metasploit | 2b8ca9167adfa1f750586e957d4ac4a0f5f3d260200167fb30e4b6caea9b0953

Analysis

max time kernel
147s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
17/09/2024, 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e7413f74d42ea5800098ed3e829e4482_JaffaCakes118.exe
Size

1.3MB
MD5

e7413f74d42ea5800098ed3e829e4482
SHA1

a948c60fbdc351f820ee2485a40ec770cb192043
SHA256

2b8ca9167adfa1f750586e957d4ac4a0f5f3d260200167fb30e4b6caea9b0953
SHA512

1fd09d2ce6a147163a7432c3a658f533a6ba130b1bc6ba493931976fd4c3d2a7845e11029bd0bbec08e7709ccfa1f93123ca4e6f24dc06f1df9c5681b85417c4
SSDEEP

3072:wjY4C6zJKEmIjV0s4wg8ShB/V50GSSOEPCQ4gn2CPETEwabZlXLRsHfBg580f70+:MY4vgv9ZBn/oGpOfQsabRr8c7yg

Score

10^/10

metasploit backdoor discovery evasion trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Modifies security service 2 TTPs 20 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe

Executes dropped EXE 10 IoCs

pid	Process
2484	msxdll.exe
2384	msxdll.exe
1948	msxdll.exe
2680	msxdll.exe
2360	msxdll.exe
1688	msxdll.exe
2616	msxdll.exe
1068	msxdll.exe
2800	msxdll.exe
1560	msxdll.exe

Loads dropped DLL 20 IoCs

pid	Process
2296	e7413f74d42ea5800098ed3e829e4482_JaffaCakes118.exe
2296	e7413f74d42ea5800098ed3e829e4482_JaffaCakes118.exe
2484	msxdll.exe
2484	msxdll.exe
2384	msxdll.exe
2384	msxdll.exe
1948	msxdll.exe
1948	msxdll.exe
2680	msxdll.exe
2680	msxdll.exe
2360	msxdll.exe
2360	msxdll.exe
1688	msxdll.exe
1688	msxdll.exe
2616	msxdll.exe
2616	msxdll.exe
1068	msxdll.exe
1068	msxdll.exe
2800	msxdll.exe
2800	msxdll.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File opened for modification	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File opened for modification	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File opened for modification	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File opened for modification	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File opened for modification	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File created	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File opened for modification	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File created	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File opened for modification	C:\Windows\SysWOW64\msxdll.exe	e7413f74d42ea5800098ed3e829e4482_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File opened for modification	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File created	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File created	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File created	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File opened for modification	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File created	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File opened for modification	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File created	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File created	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File created	C:\Windows\SysWOW64\msxdll.exe	e7413f74d42ea5800098ed3e829e4482_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe

System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e7413f74d42ea5800098ed3e829e4482_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msxdll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msxdll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msxdll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msxdll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msxdll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msxdll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msxdll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msxdll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msxdll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msxdll.exe

Runs .reg file with regedit 10 IoCs

pid	Process
2116	regedit.exe
3048	regedit.exe
868	regedit.exe
1524	regedit.exe
3000	regedit.exe
592	regedit.exe
2860	regedit.exe
2772	regedit.exe
2940	regedit.exe
1700	regedit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 3016	2296	e7413f74d42ea5800098ed3e829e4482_JaffaCakes118.exe	30
PID 2296 wrote to memory of 3016	2296	e7413f74d42ea5800098ed3e829e4482_JaffaCakes118.exe	30
PID 2296 wrote to memory of 3016	2296	e7413f74d42ea5800098ed3e829e4482_JaffaCakes118.exe	30
PID 2296 wrote to memory of 3016	2296	e7413f74d42ea5800098ed3e829e4482_JaffaCakes118.exe	30
PID 3016 wrote to memory of 2116	3016	cmd.exe	31
PID 3016 wrote to memory of 2116	3016	cmd.exe	31
PID 3016 wrote to memory of 2116	3016	cmd.exe	31
PID 3016 wrote to memory of 2116	3016	cmd.exe	31
PID 2296 wrote to memory of 2484	2296	e7413f74d42ea5800098ed3e829e4482_JaffaCakes118.exe	32
PID 2296 wrote to memory of 2484	2296	e7413f74d42ea5800098ed3e829e4482_JaffaCakes118.exe	32
PID 2296 wrote to memory of 2484	2296	e7413f74d42ea5800098ed3e829e4482_JaffaCakes118.exe	32
PID 2296 wrote to memory of 2484	2296	e7413f74d42ea5800098ed3e829e4482_JaffaCakes118.exe	32
PID 2484 wrote to memory of 2384	2484	msxdll.exe	33
PID 2484 wrote to memory of 2384	2484	msxdll.exe	33
PID 2484 wrote to memory of 2384	2484	msxdll.exe	33
PID 2484 wrote to memory of 2384	2484	msxdll.exe	33
PID 2384 wrote to memory of 1004	2384	msxdll.exe	34
PID 2384 wrote to memory of 1004	2384	msxdll.exe	34
PID 2384 wrote to memory of 1004	2384	msxdll.exe	34
PID 2384 wrote to memory of 1004	2384	msxdll.exe	34
PID 1004 wrote to memory of 592	1004	cmd.exe	35
PID 1004 wrote to memory of 592	1004	cmd.exe	35
PID 1004 wrote to memory of 592	1004	cmd.exe	35
PID 1004 wrote to memory of 592	1004	cmd.exe	35
PID 2384 wrote to memory of 1948	2384	msxdll.exe	36
PID 2384 wrote to memory of 1948	2384	msxdll.exe	36
PID 2384 wrote to memory of 1948	2384	msxdll.exe	36
PID 2384 wrote to memory of 1948	2384	msxdll.exe	36
PID 1948 wrote to memory of 1928	1948	msxdll.exe	37
PID 1948 wrote to memory of 1928	1948	msxdll.exe	37
PID 1948 wrote to memory of 1928	1948	msxdll.exe	37
PID 1948 wrote to memory of 1928	1948	msxdll.exe	37
PID 1928 wrote to memory of 2860	1928	cmd.exe	38
PID 1928 wrote to memory of 2860	1928	cmd.exe	38
PID 1928 wrote to memory of 2860	1928	cmd.exe	38
PID 1928 wrote to memory of 2860	1928	cmd.exe	38
PID 1948 wrote to memory of 2680	1948	msxdll.exe	39
PID 1948 wrote to memory of 2680	1948	msxdll.exe	39
PID 1948 wrote to memory of 2680	1948	msxdll.exe	39
PID 1948 wrote to memory of 2680	1948	msxdll.exe	39
PID 2680 wrote to memory of 1864	2680	msxdll.exe	40
PID 2680 wrote to memory of 1864	2680	msxdll.exe	40
PID 2680 wrote to memory of 1864	2680	msxdll.exe	40
PID 2680 wrote to memory of 1864	2680	msxdll.exe	40
PID 1864 wrote to memory of 3048	1864	cmd.exe	41
PID 1864 wrote to memory of 3048	1864	cmd.exe	41
PID 1864 wrote to memory of 3048	1864	cmd.exe	41
PID 1864 wrote to memory of 3048	1864	cmd.exe	41
PID 2680 wrote to memory of 2360	2680	msxdll.exe	42
PID 2680 wrote to memory of 2360	2680	msxdll.exe	42
PID 2680 wrote to memory of 2360	2680	msxdll.exe	42
PID 2680 wrote to memory of 2360	2680	msxdll.exe	42
PID 2360 wrote to memory of 2088	2360	msxdll.exe	43
PID 2360 wrote to memory of 2088	2360	msxdll.exe	43
PID 2360 wrote to memory of 2088	2360	msxdll.exe	43
PID 2360 wrote to memory of 2088	2360	msxdll.exe	43
PID 2088 wrote to memory of 868	2088	cmd.exe	44
PID 2088 wrote to memory of 868	2088	cmd.exe	44
PID 2088 wrote to memory of 868	2088	cmd.exe	44
PID 2088 wrote to memory of 868	2088	cmd.exe	44
PID 2360 wrote to memory of 1688	2360	msxdll.exe	45
PID 2360 wrote to memory of 1688	2360	msxdll.exe	45
PID 2360 wrote to memory of 1688	2360	msxdll.exe	45
PID 2360 wrote to memory of 1688	2360	msxdll.exe	45

C:\Users\Admin\AppData\Local\Temp\e7413f74d42ea5800098ed3e829e4482_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e7413f74d42ea5800098ed3e829e4482_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\a.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\SysWOW64\regedit.exe
    REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
    3⤵
    - Modifies security service
    - System Location Discovery: System Language Discovery
    - Runs .reg file with regedit
    PID:2116
- C:\Windows\SysWOW64\msxdll.exe
  C:\Windows\system32\msxdll.exe 452 "C:\Users\Admin\AppData\Local\Temp\e7413f74d42ea5800098ed3e829e4482_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\SysWOW64\msxdll.exe
    C:\Windows\system32\msxdll.exe 520 "C:\Windows\SysWOW64\msxdll.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2384
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c c:\a.bat
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1004
    - - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        5⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:592
  - - C:\Windows\SysWOW64\msxdll.exe
      C:\Windows\system32\msxdll.exe 528 "C:\Windows\SysWOW64\msxdll.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1948
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1928
      - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        6⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:2860
    - - C:\Windows\SysWOW64\msxdll.exe
        
        C:\Windows\system32\msxdll.exe 516 "C:\Windows\SysWOW64\msxdll.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2680
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1864
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        7⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:3048
      - C:\Windows\SysWOW64\msxdll.exe
        
