe
1780	system.exe
2324	userinit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2324	userinit.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2624	ba8413bd7cde42eb7e6c61144cb97ed3_JaffaCakes118.exe
2624	ba8413bd7cde42eb7e6c61144cb97ed3_JaffaCakes118.exe
2324	userinit.exe
2324	userinit.exe
2056	system.exe
2056	system.exe
2652	system.exe
2652	system.exe
2616	system.exe
2616	system.exe
2240	system.exe
2240	system.exe
2476	system.exe
2476	system.exe
2420	system.exe
2420	system.exe
2736	system.exe
2736	system.exe
2936	system.exe
2936	system.exe
1768	system.exe
1768	system.exe
1096	system.exe
1096	system.exe
572	system.exe
572	system.exe
2052	system.exe
2052	system.exe
2328	system.exe
2328	system.exe
1196	system.exe
1196	system.exe
1584	system.exe
1584	system.exe
756	system.exe
756	system.exe
904	system.exe
904	system.exe
1804	system.exe
1804	system.exe
1176	system.exe
1176	system.exe
2480	system.exe
2480	system.exe
700	system.exe
700	system.exe
2000	system.exe
2000	system.exe
892	system.exe
892	system.exe
2760	system.exe
2760	system.exe
2080	system.exe
2080	system.exe
2548	system.exe
2548	system.exe
2576	system.exe
2576	system.exe
2604	system.exe
2604	system.exe
2228	system.exe
2228	system.exe
1780	system.exe
1780	system.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2324	2624	ba8413bd7cde42eb7e6c61144cb97ed3_JaffaCakes118.exe	30
PID 2624 wrote to memory of 2324	2624	ba8413bd7cde42eb7e6c61144cb97ed3_JaffaCakes118.exe	30
PID 2624 wrote to memory of 2324	2624	ba8413bd7cde42eb7e6c61144cb97ed3_JaffaCakes118.exe	30
PID 2624 wrote to memory of 2324	2624	ba8413bd7cde42eb7e6c61144cb97ed3_JaffaCakes118.exe	30
PID 2324 wrote to memory of 2768	2324	userinit.exe	31
PID 2324 wrote to memory of 2768	2324	userinit.exe	31
PID 2324 wrote to memory of 2768	2324	userinit.exe	31
PID 2324 wrote to memory of 2768	2324	userinit.exe	31
PID 2324 wrote to memory of 2768	2324	userinit.exe	31
PID 2324 wrote to memory of 2768	2324	userinit.exe	31
PID 2324 wrote to memory of 2768	2324	userinit.exe	31
PID 2324 wrote to memory of 2056	2324	userinit.exe	32
PID 2324 wrote to memory of 2056	2324	userinit.exe	32
PID 2324 wrote to memory of 2056	2324	userinit.exe	32
PID 2324 wrote to memory of 2056	2324	userinit.exe	32
PID 2324 wrote to memory of 2652	2324	userinit.exe	33
PID 2324 wrote to memory of 2652	2324	userinit.exe	33
PID 2324 wrote to memory of 2652	2324	userinit.exe	33
PID 2324 wrote to memory of 2652	2324	userinit.exe	33
PID 2324 wrote to memory of 2616	2324	userinit.exe	34
PID 2324 wrote to memory of 2616	2324	userinit.exe	34
PID 2324 wrote to memory of 2616	2324	userinit.exe	34
PID 2324 wrote to memory of 2616	2324	userinit.exe	34
PID 2324 wrote to memory of 2240	2324	userinit.exe	35
PID 2324 wrote to memory of 2240	2324	userinit.exe	35
PID 2324 wrote to memory of 2240	2324	userinit.exe	35
PID 2324 wrote to memory of 2240	2324	userinit.exe	35
PID 2324 wrote to memory of 2476	2324	userinit.exe	36
PID 2324 wrote to memory of 2476	2324	userinit.exe	36
PID 2324 wrote to memory of 2476	2324	userinit.exe	36
PID 2324 wrote to memory of 2476	2324	userinit.exe	36
PID 2324 wrote to memory of 2420	2324	userinit.exe	37
PID 2324 wrote to memory of 2420	2324	userinit.exe	37
PID 2324 wrote to memory of 2420	2324	userinit.exe	37
PID 2324 wrote to memory of 2420	2324	userinit.exe	37
PID 2324 wrote to memory of 2736	2324	userinit.exe	38
PID 2324 wrote to memory of 2736	2324	userinit.exe	38
PID 2324 wrote to memory of 2736	2324	userinit.exe	38
PID 2324 wrote to memory of 2736	2324	userinit.exe	38
PID 2324 wrote to memory of 2936	2324	userinit.exe	39
PID 2324 wrote to memory of 2936	2324	userinit.exe	39
PID 2324 wrote to memory of 2936	2324	userinit.exe	39
PID 2324 wrote to memory of 2936	2324	userinit.exe	39
PID 2324 wrote to memory of 1768	2324	userinit.exe	40
PID 2324 wrote to memory of 1768	2324	userinit.exe	40
PID 2324 wrote to memory of 1768	2324	userinit.exe	40
PID 2324 wrote to memory of 1768	2324	userinit.exe	40
PID 2324 wrote to memory of 1096	2324	userinit.exe	41
PID 2324 wrote to memory of 1096	2324	userinit.exe	41
PID 2324 wrote to memory of 1096	2324	userinit.exe	41
PID 2324 wrote to memory of 1096	2324	userinit.exe	41
PID 2324 wrote to memory of 572	2324	userinit.exe	42
PID 2324 wrote to memory of 572	2324	userinit.exe	42
PID 2324 wrote to memory of 572	2324	userinit.exe	42
PID 2324 wrote to memory of 572	2324	userinit.exe	42
PID 2324 wrote to memory of 2052	2324	userinit.exe	43
PID 2324 wrote to memory of 2052	2324	userinit.exe	43
PID 2324 wrote to memory of 2052	2324	userinit.exe	43
PID 2324 wrote to memory of 2052	2324	userinit.exe	43
PID 2324 wrote to memory of 2328	2324	userinit.exe	44
PID 2324 wrote to memory of 2328	2324	userinit.exe	44
PID 2324 wrote to memory of 2328	2324	userinit.exe	44
PID 2324 wrote to memory of 2328	2324	userinit.exe	44
PID 2324 wrote to memory of 1196	2324	userinit.exe	45

C:\Users\Admin\AppData\Local\Temp\ba8413bd7cde42eb7e6c61144cb97ed3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ba8413bd7cde42eb7e6c61144cb97ed3_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\userinit.exe
  C:\Windows\userinit.exe
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\Regsvr32.exe
    Regsvr32 C:\Windows\system32\MSWINSCK.OCX /s
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2768
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2056
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2652
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2616
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2240
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2476
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2420
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2736
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2936
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1768
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1096
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:572
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2052
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2328
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1196
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1584
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:756
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:904
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1804
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1176
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2480
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:700
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2000
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:892
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1912
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2760
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2080
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2548
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2576
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2604
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2228
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1780
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:2244
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:2476
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2976
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2804
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:2940
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:2912
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1312
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2100
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:2892
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2140
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2172
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:1980
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:2316
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:2144
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:316
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1872
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:868
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:1688
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2956
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:1680
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:1036
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1716
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1028
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2000
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:844
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:2684
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:2760
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2824
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2848
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2832
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:2612
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:2008
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3000
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:592
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2124
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2420
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2900
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2924
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:448
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:760
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2640
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:688
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2180
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2208
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2412
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2312
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1856
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1748
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1672
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1792
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:904
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:820
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2528
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1988
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1940
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1724
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1616
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2820
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2252
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2360
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2792
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2856
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2356
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2556
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2216
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1272
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:3052
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1704
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2224
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1968
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2124
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2784
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:3056
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3016
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2744
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3004
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2716
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2200
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2196
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2176
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2492
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:112
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2212
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2440
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:756
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2416
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1928
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1804
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1700
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2528
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1340
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1940
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1724
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1616
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2820
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2500
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2768
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2364
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2848
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2832
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2844
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2008
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2944
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:948
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2568
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2872
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1820
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2804
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2908
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1612
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\MSWINSCK.OCX

Filesize
105KB

MD5
9484c04258830aa3c2f2a70eb041414c

SHA1
b242a4fb0e9dcf14cb51dc36027baff9a79cb823

SHA256
bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5

SHA512
9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0

Download Submit
C:\Windows\userinit.exe

Filesize
118KB

MD5
ba8413bd7cde42eb7e6c61144cb97ed3

SHA1
a94ae31338fbfb1b8f09a248ef1d718f89e61a70

SHA256
3f438081d66d742339cb61c39a8ca4f07f844287e8ab2ccee9eea8af302570dc

SHA512
3fb802765947d9ad0af60de54778f42a739b45c380f768cdd80acd1b2259103fbcd3a15641aec592198f52efd6315eb9b2cbd7d6350331e2977b7dafccd76e67

Download Submit
memory/572-166-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/700-279-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/756-225-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/760-708-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/892-295-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/904-800-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1096-150-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1096-155-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1196-201-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1272-924-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1584-213-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1768-140-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1856-767-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1912-304-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1912-300-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1912-302-0x00000000776C0000-0x00000000777DF000-memory.dmp

Filesize
1.1MB

Download
memory/1912-303-0x00000000777E0000-0x00000000778DA000-memory.dmp

Filesize
1000KB

Download
memory/2052-178-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2056-41-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2056-37-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2140-454-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2240-75-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2240-79-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2324-417-0x00000000041D0000-0x000000000421D000-memory.dmp

Filesize
308KB

Download
memory/2324-346-0x00000000041D0000-0x000000000421D000-memory.dmp

Filesize
308KB

Download
memory/2324-889-0x00000000041D0000-0x000000000421D000-memory.dmp

Filesize
308KB

Download
memory/2324-135-0x00000000039A0000-0x00000000039ED000-memory.dmp

Filesize
308KB

Download
memory/2324-856-0x00000000041D0000-0x000000000421D000-memory.dmp

Filesize
308KB

Download
memory/2324-141-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2324-110-0x00000000039A0000-0x00000000039ED000-memory.dmp

Filesize
308KB

Download
memory/2324-149-0x00000000039A0000-0x00000000039ED000-memory.dmp

Filesize
308KB

Download
memory/2324-839-0x00000000041D0000-0x000000000421D000-memory.dmp

Filesize
308KB

Download
memory/2324-805-0x00000000041D0000-0x000000000421D000-memory.dmp

Filesize
308KB

Download
memory/2324-174-0x00000000039A0000-0x00000000039ED000-memory.dmp

Filesize
308KB

Download
memory/2324-98-0x00000000039A0000-0x00000000039ED000-memory.dmp

Filesize
308KB

Download
memory/2324-15-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2324-197-0x00000000039A0000-0x00000000039ED000-memory.dmp

Filesize
308KB

Download
memory/2324-737-0x00000000041D0000-0x000000000421D000-memory.dmp

Filesize
308KB

Download
memory/2324-208-0x00000000039A0000-0x00000000039ED000-memory.dmp

Filesize
308KB

Download
memory/2324-86-0x00000000039A0000-0x00000000039ED000-memory.dmp

Filesize
308KB

Download
memory/2324-74-0x00000000039A0000-0x00000000039ED000-memory.dmp

Filesize
308KB

Download
memory/2324-233-0x00000000039A0000-0x00000000039ED000-memory.dmp

Filesize
308KB

Download
memory/2324-245-0x00000000039A0000-0x00000000039ED000-memory.dmp

Filesize
308KB

Download
memory/2324-250-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2324-611-0x00000000041D0000-0x000000000421D000-memory.dmp

Filesize
308KB

Download
memory/2324-601-0x00000000041D0000-0x000000000421D000-memory.dmp

Filesize
308KB

Download
memory/2324-527-0x00000000041D0000-0x000000000421D000-memory.dmp

Filesize
308KB

Download
memory/2324-518-0x00000000041D0000-0x000000000421D000-memory.dmp

Filesize
308KB

Download
memory/2324-49-0x00000000039A0000-0x00000000039ED000-memory.dmp

Filesize
308KB

Download
memory/2324-509-0x00000000039A0000-0x00000000039ED000-memory.dmp

Filesize
308KB

Download
memory/2324-30-0x00000000039A0000-0x00000000039ED000-memory.dmp

Filesize
308KB

Download
memory/2324-309-0x00000000039A0000-0x00000000039ED000-memory.dmp

Filesize
308KB

Download
memory/2324-310-0x00000000039A0000-0x00000000039ED000-memory.dmp

Filesize
308KB

Download
memory/2324-459-0x00000000041D0000-0x000000000421D000-memory.dmp

Filesize
308KB

Download
memory/2324-319-0x00000000039A0000-0x00000000039ED000-memory.dmp

Filesize
308KB

Download
memory/2324-328-0x00000000039A0000-0x00000000039ED000-memory.dmp

Filesize
308KB

Download
memory/2324-408-0x00000000041D0000-0x000000000421D000-memory.dmp

Filesize
308KB

Download
memory/2324-124-0x00000000039A0000-0x00000000039ED000-memory.dmp

Filesize
308KB

Download
memory/2324-355-0x00000000041D0000-0x000000000421D000-memory.dmp

Filesize
308KB

Download
memory/2324-365-0x00000000041D0000-0x000000000421D000-memory.dmp

Filesize
308KB

Download
memory/2324-364-0x00000000041D0000-0x000000000421D000-memory.dmp

Filesize
308KB

Download
memory/2324-372-0x00000000041D0000-0x000000000421D000-memory.dmp

Filesize
308KB

Download
memory/2324-391-0x00000000041D0000-0x000000000421D000-memory.dmp

Filesize
308KB

Download
memory/2328-189-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2420-103-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2476-91-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2480-271-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2548-332-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2556-910-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2616-66-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2616-62-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2624-24-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2624-13-0x0000000002360000-0x00000000023AD000-memory.dmp

Filesize
308KB

Download
memory/2624-14-0x0000000002360000-0x00000000023AD000-memory.dmp

Filesize
308KB

Download
memory/2624-1-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2624-0-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2652-50-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2652-54-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2736-112-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2736-116-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2760-314-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2824-606-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2900-683-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2912-421-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2936-128-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2976-395-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3000-649-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3000-644-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3052-933-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download