adda323ba6c6dff2b728907819ed779c56114a07a5ed07f9ac9bc08117fe0d08

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Size

1.7MB
MD5

c26dde74c4e50e22121b1ec50dd30417
SHA1

c2086ad96557af08bf3d406d0b40054fd8ce5465
SHA256

adda323ba6c6dff2b728907819ed779c56114a07a5ed07f9ac9bc08117fe0d08
SHA512

968563b793f2f01f0def5312fd79f0b5600a0034a2f2a771c39cf20f2ee37602aefe67a878f0fe8fdeff2ce5bb8df2916f6b15b1688be0fc01f7eab5160d6839
SSDEEP

3072:A4tngvlGPo7OmH2MGn8hEXRjCC1K0mKGVpeH:3ytGPyOetGnNXRj+Re

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\StubPath = "rundll32.exe C:\\Windows\\system32\\themeuichk.dll,ThemesSetupInstallCheck"	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\IconsBinary = 43003a005c00570069006e0064006f00770073005c00730079007300740065006d00330032005c006d0073006f0062006a006d006f006e002e006500780065000000	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\Version = "1,1,1,2"	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\ComponentID = "DOTNETFRAMEWORKS"	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\DontAsk = "2"	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\IsInstalled = "1"	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\ = "Themes Setup"	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe

Executes dropped EXE 36 IoCs

pid	Process
2816	procpptpsql.exe
2028	smss.exe
3008	smss.exe
4296	smss.exe
3004	smss.exe
3048	smss.exe
4000	smss.exe
2032	smss.exe
3656	smss.exe
3676	smss.exe
1900	smss.exe
1816	smss.exe
2644	smss.exe
2576	smss.exe
1072	smss.exe
2264	smss.exe
5024	smss.exe
3948	smss.exe
4828	smss.exe
3420	smss.exe
4272	smss.exe
3524	smss.exe
3588	smss.exe
4928	smss.exe
5040	smss.exe
3660	smss.exe
2228	smss.exe
1772	smss.exe
2032	smss.exe
4464	smss.exe
4708	smss.exe
3116	smss.exe
2976	smss.exe
1224	smss.exe
448	smss.exe
4556	smss.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ = "AcroIEHelperStub"	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\NoExplorer = "1"	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ipdhcpproc.exe	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\disppdblsa.exe	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msobjmon.exe	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\msobjmon.exe	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\svcdnsdhcp.exe	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\netsqldns.ocx	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ipdhcpproc.exe	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\disppdblsa.exe	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\svcdnsdhcp.exe	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\netsqldns.ocx	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msctfobj.exe	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\msctfobj.exe	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3920	2816	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	procpptpsql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ = "Adobe PDF Link Helper"	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\InprocServer32	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\InprocServer32\ThreadingModel = "Apartment"	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\VersionIndependentProgID	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\InprocServer32\ = "C:\\Windows\\SysWow64\\netsqldns.ocx"	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ProgID	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ProgID\ = "AcroIEHelperShim.AcroIEHelperShimObj.1"	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\VersionIndependentProgID\ = "AcroIEHelperShim.AcroIEHelperShimObj"	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeBackupPrivilege	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
Token: SeDebugPrivilege	2816	procpptpsql.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 2816	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe	94
PID 4320 wrote to memory of 2816	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe	94
PID 4320 wrote to memory of 2816	4320	c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe	94
PID 2816 wrote to memory of 3792	2816	procpptpsql.exe	95
PID 2816 wrote to memory of 3792	2816	procpptpsql.exe	95
PID 2816 wrote to memory of 3792	2816	procpptpsql.exe	95
PID 3792 wrote to memory of 2028	3792	cmd.exe	97
PID 3792 wrote to memory of 2028	3792	cmd.exe	97
PID 3792 wrote to memory of 2028	3792	cmd.exe	97
PID 3792 wrote to memory of 4520	3792	cmd.exe	101
PID 3792 wrote to memory of 4520	3792	cmd.exe	101
PID 3792 wrote to memory of 4520	3792	cmd.exe	101
PID 3792 wrote to memory of 3008	3792	cmd.exe	102
PID 3792 wrote to memory of 3008	3792	cmd.exe	102
PID 3792 wrote to memory of 3008	3792	cmd.exe	102
PID 3792 wrote to memory of 4952	3792	cmd.exe	106
PID 3792 wrote to memory of 4952	3792	cmd.exe	106
PID 3792 wrote to memory of 4952	3792	cmd.exe	106
PID 3792 wrote to memory of 4296	3792	cmd.exe	107
PID 3792 wrote to memory of 4296	3792	cmd.exe	107
PID 3792 wrote to memory of 4296	3792	cmd.exe	107
PID 3792 wrote to memory of 4956	3792	cmd.exe	108
PID 3792 wrote to memory of 4956	3792	cmd.exe	108
PID 3792 wrote to memory of 4956	3792	cmd.exe	108
PID 3792 wrote to memory of 3004	3792	cmd.exe	109
PID 3792 wrote to memory of 3004	3792	cmd.exe	109
PID 3792 wrote to memory of 3004	3792	cmd.exe	109
PID 3792 wrote to memory of 4776	3792	cmd.exe	110
PID 3792 wrote to memory of 4776	3792	cmd.exe	110
PID 3792 wrote to memory of 4776	3792	cmd.exe	110
PID 3792 wrote to memory of 3048	3792	cmd.exe	111
PID 3792 wrote to memory of 3048	3792	cmd.exe	111
PID 3792 wrote to memory of 3048	3792	cmd.exe	111
PID 3792 wrote to memory of 3624	3792	cmd.exe	112
PID 3792 wrote to memory of 3624	3792	cmd.exe	112
PID 3792 wrote to memory of 3624	3792	cmd.exe	112
PID 3792 wrote to memory of 4000	3792	cmd.exe	113
PID 3792 wrote to memory of 4000	3792	cmd.exe	113
PID 3792 wrote to memory of 4000	3792	cmd.exe	113
PID 3792 wrote to memory of 2148	3792	cmd.exe	115
PID 3792 wrote to memory of 2148	3792	cmd.exe	115
PID 3792 wrote to memory of 2148	3792	cmd.exe	115
PID 3792 wrote to memory of 2032	3792	cmd.exe	116
PID 3792 wrote to memory of 2032	3792	cmd.exe	116
PID 3792 wrote to memory of 2032	3792	cmd.exe	116
PID 3792 wrote to memory of 5008	3792	cmd.exe	121
PID 3792 wrote to memory of 5008	3792	cmd.exe	121
PID 3792 wrote to memory of 5008	3792	cmd.exe	121
PID 3792 wrote to memory of 3656	3792	cmd.exe	122
PID 3792 wrote to memory of 3656	3792	cmd.exe	122
PID 3792 wrote to memory of 3656	3792	cmd.exe	122
PID 3792 wrote to memory of 3772	3792	cmd.exe	128
PID 3792 wrote to memory of 3772	3792	cmd.exe	128
PID 3792 wrote to memory of 3772	3792	cmd.exe	128
PID 3792 wrote to memory of 3676	3792	cmd.exe	129
PID 3792 wrote to memory of 3676	3792	cmd.exe	129
PID 3792 wrote to memory of 3676	3792	cmd.exe	129
PID 3792 wrote to memory of 2408	3792	cmd.exe	130
PID 3792 wrote to memory of 2408	3792	cmd.exe	130
PID 3792 wrote to memory of 2408	3792	cmd.exe	130
PID 3792 wrote to memory of 1900	3792	cmd.exe	131
PID 3792 wrote to memory of 1900	3792	cmd.exe	131
PID 3792 wrote to memory of 1900	3792	cmd.exe	131
PID 3792 wrote to memory of 3404	3792	cmd.exe	132

Views/modifies file attributes 1 TTPs 34 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4004	attrib.exe
4776	attrib.exe
2148	attrib.exe
5008	attrib.exe
2352	attrib.exe
1600	attrib.exe
3348	attrib.exe
4956	attrib.exe
4460	attrib.exe
4452	attrib.exe
2628	attrib.exe
1624	attrib.exe
3404	attrib.exe
2640	attrib.exe
1180	attrib.exe
2632	attrib.exe
3004	attrib.exe
3648	attrib.exe
1016	attrib.exe
4520	attrib.exe
3624	attrib.exe
3772	attrib.exe
4980	attrib.exe
3888	attrib.exe
2408	attrib.exe
412	attrib.exe
3476	attrib.exe
404	attrib.exe
1400	attrib.exe
4324	attrib.exe
884	attrib.exe
4952	attrib.exe
2828	attrib.exe
1208	attrib.exe

C:\Users\Admin\AppData\Local\Temp\c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c26dde74c4e50e22121b1ec50dd30417_JaffaCakes118.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Users\Admin\AppData\Local\Temp\procpptpsql.exe
  "C:\Users\Admin\AppData\Local\Temp\procpptpsql.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\EE29.tmp.cmd "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2028
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3008
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4296
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3004
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3048
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4000
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2032
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3656
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3676
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1900
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1816
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:412
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2644
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1400
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      PID:2576
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      Views/modifies file attributes
      PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      PID:1072
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2264
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2352
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5024
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3948
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      PID:4828
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3420
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4272
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3524
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3588
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4928
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      Views/modifies file attributes
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5040
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      Views/modifies file attributes
      PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3660
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2228
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1208
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1772
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:884
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2032
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4464
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4708
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2640
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3116
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      Views/modifies file attributes
      PID:1180
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2976
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:404
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      PID:1224
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:448
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\PROCPP~1.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1016
  - - C:\Users\Admin\AppData\Local\Temp\smss.exe
      "C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 5
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 544
    3⤵
    - Program crash
    PID:3920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2816 -ip 2816
1⤵
PID:4424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\EE29.tmp.cmd

Filesize
168B

MD5
e7efc2c945a798b4dab3fe50f1524592

SHA1
0bb937ccd89e40c91c0e58b376873ef909fe805b

SHA256
624acac79fdcfe30592f5321b4ab73d360f393dbcdbe8daa50fcce63c710f5dc

SHA512
e75840979404587aa15fd4d1e46707c33e32dca086ca72c7666045e14191e29857d06dc8ba737e69925c71b2e2d6a5ee3b63c36ecd2f32ae515f85a985d8f257

Download Submit
C:\Users\Admin\AppData\Local\Temp\advsec32.dll

Filesize
4KB

MD5
3adea70969f52d365c119b3d25619de9

SHA1
d303a6ddd63ce993a8432f4daab5132732748843

SHA256
c9f5a19c7b11fd866483adc93aa5bc4bd3515bd995ca79297b227e3e5ef1a665

SHA512
c4d836fcbdab4c859a6fc0f849d1e41e98c7e23fc0fe0fe0a09cb68e9a57d60b2ae9ad46762d7a5e05db28d6179bd431ef179ee1f9ff016db74cc3b1d74ed7f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\procpptpsql.exe

Filesize
112KB

MD5
ddeeebb34da3deea82ea1f4ff4c894a5

SHA1
c1e229219e84203ba9e26f2917bd268656ff4716

SHA256
35f911365d14ff533acce7367c2ab74167a9beb7b4e8fd487f25b9db4d68f627

SHA512
30c0f41c311591f39f6441af7e872bc6e1954c5050f4977f417f5e07f7550480fff17994fedc79316d93f18236abb6b11ef44b8fcfa3f71f9086b34044ac52d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\smss.exe

Filesize
18KB

MD5
b3624dd758ccecf93a1226cef252ca12

SHA1
fcf4dad8c4ad101504b1bf47cbbddbac36b558a7

SHA256
4aaa74f294c15aeb37ada8185d0dead58bd87276a01a814abc0c4b40545bf2ef

SHA512
c613d18511b00fa25fc7b1bdde10d96debb42a99b5aaab9e9826538d0e229085bb371f0197f6b1086c4f9c605f01e71287ffc5442f701a95d67c232a5f031838

Download Submit
C:\Windows\SysWOW64\msobjmon.exe

Filesize
1.7MB

MD5
c26dde74c4e50e22121b1ec50dd30417

SHA1
c2086ad96557af08bf3d406d0b40054fd8ce5465

SHA256
adda323ba6c6dff2b728907819ed779c56114a07a5ed07f9ac9bc08117fe0d08

SHA512
968563b793f2f01f0def5312fd79f0b5600a0034a2f2a771c39cf20f2ee37602aefe67a878f0fe8fdeff2ce5bb8df2916f6b15b1688be0fc01f7eab5160d6839

Download Submit
memory/4320-0-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/4320-32-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download