adwind | 6cd8339bef4fddc4797b25af902caa74907fc95b97c1e07ab024fd9f70d07894

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10-09-2024 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d87bda9120de373ab47fe445b99b6298_JaffaCakes118.exe
Size

2.2MB
MD5

d87bda9120de373ab47fe445b99b6298
SHA1

0bb96c96b0d5ecec102a61ade898065b39f89e1a
SHA256

6cd8339bef4fddc4797b25af902caa74907fc95b97c1e07ab024fd9f70d07894
SHA512

314f2985929855f290ab40442570c9474f3dc9370f579ed7132a21bb41995806d99ac4ea45021058a413e784b0f88200663a35544e7a6c75a1bf2b7119a7315c
SSDEEP

49152:qmFEuV35cn/aEvVUi8ZJ29SerQdbZmN1XXWJl+dK6a1r+YOpFLyqf3nCSii:qyLOifkwerWe1XXMEdvU+zF+qfSz

Score

10^/10

adwind lokibot xtremerat collection credential_access discovery evasion persistence rat spyware stealer trojan upx

Malware Config

Extracted

Family

xtremerat

iaficasioo.zapto.org

Signatures

AdWind
A Java-based RAT family operated as malware-as-a-service.
trojan adwind

Class file contains resources related to AdWind 1 IoCs

resource	yara_rule
sample	family_adwind5

Detect XtremeRAT payload 30 IoCs

resource	yara_rule
behavioral2/files/0x001200000002345f-18.dat	family_xtremerat
behavioral2/memory/2756-38-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat
behavioral2/memory/2284-41-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat
behavioral2/memory/2284-48-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat
behavioral2/memory/4680-64-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat
behavioral2/memory/4680-65-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat
behavioral2/memory/2444-90-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat
behavioral2/memory/2444-95-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat
behavioral2/memory/1076-220-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat
behavioral2/memory/1076-351-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat
behavioral2/memory/2340-558-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat
behavioral2/memory/2340-661-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat
behavioral2/memory/2884-897-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat
behavioral2/memory/2884-943-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat
behavioral2/memory/2776-991-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat
behavioral2/memory/2776-992-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat
behavioral2/memory/4364-1006-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat
behavioral2/memory/4432-1010-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat
behavioral2/memory/4432-1011-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat
behavioral2/memory/3252-1111-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat
behavioral2/memory/3252-1120-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat
behavioral2/memory/4904-1140-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat
behavioral2/memory/4904-1142-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat
behavioral2/memory/1568-1150-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat
behavioral2/memory/1568-1152-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat
behavioral2/memory/2168-1153-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat
behavioral2/memory/2168-1154-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat
behavioral2/memory/3152-1157-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat
behavioral2/memory/3152-1158-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat
behavioral2/memory/2980-1177-0x0000000000C80000-0x0000000000D10000-memory.dmp	family_xtremerat

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	regedit.exe

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K5VVB854-OYR7-D8JQ-5HC0-X32C3UKV4ROA}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{K5VVB854-OYR7-D8JQ-5HC0-X32C3UKV4ROA}	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K5VVB854-OYR7-D8JQ-5HC0-X32C3UKV4ROA}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{K5VVB854-OYR7-D8JQ-5HC0-X32C3UKV4ROA}	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K5VVB854-OYR7-D8JQ-5HC0-X32C3UKV4ROA}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	Server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{K5VVB854-OYR7-D8JQ-5HC0-X32C3UKV4ROA}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{K5VVB854-OYR7-D8JQ-5HC0-X32C3UKV4ROA}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{K5VVB854-OYR7-D8JQ-5HC0-X32C3UKV4ROA}	Server.exe

Disables Task Manager via registry modification
evasion
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Bav.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VIEWTCP.EXE\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FSHDLL64.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsgk32.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKWCtlx64.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiESNAC.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clamscan.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MWAGENT.EXE\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scproxysrv.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PtSessionAgent.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvcod.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BavUpdater.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiSSLVPNdaemon.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\filwscc.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamscheduler.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClamWin.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\econceal.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\freshclamwrap.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7RTScan.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSUAMain.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiProxy.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdAwareService.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TRAYICOS.EXE	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsorsp.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trigger.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7TSMngr.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uiSeAgnt.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WebCompanion.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\econser.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKProxy.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDScan.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fcappdb.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiTray.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cavwp.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fshoster32.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvc.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utsvc.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7SysMon.Exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SAPISSVC.EXE\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utsvc.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FilUp.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvcsvc.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nseupdatesvc.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ScSecSvc.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDTray.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SBAMTray.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UnThreat.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClamTray.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iptray.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nwscmon.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OPSSVC.EXE\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7EmlPxy.EXE\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7TSecurity.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvc.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SBAMSvc.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanpro.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FSHDLL64.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FProtTray.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BavSvc.exe\debugger = "svchost.exe"	regedit.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	d87bda9120de373ab47fe445b99b6298_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	server.exe

Executes dropped EXE 9 IoCs

pid	Process
4364	server.exe
1400	358saxio.exe
2872	Server.exe
4768	javaw.exe
3388	java.exe
2676	Server.exe
4860	358saxio.exe
4976	358saxio.exe
4620	358saxio.exe

Loads dropped DLL 24 IoCs

pid	Process
4768	javaw.exe
4768	javaw.exe
4768	javaw.exe
4768	javaw.exe
4768	javaw.exe
4768	javaw.exe
4768	javaw.exe
4768	javaw.exe
4768	javaw.exe
3388	java.exe
3388	java.exe
3388	java.exe
3388	java.exe
3388	java.exe
3388	java.exe
3388	java.exe
4768	javaw.exe
3388	java.exe
4768	javaw.exe
3388	java.exe
3388	java.exe
3388	java.exe
4768	javaw.exe
3388	java.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4660-0-0x0000000000400000-0x0000000000876000-memory.dmp	upx
behavioral2/memory/4660-2-0x0000000000400000-0x0000000000876000-memory.dmp	upx
behavioral2/memory/4660-14-0x0000000000400000-0x0000000000876000-memory.dmp	upx
behavioral2/files/0x00070000000235a6-999.dat	upx
behavioral2/memory/1400-1003-0x0000000000400000-0x0000000000515000-memory.dmp	upx
behavioral2/memory/1400-1201-0x0000000000400000-0x0000000000515000-memory.dmp	upx
behavioral2/memory/4860-1231-0x0000000000400000-0x0000000000515000-memory.dmp	upx
behavioral2/memory/4976-1244-0x0000000000400000-0x0000000000515000-memory.dmp	upx
behavioral2/memory/1400-1279-0x0000000000400000-0x0000000000515000-memory.dmp	upx
behavioral2/memory/4860-1317-0x0000000000400000-0x0000000000515000-memory.dmp	upx
behavioral2/memory/4976-1319-0x0000000000400000-0x0000000000515000-memory.dmp	upx