        C:\Windows\system32\msxdll.exe 536 "C:\Windows\SysWOW64\msxdll.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2360
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2088
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        8⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:868
        
        C:\Windows\SysWOW64\msxdll.exe
        
        C:\Windows\system32\msxdll.exe 540 "C:\Windows\SysWOW64\msxdll.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1688
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2792
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        9⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:2772
        
        C:\Windows\SysWOW64\msxdll.exe
        
        C:\Windows\system32\msxdll.exe 544 "C:\Windows\SysWOW64\msxdll.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2616
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2380
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        10⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:1524
        
        C:\Windows\SysWOW64\msxdll.exe
        
        C:\Windows\system32\msxdll.exe 548 "C:\Windows\SysWOW64\msxdll.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1068
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2056
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        11⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:3000
        
        C:\Windows\SysWOW64\msxdll.exe
        
        C:\Windows\system32\msxdll.exe 552 "C:\Windows\SysWOW64\msxdll.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2800
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:2784
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        12⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:2940
        
        C:\Windows\SysWOW64\msxdll.exe
        
        C:\Windows\system32\msxdll.exe 556 "C:\Windows\SysWOW64\msxdll.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1560
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:2140
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        13⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
1daa413d1a8cd1692f2e4ae22b54c74a

SHA1
2e02e2a23cfaa62f301e29a117e291ff93cc5d31

SHA256
10732e2612780d9694faf0bb9b27cdc6f3376ad327da7dfc346e9e5579493d33

SHA512
b947c70c7c4af971e3fbdc66fb7175b6624ac68c6a723dac7ecb5cf5f43bbe210fa0fa61fd4b6153dccf7de077d003ca03f061e209dc37773546b038e6aef277

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
908860a865f8ed2e14085e35256578dd

SHA1
7ff5ee35cc7e96a661848eb95a70d0b8d2d78603

SHA256
d2b73d92cf00a9dc61f2777a7f298e8c4bb72697236965f8931bdfc9d0924c5f

SHA512
a93bb8cb180d957ef2b2c511d5ff66a25d2bcfb071af9884c146b8c422d1fadc9a4d390712bc2cb27640634854b3e59d5209803373cf1f42381d513747a65fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
c8441ec8a2edf9b2f4f631fe930ea4d9

SHA1
2855ee21116b427d280fcaa2471c9bd3d2957f6f

SHA256
dd2fa55643d4e02b39ef5a619f2ca63e49d6cc1e6513d953c2d9400d46b88184

SHA512
b0b03828275f895adf93ef6b9d40d31e10f166d40c1ee0f5697aadcee1b6d5e8b81637ccfcf66ba9dfd92295f106cfac0eca2320b71a15ad96fdbe06f6764ef7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
a920eceddece6cf7f3487fd8e919af34

SHA1
a6dee2d31d4cbd1b18f5d3bc971521411a699889

SHA256
ec2d3952154412db3202f5c95e4d1b02c40a7f71f4458898ddc36e827a7b32d6

SHA512
a4700af2ce477c7ce33f434cdddd4031e88c3926d05475f522a753063269fe8b6e50b649c3e939272240194951cb70ac05df533978c19839e381141535275ecc

Download Submit
C:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
\Windows\SysWOW64\msxdll.exe

Filesize
1.3MB

MD5
e7413f74d42ea5800098ed3e829e4482

SHA1
a948c60fbdc351f820ee2485a40ec770cb192043

SHA256
2b8ca9167adfa1f750586e957d4ac4a0f5f3d260200167fb30e4b6caea9b0953

SHA512
1fd09d2ce6a147163a7432c3a658f533a6ba130b1bc6ba493931976fd4c3d2a7845e11029bd0bbec08e7709ccfa1f93123ca4e6f24dc06f1df9c5681b85417c4

Download Submit
memory/1068-972-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/1560-1210-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/1688-733-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/1948-375-0x0000000002FD0000-0x000000000311B000-memory.dmp

Filesize
1.3MB

Download
memory/1948-372-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2296-129-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2296-124-0x0000000002ED0000-0x000000000301B000-memory.dmp

Filesize
1.3MB

Download
memory/2296-126-0x0000000002ED0000-0x000000000301B000-memory.dmp

Filesize
1.3MB

Download
memory/2296-0-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2360-613-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2360-616-0x0000000002FD0000-0x000000000311B000-memory.dmp

Filesize
1.3MB

Download
memory/2384-252-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2384-136-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2384-255-0x0000000002F50000-0x000000000309B000-memory.dmp

Filesize
1.3MB

Download
memory/2484-134-0x0000000002F30000-0x000000000307B000-memory.dmp

Filesize
1.3MB

Download
memory/2484-131-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2484-128-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2616-737-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2616-853-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2680-496-0x0000000003010000-0x000000000315B000-memory.dmp

Filesize
1.3MB

Download
memory/2680-493-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2680-377-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2800-1091-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads