02358ba4720c5de7691c9fb71e0cfa437f1c1bc0e856d9a207de563bb6b62b8a

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc0ee3e54b30159aba15019a51197300_JaffaCakes118.exe
Size

76KB
MD5

bc0ee3e54b30159aba15019a51197300
SHA1

b02627317e03b6c669922fccc42ff4eb9da95d1a
SHA256

02358ba4720c5de7691c9fb71e0cfa437f1c1bc0e856d9a207de563bb6b62b8a
SHA512

20b4d6ca2284a52b6198a4ae0699756599503aa41a079de4df4838882dd148b106a78de660e120abf0e586f18be437d32e0084be89dc4c6033450ad75d5bb798
SSDEEP

1536:yy6h6NL247EJlU5IB99muEO40sW9qazlShlq4Se:2hU24uWCB99muEh0sW9nYjq4D

Score

8^/10

discovery persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	myccdd080721a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\ccnhh = "rundll32.exe C:\\Windows\\system32\\mywcc080721.dll bgdll"	myccdd080721a.exe

Deletes itself 1 IoCs

pid	Process
2836	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2788	myccdd080721a.exe

Loads dropped DLL 6 IoCs

pid	Process
2272	rundll32.exe
2272	rundll32.exe
2272	rundll32.exe
2272	rundll32.exe
2772	cmd.exe
2772	cmd.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\myccdd080721a.exe	bc0ee3e54b30159aba15019a51197300_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\myccdd080721a.exe	bc0ee3e54b30159aba15019a51197300_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\mywcc080721.dll	bc0ee3e54b30159aba15019a51197300_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\mycgc32.dll	myccdd080721a.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\cc16.ini	bc0ee3e54b30159aba15019a51197300_JaffaCakes118.exe
File opened for modification	C:\Windows\cc16.ini	myccdd080721a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 54 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc0ee3e54b30159aba15019a51197300_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	myccdd080721a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 48 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1848	PING.EXE
3020	PING.EXE
1260	PING.EXE
3068	PING.EXE
968	PING.EXE
776	PING.EXE
1552	PING.EXE
2852	PING.EXE
1588	PING.EXE
2164	PING.EXE
1540	PING.EXE
2620	PING.EXE
1736	PING.EXE
1744	PING.EXE
2208	PING.EXE
2072	PING.EXE
268	PING.EXE
772	PING.EXE
2404	PING.EXE
3000	PING.EXE
1904	PING.EXE
1124	PING.EXE
2996	PING.EXE
1328	PING.EXE
1076	PING.EXE
2128	PING.EXE
2200	PING.EXE
1812	PING.EXE
1656	PING.EXE
1444	PING.EXE
2464	PING.EXE
1764	PING.EXE
2268	PING.EXE
112	PING.EXE
2584	PING.EXE
1940	PING.EXE
2840	PING.EXE
2192	PING.EXE
916	PING.EXE
1668	PING.EXE
2944	PING.EXE
1500	PING.EXE
2204	PING.EXE
1008	PING.EXE
2312	PING.EXE
2216	PING.EXE
1608	PING.EXE
536	PING.EXE

Runs ping.exe 1 TTPs 48 IoCs

Remote System Discovery

T1018

pid	Process
2620	PING.EXE
2312	PING.EXE
1552	PING.EXE
2584	PING.EXE
1940	PING.EXE
1904	PING.EXE
1500	PING.EXE
2996	PING.EXE
1764	PING.EXE
2216	PING.EXE
1608	PING.EXE
2128	PING.EXE
2944	PING.EXE
1540	PING.EXE
2204	PING.EXE
772	PING.EXE
1328	PING.EXE
112	PING.EXE
3020	PING.EXE
776	PING.EXE
1812	PING.EXE
916	PING.EXE
1848	PING.EXE
1588	PING.EXE
2200	PING.EXE
3068	PING.EXE
2464	PING.EXE
2268	PING.EXE
1076	PING.EXE
1656	PING.EXE
2208	PING.EXE
1668	PING.EXE
1444	PING.EXE
968	PING.EXE
2164	PING.EXE
2852	PING.EXE
1124	PING.EXE
1008	PING.EXE
1736	PING.EXE
2840	PING.EXE
2072	PING.EXE
268	PING.EXE
1744	PING.EXE
2404	PING.EXE
536	PING.EXE
3000	PING.EXE
2192	PING.EXE
1260	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2128	bc0ee3e54b30159aba15019a51197300_JaffaCakes118.exe
2128	bc0ee3e54b30159aba15019a51197300_JaffaCakes118.exe
2788	myccdd080721a.exe
2788	myccdd080721a.exe
2788	myccdd080721a.exe
2788	myccdd080721a.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2128	bc0ee3e54b30159aba15019a51197300_JaffaCakes118.exe
Token: SeDebugPrivilege	2788	myccdd080721a.exe
Token: SeDebugPrivilege	2788	myccdd080721a.exe
Token: SeDebugPrivilege	2788	myccdd080721a.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2272	2128	bc0ee3e54b30159aba15019a51197300_JaffaCakes118.exe	30
PID 2128 wrote to memory of 2272	2128	bc0ee3e54b30159aba15019a51197300_JaffaCakes118.exe	30
PID 2128 wrote to memory of 2272	2128	bc0ee3e54b30159aba15019a51197300_JaffaCakes118.exe	30
PID 2128 wrote to memory of 2272	2128	bc0ee3e54b30159aba15019a51197300_JaffaCakes118.exe	30
PID 2128 wrote to memory of 2272	2128	bc0ee3e54b30159aba15019a51197300_JaffaCakes118.exe	30
PID 2128 wrote to memory of 2272	2128	bc0ee3e54b30159aba15019a51197300_JaffaCakes118.exe	30
PID 2128 wrote to memory of 2272	2128	bc0ee3e54b30159aba15019a51197300_JaffaCakes118.exe	30
PID 2272 wrote to memory of 2772	2272	rundll32.exe	31
PID 2272 wrote to memory of 2772	2272	rundll32.exe	31
PID 2272 wrote to memory of 2772	2272	rundll32.exe	31
PID 2272 wrote to memory of 2772	2272	rundll32.exe	31
PID 2128 wrote to memory of 2836	2128	bc0ee3e54b30159aba15019a51197300_JaffaCakes118.exe	32
PID 2128 wrote to memory of 2836	2128	bc0ee3e54b30159aba15019a51197300_JaffaCakes118.exe	32
PID 2128 wrote to memory of 2836	2128	bc0ee3e54b30159aba15019a51197300_JaffaCakes118.exe	32
PID 2128 wrote to memory of 2836	2128	bc0ee3e54b30159aba15019a51197300_JaffaCakes118.exe	32
PID 2772 wrote to memory of 2788	2772	cmd.exe	35
PID 2772 wrote to memory of 2788	2772	cmd.exe	35
PID 2772 wrote to memory of 2788	2772	cmd.exe	35
PID 2772 wrote to memory of 2788	2772	cmd.exe	35
PID 2836 wrote to memory of 2996	2836	cmd.exe	36
PID 2836 wrote to memory of 2996	2836	cmd.exe	36
PID 2836 wrote to memory of 2996	2836	cmd.exe	36
PID 2836 wrote to memory of 2996	2836	cmd.exe	36
PID 2788 wrote to memory of 2888	2788	myccdd080721a.exe	37
PID 2788 wrote to memory of 2888	2788	myccdd080721a.exe	37
PID 2788 wrote to memory of 2888	2788	myccdd080721a.exe	37
PID 2788 wrote to memory of 2888	2788	myccdd080721a.exe	37
PID 2788 wrote to memory of 2888	2788	myccdd080721a.exe	37
PID 2788 wrote to memory of 2712	2788	myccdd080721a.exe	39
PID 2788 wrote to memory of 2712	2788	myccdd080721a.exe	39
PID 2788 wrote to memory of 2712	2788	myccdd080721a.exe	39
PID 2788 wrote to memory of 2712	2788	myccdd080721a.exe	39
PID 2712 wrote to memory of 3068	2712	cmd.exe	41
PID 2712 wrote to memory of 3068	2712	cmd.exe	41
PID 2712 wrote to memory of 3068	2712	cmd.exe	41
PID 2712 wrote to memory of 3068	2712	cmd.exe	41
PID 2712 wrote to memory of 2204	2712	cmd.exe	42
PID 2712 wrote to memory of 2204	2712	cmd.exe	42
PID 2712 wrote to memory of 2204	2712	cmd.exe	42
PID 2712 wrote to memory of 2204	2712	cmd.exe	42
PID 2712 wrote to memory of 1008	2712	cmd.exe	43
PID 2712 wrote to memory of 1008	2712	cmd.exe	43
PID 2712 wrote to memory of 1008	2712	cmd.exe	43
PID 2712 wrote to memory of 1008	2712	cmd.exe	43
PID 2712 wrote to memory of 1444	2712	cmd.exe	44
PID 2712 wrote to memory of 1444	2712	cmd.exe	44
PID 2712 wrote to memory of 1444	2712	cmd.exe	44
PID 2712 wrote to memory of 1444	2712	cmd.exe	44
PID 2712 wrote to memory of 268	2712	cmd.exe	45
PID 2712 wrote to memory of 268	2712	cmd.exe	45
PID 2712 wrote to memory of 268	2712	cmd.exe	45
PID 2712 wrote to memory of 268	2712	cmd.exe	45
PID 2712 wrote to memory of 2620	2712	cmd.exe	46
PID 2712 wrote to memory of 2620	2712	cmd.exe	46
PID 2712 wrote to memory of 2620	2712	cmd.exe	46
PID 2712 wrote to memory of 2620	2712	cmd.exe	46
PID 2712 wrote to memory of 2464	2712	cmd.exe	47
PID 2712 wrote to memory of 2464	2712	cmd.exe	47
PID 2712 wrote to memory of 2464	2712	cmd.exe	47
PID 2712 wrote to memory of 2464	2712	cmd.exe	47
PID 2712 wrote to memory of 772	2712	cmd.exe	48
PID 2712 wrote to memory of 772	2712	cmd.exe	48
PID 2712 wrote to memory of 772	2712	cmd.exe	48
PID 2712 wrote to memory of 772	2712	cmd.exe	48