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	358saxio.exe
Key opened	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	358saxio.exe
Key opened	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	358saxio.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sVCHXnbVdLZ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\JbWWIoBadTZ\\lHhuTzdHfZG.ZDwmik\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\358saxio.exe = "C:\\Users\\Admin\\AppData\\Roaming/Microsoft/Skype.exe"	358saxio.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\358saxio.exe = "C:\\Users\\Admin\\AppData\\Roaming/Microsoft/Skype.exe"	358saxio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d87bda9120de373ab47fe445b99b6298_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Roaming/Microsoft/Skype.exe"	d87bda9120de373ab47fe445b99b6298_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\358saxio.exe = "C:\\Users\\Admin\\AppData\\Roaming/Microsoft/Skype.exe"	358saxio.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\test.txt	javaw.exe
File opened for modification	C:\Windows\System32\test.txt	java.exe
File created	C:\Windows\System32\test.txt	javaw.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4660 set thread context of 4040	4660	d87bda9120de373ab47fe445b99b6298_JaffaCakes118.exe	96
PID 1400 set thread context of 4620	1400	358saxio.exe	230

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\	server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	Server.exe
File opened for modification	C:\Windows\InstallDir\	Server.exe
File opened for modification	C:\Windows\InstallDir\Server.exe	server.exe
File created	C:\Windows\InstallDir\Server.exe	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	358saxio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	358saxio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d87bda9120de373ab47fe445b99b6298_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	358saxio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	358saxio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d87bda9120de373ab47fe445b99b6298_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Kills process with taskkill 64 IoCs

evasion

pid	Process
2116	taskkill.exe
3752	taskkill.exe
4236	taskkill.exe
4028	taskkill.exe
3772	taskkill.exe
3572	taskkill.exe
3980	taskkill.exe
880	taskkill.exe
1020	taskkill.exe
3180	taskkill.exe
2676	taskkill.exe
4408	taskkill.exe
2272	taskkill.exe
4860	taskkill.exe
884	taskkill.exe
4796	taskkill.exe
1972	taskkill.exe
3708	taskkill.exe
1484	taskkill.exe
4496	taskkill.exe
3120	taskkill.exe
800	taskkill.exe
4820	taskkill.exe
3928	taskkill.exe
944	taskkill.exe
64	taskkill.exe
1216	taskkill.exe
4236	taskkill.exe
4636	taskkill.exe
4644	taskkill.exe
3308	taskkill.exe
3360	taskkill.exe
3792	taskkill.exe
4308	taskkill.exe
3280	taskkill.exe
3856	taskkill.exe
2884	taskkill.exe
3752	taskkill.exe
4060	taskkill.exe
3024	taskkill.exe
944	taskkill.exe
3436	taskkill.exe
3252	taskkill.exe
2024	taskkill.exe
3584	taskkill.exe
3816	taskkill.exe
840	taskkill.exe
4912	taskkill.exe
2588	taskkill.exe
3136	taskkill.exe
3948	taskkill.exe
3152	taskkill.exe
3708	taskkill.exe
4108	taskkill.exe
4672	taskkill.exe
4820	taskkill.exe
3368	taskkill.exe
2124	taskkill.exe
4664	taskkill.exe
3856	taskkill.exe
4968	taskkill.exe
388	taskkill.exe
4100	taskkill.exe
3796	taskkill.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	d87bda9120de373ab47fe445b99b6298_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
5100	reg.exe

