Analysis
-
max time kernel
35s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
31-08-2024 18:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
21 signatures
150 seconds
General
-
Target
cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe
-
Size
384KB
-
MD5
cd5ef8ddb218d86280527236d0378e0e
-
SHA1
a5fe609dc4f94e1f96d57303b806a8119fbc1443
-
SHA256
ed76128b57ce0622a1a0f8f312ea3f21245a421060f3ec973a6272b3629e26e4
-
SHA512
df9d3c4c6916f13f0bb9df181f861c001c1153dd40fe3a51a767045eb44ba9ba1ac04eb1c441a3c1216bd624c427499204f139207eb7d0c0c0df57b68c28a40e
-
SSDEEP
6144:08k3xrhqUO3En8ly2UopRlMaoNjOR5GxXFHEOQgJb7a/MV/7O6V:ohrRw02UopRqaoNjOOvJfa/G/7OC
Malware Config
Extracted
Family
latentbot
C2
darkbluecomet.zapto.org
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe -
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
winupdate.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" winupdate.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile winupdate.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" winupdate.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
winupdate.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" winupdate.exe -
Processes:
winupdate.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winupdate.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid Process 2772 attrib.exe 2888 attrib.exe -
Executes dropped EXE 2 IoCs
Processes:
winupdate.exewinupdate.exepid Process 2824 winupdate.exe 2776 winupdate.exe -
Loads dropped DLL 8 IoCs
Processes:
cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exewinupdate.exewinupdate.exepid Process 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 2824 winupdate.exe 2824 winupdate.exe 2824 winupdate.exe 2824 winupdate.exe 2776 winupdate.exe 2776 winupdate.exe 2776 winupdate.exe -
Processes:
resource yara_rule behavioral1/memory/2024-8-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/2024-10-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/2024-4-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/2024-5-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/2024-9-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/2024-11-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/2024-12-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/2024-13-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/2024-29-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/2776-47-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/2776-42-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/2776-48-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/2776-52-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/2776-53-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/2776-51-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/2776-50-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/2776-49-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/2776-55-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/2776-54-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/2776-56-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/2776-57-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/2776-58-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/2776-59-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/2776-60-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/2776-61-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/2776-62-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/2776-63-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/2776-64-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/2776-65-0x0000000000400000-0x00000000004B9000-memory.dmp upx -
Processes:
winupdate.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winupdate.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exewinupdate.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" winupdate.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exewinupdate.exedescription pid Process procid_target PID 1612 set thread context of 2024 1612 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 30 PID 2824 set thread context of 2776 2824 winupdate.exe 40 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.execmd.exePING.EXEcd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.execmd.exeattrib.exewinupdate.exewinupdate.execd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exeattrib.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
Processes:
cmd.exePING.EXEpid Process 2892 cmd.exe 2712 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exewinupdate.exedescription pid Process Token: SeIncreaseQuotaPrivilege 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe Token: SeSecurityPrivilege 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe Token: SeSystemtimePrivilege 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe Token: SeBackupPrivilege 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe Token: SeRestorePrivilege 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe Token: SeShutdownPrivilege 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe Token: SeDebugPrivilege 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe Token: SeUndockPrivilege 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe Token: SeManageVolumePrivilege 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe Token: SeImpersonatePrivilege 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe Token: 33 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe Token: 34 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe Token: 35 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2776 winupdate.exe Token: SeSecurityPrivilege 2776 winupdate.exe Token: SeTakeOwnershipPrivilege 2776 winupdate.exe Token: SeLoadDriverPrivilege 2776 winupdate.exe Token: SeSystemProfilePrivilege 2776 winupdate.exe Token: SeSystemtimePrivilege 2776 winupdate.exe Token: SeProfSingleProcessPrivilege 2776 winupdate.exe Token: SeIncBasePriorityPrivilege 2776 winupdate.exe Token: SeCreatePagefilePrivilege 2776 winupdate.exe Token: SeBackupPrivilege 2776 winupdate.exe Token: SeRestorePrivilege 2776 winupdate.exe Token: SeShutdownPrivilege 2776 winupdate.exe Token: SeDebugPrivilege 2776 winupdate.exe Token: SeSystemEnvironmentPrivilege 2776 winupdate.exe Token: SeChangeNotifyPrivilege 2776 winupdate.exe Token: SeRemoteShutdownPrivilege 2776 winupdate.exe Token: SeUndockPrivilege 2776 winupdate.exe Token: SeManageVolumePrivilege 2776 winupdate.exe Token: SeImpersonatePrivilege 2776 winupdate.exe Token: SeCreateGlobalPrivilege 2776 winupdate.exe Token: 33 2776 winupdate.exe Token: 34 2776 winupdate.exe Token: 35 2776 winupdate.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exewinupdate.exewinupdate.exepid Process 1612 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 2824 winupdate.exe 2776 winupdate.exe -
Suspicious use of WriteProcessMemory 50 IoCs
Processes:
cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.execd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.execmd.execmd.exewinupdate.execmd.exedescription pid Process procid_target PID 1612 wrote to memory of 2024 1612 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 30 PID 1612 wrote to memory of 2024 1612 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 30 PID 1612 wrote to memory of 2024 1612 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 30 PID 1612 wrote to memory of 2024 1612 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 30 PID 1612 wrote to memory of 2024 1612 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 30 PID 1612 wrote to memory of 2024 1612 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 30 PID 1612 wrote to memory of 2024 1612 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 30 PID 1612 wrote to memory of 2024 1612 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 30 PID 2024 wrote to memory of 2844 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 31 PID 2024 wrote to memory of 2844 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 31 PID 2024 wrote to memory of 2844 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 31 PID 2024 wrote to memory of 2844 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 31 PID 2024 wrote to memory of 2848 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 32 PID 2024 wrote to memory of 2848 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 32 PID 2024 wrote to memory of 2848 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 32 PID 2024 wrote to memory of 2848 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 32 PID 2844 wrote to memory of 2772 2844 cmd.exe 35 PID 2844 wrote to memory of 2772 2844 cmd.exe 35 PID 2844 wrote to memory of 2772 2844 cmd.exe 35 PID 2844 wrote to memory of 2772 2844 cmd.exe 35 PID 2848 wrote to memory of 2888 2848 cmd.exe 36 PID 2848 wrote to memory of 2888 2848 cmd.exe 36 PID 2848 wrote to memory of 2888 2848 cmd.exe 36 PID 2848 wrote to memory of 2888 2848 cmd.exe 36 PID 2024 wrote to memory of 2824 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 37 PID 2024 wrote to memory of 2824 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 37 PID 2024 wrote to memory of 2824 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 37 PID 2024 wrote to memory of 2824 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 37 PID 2024 wrote to memory of 2824 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 37 PID 2024 wrote to memory of 2824 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 37 PID 2024 wrote to memory of 2824 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 37 PID 2024 wrote to memory of 2892 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 38 PID 2024 wrote to memory of 2892 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 38 PID 2024 wrote to memory of 2892 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 38 PID 2024 wrote to memory of 2892 2024 cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe 38 PID 2824 wrote to memory of 2776 2824 winupdate.exe 40 PID 2824 wrote to memory of 2776 2824 winupdate.exe 40 PID 2824 wrote to memory of 2776 2824 winupdate.exe 40 PID 2824 wrote to memory of 2776 2824 winupdate.exe 40 PID 2824 wrote to memory of 2776 2824 winupdate.exe 40 PID 2824 wrote to memory of 2776 2824 winupdate.exe 40 PID 2824 wrote to memory of 2776 2824 winupdate.exe 40 PID 2824 wrote to memory of 2776 2824 winupdate.exe 40 PID 2824 wrote to memory of 2776 2824 winupdate.exe 40 PID 2824 wrote to memory of 2776 2824 winupdate.exe 40 PID 2824 wrote to memory of 2776 2824 winupdate.exe 40 PID 2892 wrote to memory of 2712 2892 cmd.exe 41 PID 2892 wrote to memory of 2712 2892 cmd.exe 41 PID 2892 wrote to memory of 2712 2892 cmd.exe 41 PID 2892 wrote to memory of 2712 2892 cmd.exe 41 -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid Process 2888 attrib.exe 2772 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe" +s +h3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe" +s +h4⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2772
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2888
-
-
-
C:\Windupdt\winupdate.exe"C:\Windupdt\winupdate.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windupdt\winupdate.exeC:\Windupdt\winupdate.exe4⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2776
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Users\Admin\AppData\Local\Temp\cd5ef8ddb218d86280527236d0378e0e_JaffaCakes118.exe"3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 54⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2712
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
384KB
MD5cd5ef8ddb218d86280527236d0378e0e
SHA1a5fe609dc4f94e1f96d57303b806a8119fbc1443
SHA256ed76128b57ce0622a1a0f8f312ea3f21245a421060f3ec973a6272b3629e26e4
SHA512df9d3c4c6916f13f0bb9df181f861c001c1153dd40fe3a51a767045eb44ba9ba1ac04eb1c441a3c1216bd624c427499204f139207eb7d0c0c0df57b68c28a40e