C:\Users\Admin\AppData\Local\Temp\bc0ee3e54b30159aba15019a51197300_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bc0ee3e54b30159aba15019a51197300_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Windows\system32\mywcc080721.dll bgdll
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\downf.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Windows\SysWOW64\myccdd080721a.exe
      "C:\Windows\system32\myccdd080721a.exe" i
      4⤵
      Adds policy Run key to start application
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2788
    - - C:\program files\internet explorer\iexplore.exe
        
        "C:\program files\internet explorer\iexplore.exe"
        5⤵
        
        PID:2888
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "c:\nmDelm.bat"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2712
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3068
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2204
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1008
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1444
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:268
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2620
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2464
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:772
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1764
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1848
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2268
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2312
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1736
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1328
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:112
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3020
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:968
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:776
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2216
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1744
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1608
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1076
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1552
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2584
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1812
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1656
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1940
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2208
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2404
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2164
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:536
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2128
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2944
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2840
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3000
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2852
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2192
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1904
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1260
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1500
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1540
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:916
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2072
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1668
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1124
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1588
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2200
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "c:\nmDelm.bat"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\myccdd080721a.exe

Filesize
76KB

MD5
bc0ee3e54b30159aba15019a51197300

SHA1
b02627317e03b6c669922fccc42ff4eb9da95d1a

SHA256
02358ba4720c5de7691c9fb71e0cfa437f1c1bc0e856d9a207de563bb6b62b8a

SHA512
20b4d6ca2284a52b6198a4ae0699756599503aa41a079de4df4838882dd148b106a78de660e120abf0e586f18be437d32e0084be89dc4c6033450ad75d5bb798

Download Submit
C:\Windows\SysWOW64\mywcc080721.dll

Filesize
28KB

MD5
868feda0c9c6b32ac94b70fb19493b2b

SHA1
e59b08baa120a6f9b834844c9c2903662676e37c

SHA256
ae44365f29c76a748653f6f698624f7e1d7f6357a0b497833ca70264b1f34fb6

SHA512
7b4ad26f8dcc712cf7876969d489667e2598b92e4ea347f774b9234d5dda4984ad1d5f35572e3d0db4a06d656a16bcbcc18593b82537df04694b844ceedde048

Download Submit
C:\Windows\cc16.ini

Filesize
150B

MD5
dbda144b8729a84cca62b0f9d57610a7

SHA1
e749ebeedd1b953cf2da7cb6d53ff0b6fafe664b

SHA256
9c976bcf1b873d147c57fe3cfcb53251d2e33d37462124397013bf5204235a7f

SHA512
0c7ae7c802a78f67e12a5d8f1c97370be55f763bfdd1a38b5496f2165e842199031cee6129812f2ebc413a773820c9dc73db18e1d07f88bece36c84b4f3d9d9b

Download Submit
C:\Windows\cc16.ini

Filesize
464B

MD5
69b215aaf113a29d758b21745b0ca3ad

SHA1
649c572ed8f99b90ddc60ffe8160a6d27300a00e

SHA256
2d12634a8c6a79b050ac3097a9d3789b5aa456770b6c6001f4600d2d1ad4c91c

SHA512
a99cff16ca65b7fe9d3ad3a7aa1312df93d050f7fe508ab8adf31fcd703162298a6e076067fe22b8629234d7187a7cd3de7e9610e8fdb92c0c376a193877a9ce

Download Submit
C:\downf.bat

Filesize
51B

MD5
2b724c6a8fcd230311547ed4e1b9d68e

SHA1
10355c1441991688bde91b7c02688f308bf00915

SHA256
3f77676fa2c0553c11b7277adcd2666bba06e22d4ce39f0ff3c3245eff645a0e

SHA512
48215bac2db84c0445d5c4bd80abe13fbdf0f6750c4bad1306a01283362e2e97ab8992be597634b803bd12892c682615c637dcbae36c5441e50fea5346bb374d

Download Submit
\??\c:\nmDelm.bat

Filesize
139B

MD5
3a1bd2916250a4d03a63c8877a0098be

SHA1
fe761cbb2533906e4a6c5604a79d0c0bf94fd87f

SHA256
8183f9a2b8b37f4a70e5296c85d9fff3cba80a6950314d9900026dfc84a00a9d

SHA512
d1d03acc696e6b660ddb61c217665f5d202907e4548df4e17c92183490a2bc98c3cb9492a1e3aa678a17c5e8096ba05190c02e918aa4ca0123ca6e50e485e849

Download Submit
\??\c:\nmDelm.bat

Filesize
233B

MD5
84852456cb8bed92b1a703b43ca80e93

SHA1
3f72ba453f0abc410917d57c12c5951c1d020e61

SHA256
9398bc91ea704d880e143ed09303baa8a67ad33a0c8d1de30842c2a1948b2948

SHA512
8dff637d817c27887c562047c66813f6bee93e70ed3d3f3c10a8103d3e0c25b7c04a0d92bcfd5140eed721e1b812f3957228b0144fae9547df6505f0bf15f7e6

Download Submit
memory/2272-19-0x0000000000170000-0x000000000017D000-memory.dmp

Filesize
52KB

Download
memory/2272-42-0x0000000000170000-0x000000000017D000-memory.dmp

Filesize
52KB

Download
memory/2272-48-0x0000000000170000-0x000000000017D000-memory.dmp

Filesize
52KB

Download