Runs .reg file with regedit 1 IoCs

pid	Process
2724	regedit.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	804	taskkill.exe
Token: SeDebugPrivilege	3856	taskkill.exe
Token: SeDebugPrivilege	1812	taskkill.exe
Token: SeDebugPrivilege	3308	taskkill.exe
Token: SeDebugPrivilege	5116	taskkill.exe
Token: SeDebugPrivilege	3584	taskkill.exe
Token: SeDebugPrivilege	4384	taskkill.exe
Token: SeDebugPrivilege	3180	taskkill.exe
Token: SeDebugPrivilege	4432	taskkill.exe
Token: SeDebugPrivilege	2960	taskkill.exe
Token: SeDebugPrivilege	3572	taskkill.exe
Token: SeDebugPrivilege	1216	taskkill.exe
Token: SeDebugPrivilege	4060	taskkill.exe
Token: SeDebugPrivilege	3592	taskkill.exe
Token: SeDebugPrivilege	4204	taskkill.exe
Token: SeDebugPrivilege	3796	taskkill.exe
Token: SeDebugPrivilege	2116	taskkill.exe
Token: SeDebugPrivilege	3024	taskkill.exe
Token: SeDebugPrivilege	4128	taskkill.exe
Token: SeDebugPrivilege	3360	taskkill.exe
Token: SeDebugPrivilege	3928	taskkill.exe
Token: SeDebugPrivilege	4620	358saxio.exe
Token: SeDebugPrivilege	5084	taskkill.exe
Token: SeDebugPrivilege	4236	taskkill.exe
Token: SeDebugPrivilege	3752	taskkill.exe
Token: SeDebugPrivilege	4968	taskkill.exe
Token: SeDebugPrivilege	4660	taskkill.exe
Token: SeDebugPrivilege	4912	taskkill.exe
Token: SeDebugPrivilege	3120	taskkill.exe
Token: SeDebugPrivilege	944	taskkill.exe
Token: SeDebugPrivilege	3024	taskkill.exe
Token: SeDebugPrivilege	3244	taskkill.exe
Token: SeDebugPrivilege	3772	taskkill.exe
Token: SeDebugPrivilege	880	taskkill.exe
Token: SeDebugPrivilege	5100	taskkill.exe
Token: SeDebugPrivilege	5048	taskkill.exe
Token: SeDebugPrivilege	5080	taskkill.exe
Token: SeDebugPrivilege	2824	taskkill.exe
Token: SeDebugPrivilege	3436	taskkill.exe
Token: SeDebugPrivilege	3592	taskkill.exe
Token: SeDebugPrivilege	4860	taskkill.exe
Token: SeDebugPrivilege	1976	taskkill.exe
Token: SeDebugPrivilege	4028	taskkill.exe
Token: SeDebugPrivilege	884	taskkill.exe
Token: SeDebugPrivilege	3628	taskkill.exe
Token: SeDebugPrivilege	3792	taskkill.exe
Token: SeDebugPrivilege	2676	taskkill.exe
Token: SeDebugPrivilege	1064	taskkill.exe
Token: SeDebugPrivilege	4820	taskkill.exe
Token: SeDebugPrivilege	4408	taskkill.exe
Token: SeDebugPrivilege	4568	taskkill.exe
Token: SeDebugPrivilege	4108	taskkill.exe
Token: SeDebugPrivilege	4968	taskkill.exe
Token: SeDebugPrivilege	388	taskkill.exe
Token: SeDebugPrivilege	4636	taskkill.exe
Token: SeDebugPrivilege	4308	taskkill.exe
Token: SeDebugPrivilege	4544	taskkill.exe
Token: SeDebugPrivilege	3252	taskkill.exe
Token: SeDebugPrivilege	2008	taskkill.exe
Token: SeDebugPrivilege	3180	taskkill.exe
Token: SeDebugPrivilege	3792	taskkill.exe
Token: SeDebugPrivilege	4672	taskkill.exe
Token: SeDebugPrivilege	3772	taskkill.exe
Token: SeDebugPrivilege	800	taskkill.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4212	javaw.exe
632	java.exe
4768	javaw.exe
3388	java.exe
2980	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 4040	4660	d87bda9120de373ab47fe445b99b6298_JaffaCakes118.exe	96
PID 4660 wrote to memory of 4040	4660	d87bda9120de373ab47fe445b99b6298_JaffaCakes118.exe	96
PID 4660 wrote to memory of 4040	4660	d87bda9120de373ab47fe445b99b6298_JaffaCakes118.exe	96
PID 4660 wrote to memory of 4040	4660	d87bda9120de373ab47fe445b99b6298_JaffaCakes118.exe	96
PID 4660 wrote to memory of 4040	4660	d87bda9120de373ab47fe445b99b6298_JaffaCakes118.exe	96
PID 4040 wrote to memory of 4364	4040	d87bda9120de373ab47fe445b99b6298_JaffaCakes118.exe	97
PID 4040 wrote to memory of 4364	4040	d87bda9120de373ab47fe445b99b6298_JaffaCakes118.exe	97
PID 4040 wrote to memory of 4364	4040	d87bda9120de373ab47fe445b99b6298_JaffaCakes118.exe	97
PID 4040 wrote to memory of 4212	4040	d87bda9120de373ab47fe445b99b6298_JaffaCakes118.exe	99
PID 4040 wrote to memory of 4212	4040	d87bda9120de373ab47fe445b99b6298_JaffaCakes118.exe	99
PID 4364 wrote to memory of 2756	4364	server.exe	100
PID 4364 wrote to memory of 2756	4364	server.exe	100
PID 4364 wrote to memory of 2756	4364	server.exe	100
PID 4364 wrote to memory of 2756	4364	server.exe	100
PID 4364 wrote to memory of 712	4364	server.exe	101
PID 4364 wrote to memory of 712	4364	server.exe	101
PID 4364 wrote to memory of 2284	4364	server.exe	102
PID 4364 wrote to memory of 2284	4364	server.exe	102
PID 4364 wrote to memory of 2284	4364	server.exe	102
PID 4364 wrote to memory of 2284	4364	server.exe	102
PID 4212 wrote to memory of 632	4212	javaw.exe	103
PID 4212 wrote to memory of 632	4212	javaw.exe	103
PID 4364 wrote to memory of 2784	4364	server.exe	105
PID 4364 wrote to memory of 2784	4364	server.exe	105
PID 4364 wrote to memory of 4680	4364	server.exe	106
PID 4364 wrote to memory of 4680	4364	server.exe	106
PID 4364 wrote to memory of 4680	4364	server.exe	106
PID 4364 wrote to memory of 4680	4364	server.exe	106
PID 4364 wrote to memory of 3064	4364	server.exe	107
PID 4364 wrote to memory of 3064	4364	server.exe	107
PID 4364 wrote to memory of 2444	4364	server.exe	108
PID 4364 wrote to memory of 2444	4364	server.exe	108
PID 4364 wrote to memory of 2444	4364	server.exe	108
PID 4364 wrote to memory of 2444	4364	server.exe	108
PID 4212 wrote to memory of 4976	4212	javaw.exe	109
PID 4212 wrote to memory of 4976	4212	javaw.exe	109
PID 632 wrote to memory of 512	632	java.exe	110
PID 632 wrote to memory of 512	632	java.exe	110
PID 4976 wrote to memory of 4564	4976	cmd.exe	113
PID 4976 wrote to memory of 4564	4976	cmd.exe	113
PID 512 wrote to memory of 4012	512	cmd.exe	114
PID 512 wrote to memory of 4012	512	cmd.exe	114
PID 632 wrote to memory of 4548	632	java.exe	115
PID 632 wrote to memory of 4548	632	java.exe	115
PID 4212 wrote to memory of 4360	4212	javaw.exe	116
PID 4212 wrote to memory of 4360	4212	javaw.exe	116
PID 4548 wrote to memory of 3096	4548	cmd.exe	119
PID 4548 wrote to memory of 3096	4548	cmd.exe	119
PID 4360 wrote to memory of 3600	4360	cmd.exe	120
PID 4360 wrote to memory of 3600	4360	cmd.exe	120
PID 632 wrote to memory of 4808	632	java.exe	121
PID 632 wrote to memory of 4808	632	java.exe	121
PID 4212 wrote to memory of 3460	4212	javaw.exe	122
PID 4212 wrote to memory of 3460	4212	javaw.exe	122
PID 4364 wrote to memory of 2604	4364	server.exe	125
PID 4364 wrote to memory of 2604	4364	server.exe	125
PID 4364 wrote to memory of 1076	4364	server.exe	126
PID 4364 wrote to memory of 1076	4364	server.exe	126
PID 4364 wrote to memory of 1076	4364	server.exe	126
PID 4364 wrote to memory of 1076	4364	server.exe	126
PID 4364 wrote to memory of 4384	4364	server.exe	127
PID 4364 wrote to memory of 4384	4364	server.exe	127
PID 4364 wrote to memory of 2340	4364	server.exe	128
PID 4364 wrote to memory of 2340	4364	server.exe	128

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4128	attrib.exe
3324	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	358saxio.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	358saxio.exe

C:\Users\Admin\AppData\Local\Temp\d87bda9120de373ab47fe445b99b6298_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d87bda9120de373ab47fe445b99b6298_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Users\Admin\AppData\Local\Temp\d87bda9120de373ab47fe445b99b6298_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d87bda9120de373ab47fe445b99b6298_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4040
- - C:\Users\Admin\AppData\Local\Temp\server.exe
    "C:\Users\Admin\AppData\Local\Temp\server.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4364
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2756
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2676
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:4364
      - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\358saxio.exe
        
        "C:\Users\Admin\AppData\Local\Temp\358saxio.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:712
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2784
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3064
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2604
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4384
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2272
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3640
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:536
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\358saxio.exe
      "C:\Users\Admin\AppData\Local\Temp\358saxio.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:1400
    - - C:\Users\Admin\AppData\Local\Temp\358saxio.exe
        
        "C:\Users\Admin\AppData\Local\Temp\358saxio.exe"
        5⤵
        Executes dropped EXE
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        outlook_office_path
        outlook_win_path
        
        PID:4620
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:2872
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:1060
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3748
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:1020
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:2008
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4324
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:2020
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:884
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4928
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2168
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4160
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\358saxio.exe
        
        "C:\Users\Admin\AppData\Local\Temp\358saxio.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4860
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\uroi.jar"
    3⤵
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4212
  - - C:\Program Files\Java\jre-1.8\bin\java.exe
      "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.42123811256401314237479909206525250.class
      4⤵
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:632
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive9060601836767380573.vbs
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:512
      - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive9060601836767380573.vbs
        6⤵
        
        PID:4012
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive587392216208303467.vbs
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4548
      - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive587392216208303467.vbs
        6⤵
        
        PID:3096
    - - C:\Windows\SYSTEM32\xcopy.exe
        
        xcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
        5⤵
        
        PID:4808
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8702613827731325775.vbs
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4976
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8702613827731325775.vbs
        5⤵
        
        PID:4564
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive350686847101141434.vbs
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4360
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive350686847101141434.vbs
        5⤵
        
        PID:3600
  - - C:\Windows\SYSTEM32\xcopy.exe
      xcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
      4⤵
      PID:3460
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe
      4⤵
      PID:1484
  - - C:\Windows\SYSTEM32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v sVCHXnbVdLZ /t REG_EXPAND_SZ /d "\"C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe\" -jar \"C:\Users\Admin\JbWWIoBadTZ\lHhuTzdHfZG.ZDwmik\"" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:5100
  - - C:\Windows\SYSTEM32\attrib.exe
      attrib +h "C:\Users\Admin\JbWWIoBadTZ\*.*"
      4⤵
      Views/modifies file attributes
      PID:3324
  - - C:\Windows\SYSTEM32\attrib.exe
      attrib +h "C:\Users\Admin\JbWWIoBadTZ"
      4⤵
      Views/modifies file attributes
      PID:4128
  - - C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe
      C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe -jar C:\Users\Admin\JbWWIoBadTZ\lHhuTzdHfZG.ZDwmik
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of SetWindowsHookEx
      PID:4768
    - - C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe -jar C:\Users\Admin\AppData\Local\Temp\_0.182571162531452221355571568541978456.class
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:3388
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8049413935155286289.vbs
        6⤵
        
        PID:3316
        
        C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8049413935155286289.vbs
        7⤵
        
        PID:1976
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2671659941345407602.vbs
        6⤵
        
        PID:4308
        
        C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive2671659941345407602.vbs
        7⤵
        
        PID:3980
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe
        6⤵
        
        PID:4760
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5750554744461316131.vbs
        5⤵
        
        PID:4204
      - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5750554744461316131.vbs
        6⤵
        
        PID:4456
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7833996907143785372.vbs
        5⤵
        
        PID:2712
      - C:\Windows\system32\cscript.exe
        
        cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive7833996907143785372.vbs
        6⤵
        
        PID:408
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:2408
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM UserAccountControlSettings.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:804
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c regedit.exe /s C:\Users\Admin\AppData\Local\Temp\EtIOsLeASQ4506564636371211049.reg
        5⤵
        
        PID:4568
      - C:\Windows\regedit.exe
        
        regedit.exe /s C:\Users\Admin\AppData\Local\Temp\EtIOsLeASQ4506564636371211049.reg
        6⤵
        UAC bypass
        Event Triggered Execution: Image File Execution Options Injection
        Runs .reg file with regedit
        
        PID:2724
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM Taskmgr.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3856
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM ProcessHacker.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1812
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM procexp.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3308
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM MSASCui.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5116
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM MsMpEng.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3584
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM MpUXSrv.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4384
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM MpCmdRun.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3180
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM NisSrv.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4432
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM ConfigSecurityPolicy.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2960
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM procexp.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3572
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM wireshark.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1216
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM tshark.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4060
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM text2pcap.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3592
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM rawshark.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4204
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM mergecap.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3796
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM editcap.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2116
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM dumpcap.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3024
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM capinfos.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4128
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM mbam.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3360
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM mbamscheduler.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3928
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM mbamservice.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5084
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM AdAwareService.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4236
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM AdAwareTray.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3752
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM WebCompanion.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4968
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM AdAwareDesktop.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4660
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM V3Main.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4912
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM V3Svc.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3120
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM V3Up.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:944
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM V3SP.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3024
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM V3Proxy.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3244
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM V3Medic.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3772
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM BgScan.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:880
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM BullGuard.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5100
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM BullGuardBhvScanner.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5048
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM BullGuarScanner.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5080
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM LittleHook.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2824
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM BullGuardUpdate.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3436
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM clamscan.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3592
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM ClamTray.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4860
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM ClamWin.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1976
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM cis.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4028
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM CisTray.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:884
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM cmdagent.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3628
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM cavwp.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3792
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM dragon_updater.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2676
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM MWAGENT.EXE /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1064
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM MWASER.EXE /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4820
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM CONSCTLX.EXE /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4408
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM avpmapp.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4568
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM econceal.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4108
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM escanmon.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4968
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM escanpro.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:388
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM TRAYSSER.EXE /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4636
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM TRAYICOS.EXE /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4308
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM econser.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4544
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM VIEWTCP.EXE /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3252
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM FSHDLL64.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM fsgk32.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3180
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM fshoster32.exe /T /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3792
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM FSMA32.EXE /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4672
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM fsorsp.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3772
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM fssm32.exe /T /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:800
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM FSM32.EXE /T /F
        5⤵
        
        PID:5048
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM trigger.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:3816
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM FProtTray.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:2588
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM FPWin.exe /T /F
        5⤵
        
        PID:2232
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM FPAVServer.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:2272
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM AVK.exe /T /F
        5⤵
        
        PID:1172
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM GdBgInx64.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:4644
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM AVKProxy.exe /T /F
        5⤵
        
        PID:1968
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM GDScan.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:3980
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM AVKWCtlx64.exe /T /F
        5⤵
        
        PID:1508
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM AVKService.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:4796
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM AVKTray.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:3136
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM GDKBFltExe32.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:2884
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM GDSC.exe /T /F
        5⤵
        
        PID:2440
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM virusutilities.exe /T /F
        5⤵
        
        PID:2144
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM guardxservice.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:4664
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM guardxkickoff_x64.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:840
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM iptray.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:4236
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM freshclam.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:1484
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM freshclamwrap.exe /T /F
        5⤵
        
        PID:4320
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7RTScan.exe /T /F
        5⤵
        
        PID:4976
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7FWSrvc.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:3948
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7PSSrvc.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:4496
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7EmlPxy.EXE /T /F
        5⤵
        
        PID:2964
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7TSecurity.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:944
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7AVScan.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:3152
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7CrvSvc.exe /T /F
        5⤵
        
        PID:464
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7SysMon.Exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:3708
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7TSMain.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:3368
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM K7TSMngr.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:4100
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nanosvc.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:4820
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nanoav.exe /T /F
        5⤵
        
        PID:3988
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nnf.exe /T /F
        5⤵
        
        PID:392
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nvcsvc.exe /T /F
        5⤵
        
        PID:4508
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nbrowser.exe /T /F
        5⤵
        
        PID:1332
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nseupdatesvc.exe /T /F
        5⤵
        
        PID:388
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nfservice.exe /T /F
        5⤵
        
        PID:3796
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nwscmon.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:1972
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM njeeves2.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:64
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nvcod.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:3752
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nvoy.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:1020
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM zlhh.exe /T /F
        5⤵
        
        PID:1896
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM Zlh.exe /T /F
        5⤵
        
        PID:4624
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM nprosec.exe /T /F
        5⤵
        
        PID:944
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM Zanda.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:3280
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM NS.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:3708
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM acs.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:3856
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM op_mon.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:2024
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM PSANHost.exe /T /F
        5⤵
        
        PID:1812
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /IM PSUAMain.exe /T /F
        5⤵
        Kills process with taskkill
        
        PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
c6d40bfddecc06a78b82badf14b49450

SHA1
41351d465271495b2677d20d807aac07f4d7550c

SHA256
d364a368c11bfecdf8b2abb519454d4e80b2786285f2bbaf44cead468e675ca0

SHA512
8804549555d86c5b9aa637ed1890692aea0b49184a9b04802241072d729b32cb96adcc280f65116c6c074720c9990913c5a5f981da3498481fe333341299afa7

Download Submit
C:\ProgramData\Oracle\Java\.oracle_jre_usage\50569f7db71fa7f8.timestamp

Filesize
54B

MD5
e703b1b40b09f74e7966846c039df9e6

SHA1
b6e2f6ab3ca578e2447f01f5301ae6974afae434

SHA256
f171249b3b51340d15929de0189779f01a1114d88e187157e57c1bc8d79cb0fa

SHA512
1025c86c6e67bcfcbe6a9b29fbe9da2c6dfe4e5605db572af2f1d26131665e9bc2498494c6fb47ebb442cf76addf59c0c7b0b3b11329001587121f434f065fc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\358saxio.exe

Filesize
478KB

MD5
e938586ec1f858c38a74f3993a8678d7

SHA1
f02b611afd56dfc13f78c4aad04e745c0f25e8c3

SHA256
0617ff5e70f5f0d6192d7807bd8e8ba266e0d0c831fcffce8f2f154a7c4c3d15

SHA512
ead1e6c794be979be3257bc2a5481ea000937208395ace8e17a1d67f925771d0d447fac4885fcf606e4403380936b418f2bf7ff6b8c58424edbdf2b4e287af87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Retrive587392216208303467.vbs

Filesize
281B

MD5
a32c109297ed1ca155598cd295c26611

SHA1
dc4a1fdbaad15ddd6fe22d3907c6b03727b71510

SHA256
45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7

SHA512
70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887

Download Submit
C:\Users\Admin\AppData\Local\Temp\Retrive9060601836767380573.vbs

Filesize
276B

MD5
3bdfd33017806b85949b6faa7d4b98e4

SHA1
f92844fee69ef98db6e68931adfaa9a0a0f8ce66

SHA256
9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6

SHA512
ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429

Download Submit
C:\Users\Admin\AppData\Local\Temp\_0.42123811256401314237479909206525250.class

Filesize
241KB

MD5
781fb531354d6f291f1ccab48da6d39f

SHA1
9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68

SHA256
97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9

SHA512
3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe

Filesize
533KB

MD5
1bd2d8ca67e8ff5fdcccfebe2f8ecd35

SHA1
4beaf9f98bf3133aaa93fe0935acc6bbd451be01

SHA256
371797338d6f12d89d9d697b1fcfd35e4df3410a48812ce3c10c6980553faec8

SHA512
f0b33dd4ebc81ea946458224da80884c1766e85f28706032b96e5c4feecb8fe72be462b9ba1fd31e1704e0758a135464693023444b3ae57ffb78734ddc3a3832

Download Submit
C:\Users\Admin\AppData\Local\Temp\uroi.jar

Filesize
479KB

MD5
97a01ee483bf0ecefc0dbe43c626657b

SHA1
57e5dbe078816b8e82931391300b3afdf334e3ec

SHA256
693115a7758bad8850ba23a9ac50f9295bd252ed496fb601462c5fd124e66b03

SHA512
a542699316e8324c53385bd5b71f7d9ec001d6acfc0454245ba1eb1a6409bc09b7f94c0868de0b495011bc2b595edb7d67b6619795718a1500a172e93aa73a5b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2412658365-3084825385-3340777666-1000\0f5007522459c86e95ffcc62f32308f1_dd06e985-ac7f-4567-b0c7-3752f03c29fc

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2412658365-3084825385-3340777666-1000\0f5007522459c86e95ffcc62f32308f1_dd06e985-ac7f-4567-b0c7-3752f03c29fc

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2412658365-3084825385-3340777666-1000\83aa4cc77f591dfc2374580bbd95f6ba_dd06e985-ac7f-4567-b0c7-3752f03c29fc

Filesize
45B

MD5
c8366ae350e7019aefc9d1e6e6a498c6

SHA1
5731d8a3e6568a5f2dfbbc87e3db9637df280b61

SHA256
11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

SHA512
33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DSma9HnKa.cfg

Filesize
6KB

MD5
c7cf8ba7271ea933927a1f94c164eb6d

SHA1
e90dc0f3b165b521d5f55d00a1ef1e00509ec241

SHA256
c09b89bafd8622f16e235d74d5f1d9e9a75189d9df31776c72f304a9646626e8

SHA512
f85628b5f074607bc5e7b61de92d86f08538805f8e8a0c5975bfb08f9311235ccae7e1e2548f6abc0ee2cbcd0a91ced67761e9a70ecc7a9a1e58a5d1839ff05d

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\java.dll

Filesize
162KB

MD5
4e6dfd5867f4cea96dad1d59a0ca43fe

SHA1
6a08abc0b5a2cab00eb6d7543c661aa6620890a1

SHA256
179df744661b659d50fd6943834d81476287c2075448d2dc783fb32c69a00e54

SHA512
2565197c75eca66600a530aa6b033d4985fcb05edf73e096ebba37f06016e6ae5c4fc516a182bf674ff18e3f3b031353c9ff187a6b8804058b5d2b47c914e60b

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\java.exe

Filesize
285KB

MD5
dafb5fbb0614c19eccdab9bef8f89c22

SHA1
91ab91eb4a90f02c4950c3e5da80f3eb24bddb52

SHA256
af62c3850cd7a84db64bbaf68533e2769da619a8a4bccf0ac4836d2ec86e4b5e

SHA512
81cf8e04b595052e67db73454a67e2098e1df9353e2c3cc842b8ab2a9fa837b90a2101d5a097a6b0af0030869e788de1aa73ebb958f1428a3952ce0464db3e93

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe

Filesize
285KB

MD5
7fb44c5bca4226d8aab7398e836807a2

SHA1
47128e4f8afabfde5037ed0fcaba8752c528ff52

SHA256
a64ead73c06470bc5c84cfc231b0723d70d29fec7d385a268be2c590dc5eb1ef

SHA512
f0bd093f054c99bcc50df4005d0190bd7e3dcefea7008ae4c9b67a29e832e02ae9ff39fa75bc1352c127aeb13afdea9bfdcc238ac826ef17f288d6fbd2ec8cab

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\net.dll

Filesize
104KB

MD5
6c720917e5c8ce1202a4141e8c8cfaf7

SHA1
1175d918134983d1d64a42047f4ff814054123de

SHA256
833cdbd7b221dda58ba728ee9a41cac1d6819d19bfc7336a4b86cc69a5af3695

SHA512
217f824b389547993556c26069d58eb956e87029b5c58556c2d308e48a0db2a02a057b3147fcf6ac7606f2b97ada33e2372112e93944f645137d81cc0dd32a9d

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\nio.dll

Filesize
66KB

MD5
d8a6b5e5a33cb71b61964be369526704

SHA1
7788adf9163fb2ac2c85c43630c0998b0f13360a

SHA256
686021b000cd6d76b97c6f924c528293bc55dfb4ce936cfe70959eecd1665c90

SHA512
d15e5832d025a8fb17dd48b8c6d8246b93d54543ba52d40a9f97aff257847f7e05971ae927a77e12ab1625dc514a29115ce5fe9ddad18fe5fc4b0ddc2f8ca6d1

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\msvcp140.dll

Filesize
558KB

MD5
bf78c15068d6671693dfcdfa5770d705

SHA1
4418c03c3161706a4349dfe3f97278e7a5d8962a

SHA256
a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb

SHA512
5b6b0ab4e82cc979eaa619d387c6995198fd19aa0c455bef44bd37a765685575d57448b3b4accd70d3bd20a6cd408b1f518eda0f6dae5aa106f225bee8291372

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\vcruntime140.dll

Filesize
95KB

MD5
7415c1cc63a0c46983e2a32581daefee

SHA1
5f8534d79c84ac45ad09b5a702c8c5c288eae240

SHA256
475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1

SHA512
3d4b24061f72c0e957c7b04a0c4098c94c8f1afb4a7e159850b9939c7210d73398be6f27b5ab85073b4e8c999816e7804fef0f6115c39cd061f4aaeb4dcda8cf

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\vcruntime140_1.dll

Filesize
36KB

MD5
fcda37abd3d9e9d8170cd1cd15bf9d3f

SHA1
b23ff3e9aa2287b9c1249a008c0ae06dc8b6fdf2

SHA256
0579d460ea1f7e8a815fa55a8821a5ff489c8097f051765e9beaf25d8d0f27d6

SHA512
de8be61499aaa1504dde8c19666844550c2ea7ef774ecbe26900834b252887da31d4cf4fb51338b16b6a4416de733e519ebf8c375eb03eb425232a6349da2257

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\server\jvm.dll

Filesize
8.5MB

MD5
dceeb4fb6af9bb2ea7a2eed1d921afb5

SHA1
af1463a499f7d6eed5efcb9c9515e82335e9c1b6

SHA256
6707043f0b609a0b3677cd11f6526d8ecfcbeab079a394019d648c9039e7da21

SHA512
e4688d2264dda88e90beeb394adc48064012ed458ab9015ecef744a86ab76b4f65845f77a3d02b131aa5c342e6a572f79f471b5dc8df178b2d7483c04b1f4763

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\sunec.dll

Filesize
142KB

MD5
2632b6d90868ff1ece67f76b86a23d79

SHA1
90ddedde02a4cc37ae361caabc36a6a686c24bd1

SHA256
86106645d9e3801911808d6343a7fead7b6e9d8b740bad63a4cd9851ff599283

SHA512
61e0581c3dde45db74383b93e56396c65435714e746fe4f000c53465e8e6750bd787b5895a987bbdbe4badb5ad3570394c82476c2b4d65099f0b923002153b18

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\verify.dll

Filesize
55KB

MD5
82bb3a2292372acbf8bb25e30a3e169c

SHA1
c09c134561213cd67c670f60a2c52cf947e51a74

SHA256
9c99e6591c73eda0dfd6bb9a55d0a175cf5bdb583115477cedc627fd793c3deb

SHA512
db4802fe0e3a6dc1678765af559e9c1f6e8639dd5c7c8f18f08296b1b4d15cfe748e391459253a3dde0ca2bda74c6772af262e5b194c78c6bdefbcc2c5377db7

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\bin\zip.dll

Filesize
87KB

MD5
0d56a7ff632826362768b3edd5e5174f

SHA1
8b96856f8fe3175039d1a7cf3ac0910467844a08

SHA256
27cf17beab60d7f9a62aac7622eefa06eee78796db585f9ae5d3a5b5022d56a9

SHA512
b4fe51874b9ba7a2325ae3c0b96f32065f7cee7c846a9028495070f1f91cedd9445cb91248acd1ec134a72b2c07e49afcaef01b58af1dfb0ff417033c2d0e595

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\amd64\jvm.cfg

Filesize
634B

MD5
499f2a4e0a25a41c1ff80df2d073e4fd

SHA1
e2469cbe07e92d817637be4e889ebb74c3c46253

SHA256
80847ed146dbc5a9f604b07ec887737fc266699abba266177b553149487ce9eb

SHA512
7828f7b06d0f4309b9edd3aa71ae0bb7ee92d2f8df5642c13437bba2a3888e457dc9b24c16aa9e0f19231530cb44b8ccd955cbbdf5956ce8622cc208796b357d

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\charsets.jar

Filesize
2.9MB

MD5
bfdb22624544f02100cd37cff954f64c

SHA1
f699b290845f487cb7050d41a83b85446ea202b1

SHA256
04a6bc7af4d41fda5ca6c7584df50c5d0881fada89b4788e8ee4e5919345f143

SHA512
70c5f501c5e1cc67341bb3f4d190179a79fb8bee7292ff8cca0749368ae4475387ce121e8d33adc7e4e6fad5a10eab378fff17e3da0422d4cca0837c95574b95

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\deploy\messages_zh_TW.properties

Filesize
3KB

MD5
880baacb176553deab39edbe4b74380d

SHA1
37a57aad121c14c25e149206179728fa62203bf0

SHA256
ff4a3a92bc92cb08d2c32c435810440fd264edd63e56efa39430e0240c835620

SHA512
3039315bb283198af9090bd3d31cfae68ee73bc2b118bbae0b32812d4e3fd0f11ce962068d4a17b065dab9a66ef651b9cb8404c0a2defce74bb6b2d1d93646d5

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\meta-index

Filesize
1KB

MD5
005faac2118450bfcd46ae414da5f0e5

SHA1
9f5c887e0505e1bb06bd1fc7975a3219709d061d

SHA256
f0bce718f8d2b38247ce0ac814a1470c826602f4251d86369c2359ff60676bd8

SHA512
8b618c74b359ab3c9d3c8a4864f8e48fe4054514a396352a829a84c9b843a2028c6c31eb53e857e03c803294e05f69c5bf586e261312264e7607b2efd14f78a9

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\sunec.jar

Filesize
46KB

MD5
1227482c65dc231e3607b002950f5497

SHA1
709ff3738d5da8db225818df2966f04c13cb7d02

SHA256
cfe84c5292f9ddef96fecf118377565bbaf769eee7ff4cca81652fe1134f9809

SHA512
87c4f5fa1e6dad6f2fab8a0371380fa7be9f63b05f8ff6740a4208ec115f8db9c512de9e40b4b853be35effed2804d0774c0e9426571a129cb6bdecd527cdb8c

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\ext\sunjce_provider.jar

Filesize
287KB

MD5
456031723ebc7270d9bc3747cdd6daa2

SHA1
a4a61bb10ac83f201854a11750aa86e7dc8da41b

SHA256
324499cedd3f19ea621a38f42834369d7da8bdf40fcb5a345007bfa2e5987780

SHA512
b425eabd590f905aa147720aa507a0da2b31199956f21137a722fe6c8de05549d1cddbb2fb2ea1cbe34e39ce9d0eabb0502dd2a9a09f72dd87cd002765537079

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\images\cursors\win32_CopyNoDrop32x32.gif

Filesize
153B

MD5
1e9d8f133a442da6b0c74d49bc84a341

SHA1
259edc45b4569427e8319895a444f4295d54348f

SHA256
1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b

SHA512
63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\jce.jar

Filesize
119KB

MD5
e0b7e0f36b9fc43d13403145db82e758

SHA1
def42078cfa315e98393c69963efb4e35e2e28a8

SHA256
4362c179bb78107777d6a0557693e65eb2b318c26642162f89509dfdab8c97fe

SHA512
5074a7ceb9621096f3bbf419d32ac260ea6d9d09c758544c2761121026c2b9db0b6617806d3b692347b685d541123f4eda99dcbaa29d9c9a2d740b22c44bf7bb

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\jfr.jar

Filesize
560KB

MD5
530b1ee313390d5d51ae8f5aa0be9070

SHA1
d5de5ee8bd7275b5b20f466ba0869251679b24b3

SHA256
bded3bbadd255c856ed7fb9900cbf0445e980a669a3aa043cf095e18539eb48f

SHA512
50671ca7de240c38921849304ae482a52ae481d0ff5a2f02aef90c20b9f49842bf2ea32b9caabde57a955b8d638a017b6b3cdd662b679a2d743e029f97b88937

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\jsse.jar

Filesize
1.7MB

MD5
01408480f5c65da8c74ecfde0eed1a72

SHA1
2f1cb5df6d4879de8b0827d160e9bb281f829a3a

SHA256
fffafe7e2bacef79280a4565b5d1075320a8ec38dff7978c8fe6c033b6df49d0

SHA512
ae585f4825073da19f611bb7d11a1d075b4998bc3f7d53a67cdba778e0729e0b5134ce8fc49897f67d39e46f1209524ab53ab4551defc6a4127012e332f15d61

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\meta-index

Filesize
2KB

MD5
91aa6ea7320140f30379f758d626e59d

SHA1
3be2febe28723b1033ccdaa110eaf59bbd6d1f96

SHA256
4af21954cdf398d1eae795b6886ca2581dac9f2f1d41c98c6ed9b5dbc3e3c1d4

SHA512
03428803f1d644d89eb4c0dcbdea93acaac366d35fc1356ccabf83473f4fef7924edb771e44c721103cec22d94a179f092d1bfd1c0a62130f076eb82a826d7cb

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\resources.jar

Filesize
3.4MB

MD5
c5152884c2676dd45109cfeba088a549

SHA1
8fe4fd1980bdc4139491b0dd963eb830b70bb8d6

SHA256
65a6d0d74b193af857dd5252d59e8bf9214ddb360b26c1da816b029bf0cf208c

SHA512
ed8d4777609024960a7037f42937de41c434df4ff7062b43f03f0060e326bdef7917e941c9d3db5a8ec7a65f4890ef3dd53c87401f9568e6f068f2930d558e61

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\security\java.security

Filesize
55KB

MD5
8f0e3440fffdbcaa9d26be4730492a66

SHA1
20a3e5a8ecbec20d41d7124120d264f61de96613

SHA256
b5e8205764b83f46b50187b2021de7c86a890df908a8d6c17275a68924f832c6

SHA512
c04528769ce780e730ef71803ca8191c217f571f62703daca273499b90e93101383a3699263458c205cd7a8733399c3c2ca6afc85b6843c2c5e2ba0890e762cb

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\security\policy\unlimited\US_export_policy.jar

Filesize
3KB

MD5
6cbca5808b4a8613d2fed6fe4a84c449

SHA1
0135b30ebec03fb69d79cdc3126e608d9effb8b2

SHA256
761aab2969883e9e5ea76df63ca404fb67673efc3f97def057f8e22517fc9518

SHA512
4d9bf052aa124d07673c601cbfb83223b87369f7be7575a13e13c0d893e57849ba11e430b7769901782c26471528dfaa130996916451e1a7e38cf28468e44cfa

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\lib\security\policy\unlimited\local_policy.jar

Filesize
3KB

MD5
360663f26c5584e6c6127254b261fa0c

SHA1
aee6515eede2ad7c697ba8a61bdd9359be3319d2

SHA256
02f69a433405ea928c89a8aade74e5462282ccb9a9d30851312ed3459398f85c

SHA512
e3920d5abbbe6b0e3029ed1e0b2ce1a53da6c7e728f635b12f00b1fd2eb6151fff74b9dc85ec0c0920f7fda440c1604d24ca766cdbcb78be3425088d97e00208

Download Submit
C:\Users\Admin\JbWWIoBadTZ\ID.txt

Filesize
47B

MD5
090c2dfffab06a4f8ed9b47c73606ee5

SHA1
8de208ce1d6ac1fea7e3b8a9f2351697da020c38

SHA256
f504f766595a68683992357d7e02cd06308d22aa3d542106b8f24e726bf8f728

SHA512
c090f33f4abf7c4e18fec72a249e267e450ee02ec1ee32c24e5b1f4d5592c26f9fe67cdeb6825d493e31f20c5316dfe50da1e1a3fabf8535cf441aacf182eb2b

Download Submit
memory/632-102-0x00000151BA840000-0x00000151BA841000-memory.dmp

Filesize
4KB

Download
memory/632-89-0x00000151BA840000-0x00000151BA841000-memory.dmp

Filesize
4KB

Download
memory/632-544-0x00000151BA840000-0x00000151BA841000-memory.dmp

Filesize
4KB

Download
memory/1076-220-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/1076-351-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/1400-1201-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1400-1003-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1400-1279-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1568-1152-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/1568-1150-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/2168-1153-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/2168-1154-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/2284-41-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/2284-48-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/2340-558-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/2340-661-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/2444-90-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/2444-95-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/2756-38-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/2776-992-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/2776-991-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/2884-943-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/2884-897-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/2980-1177-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/3152-1157-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/3152-1158-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/3252-1120-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/3252-1111-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/3388-1156-0x000002083F180000-0x000002083F181000-memory.dmp

Filesize
4KB

Download
memory/3388-1151-0x000002083F180000-0x000002083F181000-memory.dmp

Filesize
4KB

Download
memory/3388-1122-0x000002083F180000-0x000002083F181000-memory.dmp

Filesize
4KB

Download
memory/4040-9-0x0000000000400000-0x000000000050E943-memory.dmp

Filesize
1.1MB

Download
memory/4040-26-0x0000000000400000-0x000000000050F000-memory.dmp

Filesize
1.1MB

Download
memory/4040-11-0x0000000000400000-0x000000000050F000-memory.dmp

Filesize
1.1MB

Download
memory/4040-6-0x0000000000400000-0x000000000050F000-memory.dmp

Filesize
1.1MB

Download
memory/4040-8-0x0000000000400000-0x000000000050F000-memory.dmp

Filesize
1.1MB

Download
memory/4040-28-0x0000000000400000-0x000000000050E943-memory.dmp

Filesize
1.1MB

Download
memory/4212-548-0x0000020F05520000-0x0000020F05521000-memory.dmp

Filesize
4KB

Download
memory/4212-1046-0x0000020F05520000-0x0000020F05521000-memory.dmp

Filesize
4KB

Download
memory/4212-101-0x0000020F05520000-0x0000020F05521000-memory.dmp

Filesize
4KB

Download
memory/4212-66-0x0000020F05520000-0x0000020F05521000-memory.dmp

Filesize
4KB

Download
memory/4364-1006-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/4432-1010-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/4432-1011-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/4660-1-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/4660-2-0x0000000000400000-0x0000000000876000-memory.dmp

Filesize
4.5MB

Download
memory/4660-4-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/4660-0-0x0000000000400000-0x0000000000876000-memory.dmp

Filesize
4.5MB

Download
memory/4660-14-0x0000000000400000-0x0000000000876000-memory.dmp

Filesize
4.5MB

Download
memory/4680-64-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/4680-65-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/4768-1172-0x0000015B0A490000-0x0000015B0A491000-memory.dmp

Filesize
4KB

Download
memory/4768-1166-0x0000015B0A490000-0x0000015B0A491000-memory.dmp

Filesize
4KB

Download
memory/4768-1146-0x0000015B0A490000-0x0000015B0A491000-memory.dmp

Filesize
4KB

Download
memory/4768-1170-0x0000015B0A490000-0x0000015B0A491000-memory.dmp

Filesize
4KB

Download
memory/4768-1162-0x0000015B0A490000-0x0000015B0A491000-memory.dmp

Filesize
4KB

Download
memory/4768-1105-0x0000015B0A490000-0x0000015B0A491000-memory.dmp

Filesize
4KB

Download
memory/4768-1062-0x0000015B0A490000-0x0000015B0A491000-memory.dmp

Filesize
4KB

Download
memory/4860-1231-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4860-1317-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4904-1140-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/4904-1142-0x0000000000C80000-0x0000000000D10000-memory.dmp

Filesize
576KB

Download
memory/4976-1244-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4976-1319-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads