metasploit | 235ca0544fcf3f022b2939f2b3c0f81aee82e888b9d764ab8d22fe1ed0f13248

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16-09-2024 22:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5b44088941e2fe5ec8f8e160d7c5f11_JaffaCakes118.exe
Size

1.2MB
MD5

e5b44088941e2fe5ec8f8e160d7c5f11
SHA1

d8dc8fb855eaaa35e6c4bd84fdb8ac42450ee2d7
SHA256

235ca0544fcf3f022b2939f2b3c0f81aee82e888b9d764ab8d22fe1ed0f13248
SHA512

0eac3fc40fe0055348aab7ea1d3ec39ebf051786acda53f1f3feeda73eafc2999d8428ee83ed7ae892240d6f65e57e583df63c45783104f37a41ca4561d4d435
SSDEEP

24576:/Mz40YtokrysuW6xWAnij/m/zjFFtjxJDjTX7eQ5AlKO8eb47IqM6r:kE0YtokrXYnij/mLdjxJvvL5Alx8eb43

Score

10^/10

metasploit backdoor discovery evasion themida trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Modifies security service 2 TTPs 20 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe

Executes dropped EXE 10 IoCs

pid	Process
2968	wiunpdate
2312	wiunpdate
2732	wiunpdate
1424	wiunpdate
2916	wiunpdate
1660	wiunpdate
2984	wiunpdate
2196	wiunpdate
2784	wiunpdate
1988	wiunpdate

Loads dropped DLL 20 IoCs

pid	Process
2520	e5b44088941e2fe5ec8f8e160d7c5f11_JaffaCakes118.exe
2520	e5b44088941e2fe5ec8f8e160d7c5f11_JaffaCakes118.exe
2968	wiunpdate
2968	wiunpdate
2312	wiunpdate
2312	wiunpdate
2732	wiunpdate
2732	wiunpdate
1424	wiunpdate
1424	wiunpdate
2916	wiunpdate
2916	wiunpdate
1660	wiunpdate
1660	wiunpdate
2984	wiunpdate
2984	wiunpdate
2196	wiunpdate
2196	wiunpdate
2784	wiunpdate
2784	wiunpdate

Themida packer 29 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2520-15-0x0000000000400000-0x0000000000766000-memory.dmp	themida
behavioral1/memory/2520-16-0x0000000000400000-0x0000000000766000-memory.dmp	themida
behavioral1/memory/2520-128-0x0000000000400000-0x0000000000766000-memory.dmp	themida
behavioral1/files/0x00080000000174a8-129.dat	themida
behavioral1/memory/2968-137-0x0000000000400000-0x0000000000766000-memory.dmp	themida
behavioral1/memory/2968-140-0x0000000000400000-0x0000000000766000-memory.dmp	themida
behavioral1/memory/2968-139-0x0000000000400000-0x0000000000766000-memory.dmp	themida
behavioral1/memory/2968-141-0x0000000000400000-0x0000000000766000-memory.dmp	themida
behavioral1/memory/2968-142-0x0000000000400000-0x0000000000766000-memory.dmp	themida
behavioral1/memory/2968-143-0x0000000000400000-0x0000000000766000-memory.dmp	themida
behavioral1/memory/2968-144-0x0000000000400000-0x0000000000766000-memory.dmp	themida
behavioral1/memory/2968-148-0x0000000000400000-0x0000000000766000-memory.dmp	themida
behavioral1/memory/2312-265-0x0000000000400000-0x0000000000766000-memory.dmp	themida
behavioral1/memory/2312-383-0x0000000000400000-0x0000000000766000-memory.dmp	themida
behavioral1/memory/2732-385-0x0000000000400000-0x0000000000766000-memory.dmp	themida
behavioral1/memory/2732-444-0x0000000000400000-0x0000000000766000-memory.dmp	themida
behavioral1/memory/1424-505-0x0000000000400000-0x0000000000766000-memory.dmp	themida
behavioral1/memory/1424-509-0x0000000000400000-0x0000000000766000-memory.dmp	themida
behavioral1/memory/2916-625-0x0000000000400000-0x0000000000766000-memory.dmp	themida
behavioral1/memory/2916-685-0x0000000000400000-0x0000000000766000-memory.dmp	themida
behavioral1/memory/1660-745-0x0000000000400000-0x0000000000766000-memory.dmp	themida
behavioral1/memory/1660-749-0x0000000000400000-0x0000000000766000-memory.dmp	themida
behavioral1/memory/2984-865-0x0000000000400000-0x0000000000766000-memory.dmp	themida
behavioral1/memory/2984-915-0x0000000000400000-0x0000000000766000-memory.dmp	themida
behavioral1/memory/2196-985-0x0000000000400000-0x0000000000766000-memory.dmp	themida
behavioral1/memory/2196-989-0x0000000000400000-0x0000000000766000-memory.dmp	themida
behavioral1/memory/2784-1105-0x0000000000400000-0x0000000000766000-memory.dmp	themida
behavioral1/memory/2784-1174-0x0000000000400000-0x0000000000766000-memory.dmp	themida
behavioral1/memory/1988-1225-0x0000000000400000-0x0000000000766000-memory.dmp	themida

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wiunpdate	wiunpdate
File opened for modification	C:\Windows\SysWOW64\wiunpdate	wiunpdate
File opened for modification	C:\Windows\SysWOW64\wiunpdate	wiunpdate
File created	C:\Windows\SysWOW64\wiunpdate	wiunpdate
File opened for modification	C:\Windows\SysWOW64\wiunpdate	wiunpdate
File created	C:\Windows\SysWOW64\wiunpdate	wiunpdate
File created	C:\Windows\SysWOW64\wiunpdate	wiunpdate
File created	C:\Windows\SysWOW64\wiunpdate	wiunpdate
File created	C:\Windows\SysWOW64\wiunpdate	wiunpdate
File opened for modification	C:\Windows\SysWOW64\wiunpdate	wiunpdate
File created	C:\Windows\SysWOW64\wiunpdate	wiunpdate
File created	C:\Windows\SysWOW64\wiunpdate	e5b44088941e2fe5ec8f8e160d7c5f11_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wiunpdate	e5b44088941e2fe5ec8f8e160d7c5f11_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wiunpdate	wiunpdate
File opened for modification	C:\Windows\SysWOW64\wiunpdate	wiunpdate
File created	C:\Windows\SysWOW64\wiunpdate	wiunpdate
File created	C:\Windows\SysWOW64\wiunpdate	wiunpdate
File opened for modification	C:\Windows\SysWOW64\wiunpdate	wiunpdate
File opened for modification	C:\Windows\SysWOW64\wiunpdate	wiunpdate
File opened for modification	C:\Windows\SysWOW64\wiunpdate	wiunpdate
File created	C:\Windows\SysWOW64\wiunpdate	wiunpdate
File opened for modification	C:\Windows\SysWOW64\wiunpdate	wiunpdate

System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wiunpdate
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e5b44088941e2fe5ec8f8e160d7c5f11_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wiunpdate
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wiunpdate
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wiunpdate
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wiunpdate
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wiunpdate
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wiunpdate
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wiunpdate
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wiunpdate
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wiunpdate
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs .reg file with regedit 10 IoCs

pid	Process
2564	regedit.exe
1720	regedit.exe
1720	regedit.exe
1988	regedit.exe
1828	regedit.exe
1976	regedit.exe
756	regedit.exe
2624	regedit.exe
756	regedit.exe
2112	regedit.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2520	e5b44088941e2fe5ec8f8e160d7c5f11_JaffaCakes118.exe
2968	wiunpdate
2312	wiunpdate
2732	wiunpdate
1424	wiunpdate
2916	wiunpdate
1660	wiunpdate
2984	wiunpdate
2196	wiunpdate
2784	wiunpdate
1988	wiunpdate

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2736	2520	e5b44088941e2fe5ec8f8e160d7c5f11_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2736	2520	e5b44088941e2fe5ec8f8e160d7c5f11_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2736	2520	e5b44088941e2fe5ec8f8e160d7c5f11_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2736	2520	e5b44088941e2fe5ec8f8e160d7c5f11_JaffaCakes118.exe	30
PID 2736 wrote to memory of 2564	2736	cmd.exe	31
PID 2736 wrote to memory of 2564	2736	cmd.exe	31
PID 2736 wrote to memory of 2564	2736	cmd.exe	31
PID 2736 wrote to memory of 2564	2736	cmd.exe	31
PID 2520 wrote to memory of 2968	2520	e5b44088941e2fe5ec8f8e160d7c5f11_JaffaCakes118.exe	32
PID 2520 wrote to memory of 2968	2520	e5b44088941e2fe5ec8f8e160d7c5f11_JaffaCakes118.exe	32
PID 2520 wrote to memory of 2968	2520	e5b44088941e2fe5ec8f8e160d7c5f11_JaffaCakes118.exe	32
PID 2520 wrote to memory of 2968	2520	e5b44088941e2fe5ec8f8e160d7c5f11_JaffaCakes118.exe	32
PID 2968 wrote to memory of 2312	2968	wiunpdate	33
PID 2968 wrote to memory of 2312	2968	wiunpdate	33
PID 2968 wrote to memory of 2312	2968	wiunpdate	33
PID 2968 wrote to memory of 2312	2968	wiunpdate	33
PID 2312 wrote to memory of 2008	2312	wiunpdate	34
PID 2312 wrote to memory of 2008	2312	wiunpdate	34
PID 2312 wrote to memory of 2008	2312	wiunpdate	34
PID 2312 wrote to memory of 2008	2312	wiunpdate	34
PID 2008 wrote to memory of 1720	2008	cmd.exe	35
PID 2008 wrote to memory of 1720	2008	cmd.exe	35
PID 2008 wrote to memory of 1720	2008	cmd.exe	35
PID 2008 wrote to memory of 1720	2008	cmd.exe	35
PID 2312 wrote to memory of 2732	2312	wiunpdate	37
PID 2312 wrote to memory of 2732	2312	wiunpdate	37
PID 2312 wrote to memory of 2732	2312	wiunpdate	37
PID 2312 wrote to memory of 2732	2312	wiunpdate	37
PID 2732 wrote to memory of 844	2732	wiunpdate	38
PID 2732 wrote to memory of 844	2732	wiunpdate	38
PID 2732 wrote to memory of 844	2732	wiunpdate	38
PID 2732 wrote to memory of 844	2732	wiunpdate	38
PID 844 wrote to memory of 756	844	cmd.exe	39
PID 844 wrote to memory of 756	844	cmd.exe	39
PID 844 wrote to memory of 756	844	cmd.exe	39
PID 844 wrote to memory of 756	844	cmd.exe	39
PID 2732 wrote to memory of 1424	2732	wiunpdate	40
PID 2732 wrote to memory of 1424	2732	wiunpdate	40
PID 2732 wrote to memory of 1424	2732	wiunpdate	40
PID 2732 wrote to memory of 1424	2732	wiunpdate	40
PID 1424 wrote to memory of 2576	1424	wiunpdate	41
PID 1424 wrote to memory of 2576	1424	wiunpdate	41
PID 1424 wrote to memory of 2576	1424	wiunpdate	41
PID 1424 wrote to memory of 2576	1424	wiunpdate	41
PID 2576 wrote to memory of 2624	2576	cmd.exe	42
PID 2576 wrote to memory of 2624	2576	cmd.exe	42
PID 2576 wrote to memory of 2624	2576	cmd.exe	42
PID 2576 wrote to memory of 2624	2576	cmd.exe	42
PID 1424 wrote to memory of 2916	1424	wiunpdate	43
PID 1424 wrote to memory of 2916	1424	wiunpdate	43
PID 1424 wrote to memory of 2916	1424	wiunpdate	43
PID 1424 wrote to memory of 2916	1424	wiunpdate	43
PID 2916 wrote to memory of 3016	2916	wiunpdate	44
PID 2916 wrote to memory of 3016	2916	wiunpdate	44
PID 2916 wrote to memory of 3016	2916	wiunpdate	44
PID 2916 wrote to memory of 3016	2916	wiunpdate	44
PID 3016 wrote to memory of 756	3016	cmd.exe	45
PID 3016 wrote to memory of 756	3016	cmd.exe	45
PID 3016 wrote to memory of 756	3016	cmd.exe	45
PID 3016 wrote to memory of 756	3016	cmd.exe	45
PID 2916 wrote to memory of 1660	2916	wiunpdate	46
PID 2916 wrote to memory of 1660	2916	wiunpdate	46
PID 2916 wrote to memory of 1660	2916	wiunpdate	46
PID 2916 wrote to memory of 1660	2916	wiunpdate	46

C:\Users\Admin\AppData\Local\Temp\e5b44088941e2fe5ec8f8e160d7c5f11_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e5b44088941e2fe5ec8f8e160d7c5f11_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\a.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\SysWOW64\regedit.exe
    REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
    3⤵
    - Modifies security service
    - System Location Discovery: System Language Discovery
    - Runs .reg file with regedit
    PID:2564
- C:\Windows\SysWOW64\wiunpdate
  C:\Windows\system32\wiunpdate 664 "C:\Users\Admin\AppData\Local\Temp\e5b44088941e2fe5ec8f8e160d7c5f11_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\SysWOW64\wiunpdate
    C:\Windows\system32\wiunpdate 708 "C:\Windows\SysWOW64\wiunpdate"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c c:\a.bat
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2008
    - - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        5⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:1720
  - - C:\Windows\SysWOW64\wiunpdate
      C:\Windows\system32\wiunpdate 720 "C:\Windows\SysWOW64\wiunpdate"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2732
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:844
      - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        6⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:756
    - - C:\Windows\SysWOW64\wiunpdate
        
        C:\Windows\system32\wiunpdate 728 "C:\Windows\SysWOW64\wiunpdate"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1424
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2576
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        7⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:2624
      - C:\Windows\SysWOW64\wiunpdate
        
        C:\Windows\system32\wiunpdate 732 "C:\Windows\SysWOW64\wiunpdate"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2916
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3016
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        8⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:756
        
        C:\Windows\SysWOW64\wiunpdate
        
        C:\Windows\system32\wiunpdate 736 "C:\Windows\SysWOW64\wiunpdate"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1660
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1876
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        9⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:2112
        
        C:\Windows\SysWOW64\wiunpdate
        
        C:\Windows\system32\wiunpdate 740 "C:\Windows\SysWOW64\wiunpdate"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2984
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3000
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        10⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:1988
        
        C:\Windows\SysWOW64\wiunpdate
        
        C:\Windows\system32\wiunpdate 744 "C:\Windows\SysWOW64\wiunpdate"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2196
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2628
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        11⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:1828
        
        C:\Windows\SysWOW64\wiunpdate
        
        C:\Windows\system32\wiunpdate 748 "C:\Windows\SysWOW64\wiunpdate"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2784
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:2336
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        12⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:1976
        
        C:\Windows\SysWOW64\wiunpdate
        
        C:\Windows\system32\wiunpdate 752 "C:\Windows\SysWOW64\wiunpdate"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1988
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:2088
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        13⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
748bce4dacebbbd388af154a1df22078

SHA1
0eeeb108678f819cd437d53b927feedf36aabc64

SHA256
1585c9ef77c37c064003bd746cd0a8da2523c99a10c3fb6eabd546e2a343646a

SHA512
d9756851b4aa1108416b7a77f0c6b84b599d695850d704a094a1f83b322d892ab6706001d5322e876b93935b830bcb52a951b4c69004ea2be338f64b85be2ea1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
576B

MD5
8a0897226da780b90c11da0756b361f1

SHA1
67f813e8733ad75a2147c59cca102a60274daeab

SHA256
115ff7b8bbe33e1325a2b03fb279281b79b2b9c4c0d6147c049c99da39867bee

SHA512
55e0e0791fb8e76fb67511ef2bfe1bdb934c857a5a555f9c72dd063250c18b17c57ff9f220c0d3cdd219828d87f5c08bfe5e198476c9d38119c4cfb099b99642

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
a57e37dfb6f88b2d04424936ed0b4afb

SHA1
35e2f81486b8420b88b7693ad3e92f846367cb12

SHA256
411f47af20b97f1fe35d3ff6f2a03a77301c8bee20cdfd4638a68430af77456d

SHA512
41f683cc837a2ac36eaf8c32ac336534d329eb482c1a7bd23728b3878492ce79488647df4746701c15254e552e3460f8efa8cec9448a252146596c7926dff448

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
574B

MD5
5020988c301a6bf0c54a293ddf64837c

SHA1
5b65e689a2988b9a739d53565b2a847f20d70f09

SHA256
a123ebc1fac86713cdd7c4a511e022783a581ea02ba65ea18360555706ae5f2d

SHA512
921a07597f8c82c65c675f5b09a2552c7e2e8c65c8df59eebbe9aff0bfe439ad93f5efc97ba521be31299323051d61ead6a3f0be27302dc0f728b7a844fb2fcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
478B

MD5
1a00c84e2e8a76c3caa6c0b89f9f0d6d

SHA1
2650e962d49c5800edb569ee1b989edc8868d9b9

SHA256
f477217e9368c8114de7621c41a01818957dae31140ffd7df2b39705c72543e6

SHA512
a5f2f271184ff3bad04dd2135e7d32ca32c2ad24400832ec8a143dcbc20449ede4e06b48479ba93609cb1caf0b41a9143698eafb07b032ebdd609e399d62288c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
584f47a0068747b3295751a0d591f4ee

SHA1
7886a90e507c56d3a6105ecdfd9ff77939afa56f

SHA256
927fd19c24f20ac1dff028de9d73094b2591842248c95a20a8264abf1333aea5

SHA512
ca945aad3c2d9ecadff2bc30cf23902b1254cffdf572ff9d4e7c94659255fc3467899053e4a45d3b155900c7b5b91abedf03d31af7e39870015c85e424d04257

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
2KB

MD5
fa83299c5a0d8714939977af6bdafa92

SHA1
46a4abab9b803a7361ab89d0ca000a367550e23c

SHA256
f3bb35f7fc756da2c2297a100fa29506cb12371edb793061add90ee16318bf03

SHA512
85e46b9f1089054e60c433459eea52bec26330f8b91879df3b48db1533a307443dd82006ac3bb86245bbd207c1d8c75c29949f755cc0dc262ede888a1d531599

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
908860a865f8ed2e14085e35256578dd

SHA1
7ff5ee35cc7e96a661848eb95a70d0b8d2d78603

SHA256
d2b73d92cf00a9dc61f2777a7f298e8c4bb72697236965f8931bdfc9d0924c5f

SHA512
a93bb8cb180d957ef2b2c511d5ff66a25d2bcfb071af9884c146b8c422d1fadc9a4d390712bc2cb27640634854b3e59d5209803373cf1f42381d513747a65fd9

Download Submit
C:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
\Windows\SysWOW64\wiunpdate

Filesize
1.2MB

MD5
e5b44088941e2fe5ec8f8e160d7c5f11

SHA1
d8dc8fb855eaaa35e6c4bd84fdb8ac42450ee2d7

SHA256
235ca0544fcf3f022b2939f2b3c0f81aee82e888b9d764ab8d22fe1ed0f13248

SHA512
0eac3fc40fe0055348aab7ea1d3ec39ebf051786acda53f1f3feeda73eafc2999d8428ee83ed7ae892240d6f65e57e583df63c45783104f37a41ca4561d4d435

Download Submit
memory/1424-509-0x0000000000400000-0x0000000000766000-memory.dmp

Filesize
3.4MB

Download
memory/1424-505-0x0000000000400000-0x0000000000766000-memory.dmp

Filesize
3.4MB

Download
memory/1660-749-0x0000000000400000-0x0000000000766000-memory.dmp

Filesize
3.4MB

Download
memory/1660-745-0x0000000000400000-0x0000000000766000-memory.dmp

Filesize
3.4MB

Download
memory/1988-1225-0x0000000000400000-0x0000000000766000-memory.dmp

Filesize
3.4MB

Download
memory/2196-989-0x0000000000400000-0x0000000000766000-memory.dmp

Filesize
3.4MB

Download
memory/2196-985-0x0000000000400000-0x0000000000766000-memory.dmp

Filesize
3.4MB

Download
memory/2312-383-0x0000000000400000-0x0000000000766000-memory.dmp

Filesize
3.4MB

Download
memory/2312-265-0x0000000000400000-0x0000000000766000-memory.dmp

Filesize
3.4MB

Download
memory/2520-3-0x0000000004480000-0x0000000004482000-memory.dmp

Filesize
8KB

Download
memory/2520-7-0x0000000004390000-0x0000000004391000-memory.dmp

Filesize
4KB

Download
memory/2520-0-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2520-15-0x0000000000400000-0x0000000000766000-memory.dmp

Filesize
3.4MB

Download
memory/2520-16-0x0000000000400000-0x0000000000766000-memory.dmp

Filesize
3.4MB

Download
memory/2520-128-0x0000000000400000-0x0000000000766000-memory.dmp

Filesize
3.4MB

Download
memory/2520-1-0x0000000001F00000-0x0000000001FD6000-memory.dmp

Filesize
856KB

Download
memory/2520-2-0x00000000044C0000-0x00000000044C2000-memory.dmp

Filesize
8KB

Download
memory/2520-6-0x0000000004420000-0x0000000004421000-memory.dmp

Filesize
4KB

Download
memory/2520-8-0x0000000000401000-0x0000000000422000-memory.dmp

Filesize
132KB

Download
memory/2520-5-0x00000000043D0000-0x00000000043D1000-memory.dmp

Filesize
4KB

Download
memory/2732-385-0x0000000000400000-0x0000000000766000-memory.dmp

Filesize
3.4MB

Download
memory/2732-444-0x0000000000400000-0x0000000000766000-memory.dmp

Filesize
3.4MB

Download
memory/2784-1174-0x0000000000400000-0x0000000000766000-memory.dmp

Filesize
3.4MB

Download
memory/2784-1105-0x0000000000400000-0x0000000000766000-memory.dmp

Filesize
3.4MB

Download
memory/2916-685-0x0000000000400000-0x0000000000766000-memory.dmp

Filesize
3.4MB

Download
memory/2916-625-0x0000000000400000-0x0000000000766000-memory.dmp

Filesize
3.4MB

Download
memory/2968-144-0x0000000000400000-0x0000000000766000-memory.dmp

Filesize
3.4MB

Download
memory/2968-143-0x0000000000400000-0x0000000000766000-memory.dmp

Filesize
3.4MB

Download
memory/2968-142-0x0000000000400000-0x0000000000766000-memory.dmp

Filesize
3.4MB

Download
memory/2968-148-0x0000000000400000-0x0000000000766000-memory.dmp

Filesize
3.4MB

Download
memory/2968-137-0x0000000000400000-0x0000000000766000-memory.dmp

Filesize
3.4MB

Download
memory/2968-141-0x0000000000400000-0x0000000000766000-memory.dmp

Filesize
3.4MB

Download
memory/2968-139-0x0000000000400000-0x0000000000766000-memory.dmp

Filesize
3.4MB

Download
memory/2968-140-0x0000000000400000-0x0000000000766000-memory.dmp

Filesize
3.4MB

Download
memory/2984-865-0x0000000000400000-0x0000000000766000-memory.dmp

Filesize
3.4MB

Download
memory/2984-915-0x0000000000400000-0x0000000000766000-memory.dmp

Filesize
3.4MB

Download