Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 18:34
Static task
static1
Behavioral task
behavioral1
Sample
d0347723c7ba325427fac0ef2ab767c6_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
d0347723c7ba325427fac0ef2ab767c6_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
d0347723c7ba325427fac0ef2ab767c6_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
d0347723c7ba325427fac0ef2ab767c6
-
SHA1
a2134975f712ed70e623435622d927148f541ed1
-
SHA256
148a7a6f346d42e6320a2c178c4e09ccdb0ab5b0c3230cd9ae60bf89815c94d8
-
SHA512
74422a588731e3eb619e7e44ce3e2d06f005b6bd87143a8d5b960b2793e80cce8bc43968211a33ae3dbf71873194c510b2a4d74bf2dcd67ec3425f4e55e116d4
-
SSDEEP
24576:0bSaE4mvt/K9iXC3oXezgLk8lKTqVxMot:0bSv4mvU9iXXXeEn
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2632 Setup.exe 2308 dicabfdggg.exe -
Loads dropped DLL 10 IoCs
pid Process 2632 Setup.exe 2632 Setup.exe 2632 Setup.exe 2408 WerFault.exe 2408 WerFault.exe 2408 WerFault.exe 2408 WerFault.exe 2408 WerFault.exe 2408 WerFault.exe 2408 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2408 2308 WerFault.exe 33 -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dicabfdggg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe -
NSIS installer 2 IoCs
resource yara_rule behavioral1/files/0x0005000000004ed7-30.dat nsis_installer_1 behavioral1/files/0x0005000000004ed7-30.dat nsis_installer_2 -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81 d0347723c7ba325427fac0ef2ab767c6_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 0f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce09000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c01400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748501d00000001000000100000005b3b67000eeb80022e42605b6b3b72400b000000010000000e000000740068006100770074006500000003000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b812000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 d0347723c7ba325427fac0ef2ab767c6_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d03000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b810b000000010000000e00000074006800610077007400650000001d00000001000000100000005b3b67000eeb80022e42605b6b3b72401400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb57485053000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce2000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 d0347723c7ba325427fac0ef2ab767c6_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 0400000001000000100000008ccadc0b22cef5be72ac411a11a8d8120f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce09000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c01400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748501d00000001000000100000005b3b67000eeb80022e42605b6b3b72400b000000010000000e000000740068006100770074006500000003000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b81190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d2000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 d0347723c7ba325427fac0ef2ab767c6_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2180 d0347723c7ba325427fac0ef2ab767c6_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2180 d0347723c7ba325427fac0ef2ab767c6_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2228 wmic.exe Token: SeSecurityPrivilege 2228 wmic.exe Token: SeTakeOwnershipPrivilege 2228 wmic.exe Token: SeLoadDriverPrivilege 2228 wmic.exe Token: SeSystemProfilePrivilege 2228 wmic.exe Token: SeSystemtimePrivilege 2228 wmic.exe Token: SeProfSingleProcessPrivilege 2228 wmic.exe Token: SeIncBasePriorityPrivilege 2228 wmic.exe Token: SeCreatePagefilePrivilege 2228 wmic.exe Token: SeBackupPrivilege 2228 wmic.exe Token: SeRestorePrivilege 2228 wmic.exe Token: SeShutdownPrivilege 2228 wmic.exe Token: SeDebugPrivilege 2228 wmic.exe Token: SeSystemEnvironmentPrivilege 2228 wmic.exe Token: SeRemoteShutdownPrivilege 2228 wmic.exe Token: SeUndockPrivilege 2228 wmic.exe Token: SeManageVolumePrivilege 2228 wmic.exe Token: 33 2228 wmic.exe Token: 34 2228 wmic.exe Token: 35 2228 wmic.exe Token: SeIncreaseQuotaPrivilege 2228 wmic.exe Token: SeSecurityPrivilege 2228 wmic.exe Token: SeTakeOwnershipPrivilege 2228 wmic.exe Token: SeLoadDriverPrivilege 2228 wmic.exe Token: SeSystemProfilePrivilege 2228 wmic.exe Token: SeSystemtimePrivilege 2228 wmic.exe Token: SeProfSingleProcessPrivilege 2228 wmic.exe Token: SeIncBasePriorityPrivilege 2228 wmic.exe Token: SeCreatePagefilePrivilege 2228 wmic.exe Token: SeBackupPrivilege 2228 wmic.exe Token: SeRestorePrivilege 2228 wmic.exe Token: SeShutdownPrivilege 2228 wmic.exe Token: SeDebugPrivilege 2228 wmic.exe Token: SeSystemEnvironmentPrivilege 2228 wmic.exe Token: SeRemoteShutdownPrivilege 2228 wmic.exe Token: SeUndockPrivilege 2228 wmic.exe Token: SeManageVolumePrivilege 2228 wmic.exe Token: 33 2228 wmic.exe Token: 34 2228 wmic.exe Token: 35 2228 wmic.exe Token: SeIncreaseQuotaPrivilege 2368 wmic.exe Token: SeSecurityPrivilege 2368 wmic.exe Token: SeTakeOwnershipPrivilege 2368 wmic.exe Token: SeLoadDriverPrivilege 2368 wmic.exe Token: SeSystemProfilePrivilege 2368 wmic.exe Token: SeSystemtimePrivilege 2368 wmic.exe Token: SeProfSingleProcessPrivilege 2368 wmic.exe Token: SeIncBasePriorityPrivilege 2368 wmic.exe Token: SeCreatePagefilePrivilege 2368 wmic.exe Token: SeBackupPrivilege 2368 wmic.exe Token: SeRestorePrivilege 2368 wmic.exe Token: SeShutdownPrivilege 2368 wmic.exe Token: SeDebugPrivilege 2368 wmic.exe Token: SeSystemEnvironmentPrivilege 2368 wmic.exe Token: SeRemoteShutdownPrivilege 2368 wmic.exe Token: SeUndockPrivilege 2368 wmic.exe Token: SeManageVolumePrivilege 2368 wmic.exe Token: 33 2368 wmic.exe Token: 34 2368 wmic.exe Token: 35 2368 wmic.exe Token: SeIncreaseQuotaPrivilege 1980 wmic.exe Token: SeSecurityPrivilege 1980 wmic.exe Token: SeTakeOwnershipPrivilege 1980 wmic.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2632 2180 d0347723c7ba325427fac0ef2ab767c6_JaffaCakes118.exe 32 PID 2180 wrote to memory of 2632 2180 d0347723c7ba325427fac0ef2ab767c6_JaffaCakes118.exe 32 PID 2180 wrote to memory of 2632 2180 d0347723c7ba325427fac0ef2ab767c6_JaffaCakes118.exe 32 PID 2180 wrote to memory of 2632 2180 d0347723c7ba325427fac0ef2ab767c6_JaffaCakes118.exe 32 PID 2180 wrote to memory of 2632 2180 d0347723c7ba325427fac0ef2ab767c6_JaffaCakes118.exe 32 PID 2180 wrote to memory of 2632 2180 d0347723c7ba325427fac0ef2ab767c6_JaffaCakes118.exe 32 PID 2180 wrote to memory of 2632 2180 d0347723c7ba325427fac0ef2ab767c6_JaffaCakes118.exe 32 PID 2632 wrote to memory of 2308 2632 Setup.exe 33 PID 2632 wrote to memory of 2308 2632 Setup.exe 33 PID 2632 wrote to memory of 2308 2632 Setup.exe 33 PID 2632 wrote to memory of 2308 2632 Setup.exe 33 PID 2632 wrote to memory of 2308 2632 Setup.exe 33 PID 2632 wrote to memory of 2308 2632 Setup.exe 33 PID 2632 wrote to memory of 2308 2632 Setup.exe 33 PID 2308 wrote to memory of 2228 2308 dicabfdggg.exe 34 PID 2308 wrote to memory of 2228 2308 dicabfdggg.exe 34 PID 2308 wrote to memory of 2228 2308 dicabfdggg.exe 34 PID 2308 wrote to memory of 2228 2308 dicabfdggg.exe 34 PID 2308 wrote to memory of 2368 2308 dicabfdggg.exe 37 PID 2308 wrote to memory of 2368 2308 dicabfdggg.exe 37 PID 2308 wrote to memory of 2368 2308 dicabfdggg.exe 37 PID 2308 wrote to memory of 2368 2308 dicabfdggg.exe 37 PID 2308 wrote to memory of 1980 2308 dicabfdggg.exe 39 PID 2308 wrote to memory of 1980 2308 dicabfdggg.exe 39 PID 2308 wrote to memory of 1980 2308 dicabfdggg.exe 39 PID 2308 wrote to memory of 1980 2308 dicabfdggg.exe 39 PID 2308 wrote to memory of 1576 2308 dicabfdggg.exe 41 PID 2308 wrote to memory of 1576 2308 dicabfdggg.exe 41 PID 2308 wrote to memory of 1576 2308 dicabfdggg.exe 41 PID 2308 wrote to memory of 1576 2308 dicabfdggg.exe 41 PID 2308 wrote to memory of 1736 2308 dicabfdggg.exe 43 PID 2308 wrote to memory of 1736 2308 dicabfdggg.exe 43 PID 2308 wrote to memory of 1736 2308 dicabfdggg.exe 43 PID 2308 wrote to memory of 1736 2308 dicabfdggg.exe 43 PID 2308 wrote to memory of 2408 2308 dicabfdggg.exe 45 PID 2308 wrote to memory of 2408 2308 dicabfdggg.exe 45 PID 2308 wrote to memory of 2408 2308 dicabfdggg.exe 45 PID 2308 wrote to memory of 2408 2308 dicabfdggg.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0347723c7ba325427fac0ef2ab767c6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d0347723c7ba325427fac0ef2ab767c6_JaffaCakes118.exe"1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\dicabfdggg.exeC:\Users\Admin\AppData\Local\Temp\dicabfdggg.exe 4-4-6-5-6-4-4-4-0-5-6 K0xDPzctLy42MBorT089SkVAOTAbKUpBTlJJTkdFRDgrHCs+RE1QRUA9LDI1MyobKT9FQD0rGitMTEo+UT9QX0Q+OS0yLCw1HCtTQExSQUxaT05IOWhvbmw2KSptYW5yLm9iYSlba2opYF10XChlamBqGis/SEk+RUVANxspQC05Mi0aK0AsOCctHCtELjcpLRoqPjA5KTEbKUAxNygrHCtMUko+UT9OWkpORVJBPlM5HClLTEtAUUNPWUFRRjw3HCtMUko+UT9OWkg9SUE9SV90cW0gLCwuITIrPl1qXWAfLixLcl5iYW9ubVshLixFc2pdam1kaWocK0VTP1tRTEc3HCtBWEBZP0k+R0NKQTkgKkJLT05aPE5LU1NATDkxGipORD1KS1RJUVtPTUY5HCtWSDcuHCk/TS05HC9NT0pQQ0g/W1NBTD5JSUFDSDtDQVFSRzccK0NOWU5RSlRER0E5bm1vYRwrUkBOUU5IREhDW1FTQExbQDtUTTkuHC9DQ0BBUjgrHCtFU1o+VUo7SEM/W0FOPkxVTE5APjliXWxuXxwrPkpRSkhLQT9ZRUw3NDAqMi0uLC8wKi0bKVBFSUU4KzAuLzIyNSwsMBspQEtRSUZLPUBfT0NJQTcuKTQrLjAsLyYwNC4qNiwsKjxH3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81725647707.txt bios get serialnumber4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2228
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81725647707.txt bios get version4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2368
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81725647707.txt bios get version4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1980
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81725647707.txt bios get version4⤵
- System Location Discovery: System Language Discovery
PID:1576
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81725647707.txt bios get version4⤵
- System Location Discovery: System Language Discovery
PID:1736
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 3684⤵
- Loads dropped DLL
- Program crash
PID:2408
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
611KB
MD5fe1092df4e51cb9f228d799a9219e815
SHA1cb2eab4143ff8ceca124336d62e846e5868a9833
SHA25636e0752e2a0c0c0278e6d6622178a8d2d79b586381240e2fd523d36ad6d0d595
SHA51239bcacfb95000fb26c2507515aa2f7997b68c80cd291e55c15424cc6f476803ca2ddda7246a2b6c9970542fd2fad18ef80eeb6b6622bb0b956751dc2d8d4aeb0
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
809KB
MD590b37db200fc4271fa39f26d964a824e
SHA163d47a0f1ee2e2528883026727a9eb35e409952e
SHA2560434a70c94271eee0d6bf9d26a7833b3ec8246e5d6e115ef391e9bd0df0bbfde
SHA5125fdeaf0ace86707e3aedb2c3e370f1b5656f95d57bb264a748775015de066fd532c7214e381ed8497ab23c33c2083bd09f31294af9808024aeb4dbe68e6495f2
-
Filesize
152KB
MD5b3949e4f3df2c377954eb4d84888281f
SHA1336d6f5735446cf759440fb8aa86d0e550b7f1b8
SHA256c62b0147b8482e17ad56236c485f535c63d0efc78571adb094e1e2c6b8d9741b
SHA51289249f3f036e59f910a752be87457497b6d16e5c3feddb289059a0f9bc14ffe2bfc75d743fbe727acfb60dd6b8d53270edd1020b106e65dee7ccdb5b641f6e7f
-
Filesize
40KB
MD55f13dbc378792f23e598079fc1e4422b
SHA15813c05802f15930aa860b8363af2b58426c8adf
SHA2566e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d
SHA5129270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5