ef0f4381dec9bcd2151456ea30f3aa92dd981919326b3ae2c6874bc06580cb65

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Size

141KB
MD5

d439c5ee84719dab3c6d9dd2ed0fbf87
SHA1

7e2efb25c2cff3d571852ae2387f69111eb3a4be
SHA256

ef0f4381dec9bcd2151456ea30f3aa92dd981919326b3ae2c6874bc06580cb65
SHA512

938d2e265c9f3bb43802f6a609ed1bd335bb2c08174eac46bd4e669b1f24d1bebf4b10f6a35d0cd077a4228434218af058502b2f3b66cc1b1363c7e4af10ea2b
SSDEEP

3072:iHGFw1IOjHVDwb2RUPjSm+TMdOfM/QA9GLsqfyc7G/BlYb:imF9s1kJ+K7/QmGLstcoB4

Score

7^/10

aspackv2 discovery persistence upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000b0000000122cf-1.dat	acprotect

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0006000000019246-6.dat	aspack_v212_v242

Loads dropped DLL 4 IoCs

pid	Process
2660	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
2660	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
2660	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
2660	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2660-5-0x0000000024DD0000-0x0000000024DF3000-memory.dmp	upx
behavioral1/files/0x000b0000000122cf-1.dat	upx
behavioral1/memory/2660-20-0x0000000024DD0000-0x0000000024DF3000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\WinSystem = "C:\\WINDOWS\\SYSTEM32\\d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\MSWINSCK.OCX	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MSSTDFMT.DLL	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MSSTDFMT.DLL	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MSWINSCK.OCX	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID\ = "MSWinsock.Winsock"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2B11E9B0-9F09-11D0-9484-00A0C91110ED}	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E675F3F0-91B5-11D0-9484-00A0C91110ED}\TypeLib	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSSTDFMT.StdDataFormat\ = "StdDataFormat Object"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{99FF4677-FFC3-11D0-BD02-00C04FC2FB86}\ProgID	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6B263850-900B-11D0-9484-00A0C91110ED}\1.0\ = "Microsoft Data Formatting Object Library"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6B263850-900B-11D0-9484-00A0C91110ED}\1.0\HELPDIR	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99FF4676-FFC3-11D0-BD02-00C04FC2FB86}	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D835690-900B-11D0-9484-00A0C91110ED}\Version\ = "1.0"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{699DDBCC-DC7E-11D0-BCF7-00C04FC2FB86}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSSTDFMT.DLL"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSSTDFMT.StdDataFormats.1\ = "StdDataFormats Object"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{99FF4676-FFC3-11D0-BD02-00C04FC2FB86}\ = "IStdDataFormatsDisp"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5DE7A180-91B1-11D0-9484-00A0C91110ED}\TypeLib	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSSTDFMT.StdDataFormat	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6B263850-900B-11D0-9484-00A0C91110ED}\1.0\0\win32	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E675F3F0-91B5-11D0-9484-00A0C91110ED}\TypeLib	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2B11E9B0-9F09-11D0-9484-00A0C91110ED}\ProgID	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\ = "Winsock General Property Page Object"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5DE7A180-91B1-11D0-9484-00A0C91110ED}\TypeLib\ = "{6B263850-900B-11D0-9484-00A0C91110ED}"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSSTDFMT.StdDataValue.1	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSSTDFMT.StdDataValue.1\ = "StdDataValue Object"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E675F3F0-91B5-11D0-9484-00A0C91110ED}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E675F3F0-91B5-11D0-9484-00A0C91110ED}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C2F13ED0-91B0-11D0-9484-00A0C91110ED}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSSTDFMT.StdDataFormat\CurVer	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E675F3F0-91B5-11D0-9484-00A0C91110ED}	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E675F3F0-91B5-11D0-9484-00A0C91110ED}\TypeLib\Version = "1.0"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{99FF4676-FFC3-11D0-BD02-00C04FC2FB86}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C2F13ED0-91B0-11D0-9484-00A0C91110ED}\ProxyStubClsid32	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99FF4676-FFC3-11D0-BD02-00C04FC2FB86}\TypeLib	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A1741EF6-FFC6-11D0-BD02-00C04FC2FB86}\ProxyStubClsid32	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{99FF4676-FFC3-11D0-BD02-00C04FC2FB86}\TypeLib\Version = "1.0"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99FF4676-FFC3-11D0-BD02-00C04FC2FB86}\ = "IStdDataFormatsDisp"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D835690-900B-11D0-9484-00A0C91110ED}\TypeLib\ = "{6B263850-900B-11D0-9484-00A0C91110ED}"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2B11E9B0-9F09-11D0-9484-00A0C91110ED}\Version\ = "1.0"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C2F13ED0-91B0-11D0-9484-00A0C91110ED}\TypeLib\ = "{6B263850-900B-11D0-9484-00A0C91110ED}"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C2F13ED0-91B0-11D0-9484-00A0C91110ED}\TypeLib\Version = "1.0"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1741EF6-FFC6-11D0-BD02-00C04FC2FB86}\TypeLib\Version = "1.0"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A1741EF6-FFC6-11D0-BD02-00C04FC2FB86}\ = "IDataFormatsDisp"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1741EF6-FFC6-11D0-BD02-00C04FC2FB86}	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C51B910-900B-11D0-9484-00A0C91110ED}	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D835690-900B-11D0-9484-00A0C91110ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSSTDFMT.DLL"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{699DDBCC-DC7E-11D0-BCF7-00C04FC2FB86}\ = "MSStdFmt Format Property Page Object"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5DE7A180-91B1-11D0-9484-00A0C91110ED}\ProxyStubClsid32	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C51B910-900B-11D0-9484-00A0C91110ED}\TypeLib\Version = "1.0"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0 (SP5)"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSSTDFMT.StdDataFormat.1	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5DE7A180-91B1-11D0-9484-00A0C91110ED}\ = "IStdDataValueDisp"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C2F13ED0-91B0-11D0-9484-00A0C91110ED}\ProxyStubClsid32	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6D835690-900B-11D0-9484-00A0C91110ED}\ProgID\ = "MSSTDFMT.StdDataFormat.1"	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2660	d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d439c5ee84719dab3c6d9dd2ed0fbf87_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\MSSTDFMT.DLL

Filesize
53KB

MD5
8315a1ad1052bf9449b156a0f11e1e2d

SHA1
61bb3b835cce1c13a877f98091067989538a28a7

SHA256
d6ca90635e92a9a61458e364a31da23ff70465ac6ff8f98ab5afbbfcd97f0533

SHA512
2e4bcfb2b8d1c89e3273384f55845779cd642c6c1be1db887c3eabe5cbf0abfccc9b472f084e748c08878454863bebc629c7704b7713ba0e87a23328b0d7ccf7

Download Submit
\Windows\SysWOW64\MSWINSCK.OCX

Filesize
96KB

MD5
15e15dad71e318db3cadbf3d86832ee7

SHA1
39571c1c320e14b81904194af65df1dc65a2ede7

SHA256
a52c6f44e987fa668d5f5e053223b357e60af58315854ac06465f804222149ab

SHA512
dcc58ad21ab8ee7a5afd642f119aa1088625a496bdb1b76ae20206b5c25e7921fd3446f841ee6df5cb5a7028a68b8d000b74fc295cf58ba6a26d20cb7a72eb38

Download Submit
memory/2660-5-0x0000000024DD0000-0x0000000024DF3000-memory.dmp

Filesize
140KB

Download
memory/2660-8-0x0000000022170000-0x000000002218F000-memory.dmp

Filesize
124KB

Download
memory/2660-17-0x00000000003D0000-0x00000000003EF000-memory.dmp

Filesize
124KB

Download
memory/2660-16-0x00000000003D0000-0x00000000003F3000-memory.dmp

Filesize
140KB

Download
memory/2660-20-0x0000000024DD0000-0x0000000024DF3000-memory.dmp

Filesize
140KB

Download
memory/2660-21-0x00000000003D0000-0x00000000003F3000-memory.dmp

Filesize
140KB

Download
memory/2660-23-0x0000000022170000-0x000000002218F000-memory.dmp

Filesize
124KB

Download
memory/2660-38-0x00000000003D0000-0x00000000003EF000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads