Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
301s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
19/09/2024, 17:22
Behavioral task
behavioral1
Sample
DoomRat.exe
Resource
win10-20240404-en
General
-
Target
DoomRat.exe
-
Size
12.1MB
-
MD5
0cf5c5253e621e56587ead9ccf6fc23c
-
SHA1
0f3d67f82bf309ac7ac3df68a78be948c12a0cad
-
SHA256
2c6b6b7588405b536d24bad92d809fc1a71c389c93154b3571463dd0d8774404
-
SHA512
6fcf003361c4e53eea1ff32304ad765e76d92e613d94515008e3dc291008fcd76809008f1436dbe202bbebf762286551b001e534c6626ba0dc9062758a0c8ed9
-
SSDEEP
393216:tGV2CSQhZ2YsHFUK2Jn1+TtIiFQS2NXNsI8VbTToP:0YQZ2YwUlJn1QtIm28IKzo
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Extracted
berbew
http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://mazafaka.ru/index.htm
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://fethard.biz/index.htm
http://tat-neftbank.ru/kkq.php
http://tat-neftbank.ru/wcmd.htm
http://master-x.com/index.php
http://kaspersky.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://kaspersky.ru/index.htm
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dahhio32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Neppokal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pcncpbmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jehhaaci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ocdqjceo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mlbbkfoq.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mbhamajc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mekgdl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oiihahme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mebcop32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Calhnpgn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kbghfc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knippe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Eopbnbhd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lkeekk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" 240919-vlswzszcqe64918dfacc11cad87abfe9b80cfe6dd73f1d0299ea8bc3b64ab8ed6e1a6a9269N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dkifae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mibijk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nbcqiope.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ogklelna.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oneklm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pncgmkmj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Klfjijgq.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 240919-vadypazckp812b29bc2a805bf09ba6a61d196dc4d5ef1e7f588b8f13e47ba54ba58ef09374N.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lflgmqhd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ocffempp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ocffempp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ofqpqo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jkkjmlan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mhppji32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oileggkb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lkeekk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dahhio32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eejjjl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Doilmc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mekgdl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ogpepl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lkeekk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mkadfj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Olmeci32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pdkcde32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dmgbnq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jnifigpa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kfcdfbqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" 240919-vkemzazcke88e67828ca990f42674a675cab2e7bd2d9c2ca44803915c6b8d4d3a1970981bdN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Phcomcng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Phcomcng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" 240919-vq77gazfjgBackdoor.Win32.Berbew.pz-2a8744c57db58b5b6edd3161ac4315308b99f701e5efc7357334d2858a58808cN Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jgonlm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" 240919-vm262szhmlecb603829d1ad080923bd44410f868624e8672ef2334ad7c0b1646f827063f1dN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jnnpdg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Llbidimc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Phcomcng.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Likjcbkc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oneklm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qnhahj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Doilmc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kbghfc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nomncpcg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lkeekk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lpcfkm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ocgmpccl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dmgbnq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Miomdk32.exe -
Detect Blackmoon payload 6 IoCs
resource yara_rule behavioral1/memory/3172-619-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/5668-669-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/5628-579-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/4056-459-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3536-390-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3556-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral1/memory/2252-196-0x0000000000400000-0x0000000000420000-memory.dmp family_gh0strat behavioral1/memory/2252-553-0x0000000000400000-0x0000000000420000-memory.dmp family_gh0strat -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\Microsoft.exe" 240919-vkjxpazgklebcbdcf67d668cb60850bffcab1976d3_JaffaCakes118.exe -
Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\Downloads\240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe = "C:\\Users\\Admin\\Downloads\\240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe:*:enabled:@shell32.dll,-1" 240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Program Files (x86)\Java\jre-09\bin\jusched.exe = "C:\\Program Files (x86)\\Java\\jre-09\\bin\\jusched.exe:*:Enabled:JavaUpdate9" 240919-vvka7szgmc09c66ce05f1a3b1014b5f7a2c114ed07c83e79ca68a6a4b9b28abdb1da58f120N.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\Downloads\240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe = "C:\\Users\\Admin\\Downloads\\240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe:*:Enabled:ipsec" 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications 240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile 240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List 240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe -
Modifies security service 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" .exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4" .exe -
Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 240919-vpj39azelaafe2c96862b4f2822d6aa5edb58411a9fdf84f336dd7281ffe0be18017aad01aN.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 240919-vl9vhazhjp053b148abb83b29b9f0f6618ae0c3eefc79cf910d691ce191a2945c3763ce429N.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 240919-vv9abszgpe14404e9ba4f12a186174ef0d4c1918fc8a29a0126ca31784258fb8e9c6f9691cN.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe -
pid Process 42188 Process not Found 46584 Process not Found 40724 Process not Found 33852 Process not Found 46524 Process not Found -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\DRIVERS\ETC\HOSTS 240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USBCleaner.exe .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQLiveUpdate.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvolself.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVStub.kxp\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQLiveUpdate.exe .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NPFMntor.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRepair.com .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvDetect.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmartUp.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapw32.exe .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAgent.exe .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpLive.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVStub.kxp .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQUpdateCenter.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webscanx.exe .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32X.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxCfg.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSetup.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMFilter.exe .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP_1.kxp\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FTCleanerShell.exe .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvDetect.exe .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxPol.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPF.exe .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ArSwp.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvfwMcl.exe .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe .exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\upiea.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\.exe" .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EGHOST.exe .exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kabaload.exe .exe -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Microsoft Corporation\Parameters\ServiceDll = "C:\\Program Files (x86)\\coolscsi.dll" 240919-vsmnjs1blpebd18eac83a0b3a2be572192605241b7_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 2896 240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe 4364 240919-vv65zazgpcebd34bb14d058f27e2501c75ce3fa295_JaffaCakes118.exe 2724 240919-vvka7szgmc09c66ce05f1a3b1014b5f7a2c114ed07c83e79ca68a6a4b9b28abdb1da58f120N.exe 3852 240919-vpj39azelaafe2c96862b4f2822d6aa5edb58411a9fdf84f336dd7281ffe0be18017aad01aN.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 4612 240919-vm262szhmlecb603829d1ad080923bd44410f868624e8672ef2334ad7c0b1646f827063f1dN.exe 5056 240919-vq77gazfjgBackdoor.Win32.Berbew.pz-2a8744c57db58b5b6edd3161ac4315308b99f701e5efc7357334d2858a58808cN 3556 240919-vp3wcszenb07ccd182b9a63c0ca1dbdd05338b53fb9d10efdaca2d6e69b0e54e45fa2b38afN.exe 2252 240919-vsmnjs1blpebd18eac83a0b3a2be572192605241b7_JaffaCakes118.exe 3200 240919-vkjxpazgklebcbdcf67d668cb60850bffcab1976d3_JaffaCakes118.exe 4584 Microsoft.exe 2936 240919-vrw6la1arpf43072f98e9447e10c29ee375f9d0250a48a68e12ad7b4d19ce8ccb5549a53cdN.exe 4504 240919-vss6bszfpd2ad7ac94ed750d3e50c636392db4c2ebb61b26c5c5e6937da911ac14ffbe13bbN.exe 3600 Likjcbkc.exe 4628 240919-vflwgszanaebc8ff4682ba11477dba787d41a909c9_JaffaCakes118.exe 2420 Lpcfkm32.exe 3536 22626.exe 3164 240919-vvl5ss1ckka665e7df7d2773e00307c95fb2b4081ee6feac3849424dd7bd1880f22f4553caN.exe 2024 240919-vl9vhazhjp053b148abb83b29b9f0f6618ae0c3eefc79cf910d691ce191a2945c3763ce429N.exe 1776 240919-vwtk9szhjaadc173d22faaae6ae17fd366330136af45c9898e257df3e8551ef5eedc001bfdN.exe 2092 240919-vn1plszejc436fda91edb20686cb9332a7732b427df5c32b73255573723dab257fc0eeb18dN.exe 2032 240919-vplxvazelce661a3eda783a78b5f58e0f1d240f2a74b8e8b943cb5d2b37e3d40ab24de7ea3N.exe 1040 240919-vvarrs1cjnc006f0529322d36535202243f2c80c528a3b619885f92060193cb58e0eb01151N.exe 4176 240919-vlthhszgql04462b9e68a6e6d3d43c696da44de7200939cafdb71319146699bc61868e6c8aN.exe 4672 240919-vjwvvszfqr039f29698e42f307e9620bb4e6b53238b68d2f86f83ac2db98ab47cb68611317N.exe 1928 Odmgcgbi.exe 5092 Opakbi32.exe 4056 808648.exe 2912 Oneklm32.exe 4864 Olhlhjpd.exe 532 Odocigqg.exe 3404 Ocbddc32.exe 4704 Ofqpqo32.exe 4768 Olcbmj32.exe 5212 Ocdqjceo.exe 5244 Ogpmjb32.exe 5280 .exe 5340 Olmeci32.exe 5356 Olmeci32.exe 5408 240919-vlswzszcqe64918dfacc11cad87abfe9b80cfe6dd73f1d0299ea8bc3b64ab8ed6e1a6a9269N.exe 5420 Onjegled.exe 5468 Oqhacgdh.exe 5476 Ocgmpccl.exe 5512 Ojaelm32.exe 5628 bttbbh.exe 5656 Pmannhhj.exe 5700 Pqmjog32.exe 5844 .exe 5868 Pqpgdfnp.exe 6020 240919-vsemyazfmh9a383b731834440490195dd6d014d14922aac052ed8467402644ecd4ba26e539N.exe 6108 Pcncpbmd.exe 6124 Pcncpbmd.exe 384 Qnjnnj32.exe 3172 82606.exe 4520 Pncgmkmj.exe 2296 Qnhahj32.exe 1296 Pdkcde32.exe 5208 Cmqmma32.exe 5332 Calhnpgn.exe 5624 Dkifae32.exe 5668 dvpjd.exe 5792 Dmgbnq32.exe 5820 Daconoae.exe 5840 Dmgbnq32.exe -
Loads dropped DLL 25 IoCs
pid Process 4956 DoomRat.exe 4956 DoomRat.exe 4956 DoomRat.exe 4956 DoomRat.exe 4956 DoomRat.exe 4956 DoomRat.exe 4956 DoomRat.exe 4956 DoomRat.exe 4956 DoomRat.exe 4956 DoomRat.exe 4956 DoomRat.exe 4956 DoomRat.exe 4956 DoomRat.exe 4956 DoomRat.exe 4956 DoomRat.exe 4956 DoomRat.exe 4956 DoomRat.exe 4956 DoomRat.exe 4956 DoomRat.exe 4956 DoomRat.exe 1624 svchost.exe 4176 240919-vlthhszgql04462b9e68a6e6d3d43c696da44de7200939cafdb71319146699bc61868e6c8aN.exe 7300 regsvr32.exe 7300 regsvr32.exe 7800 rundll32.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/3172-619-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5668-669-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/5992-646-0x0000000002290000-0x000000000331E000-memory.dmp upx behavioral1/memory/5992-689-0x0000000002290000-0x000000000331E000-memory.dmp upx behavioral1/memory/5992-690-0x0000000002290000-0x000000000331E000-memory.dmp upx behavioral1/memory/1360-902-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/5992-688-0x0000000002290000-0x000000000331E000-memory.dmp upx behavioral1/memory/5992-657-0x0000000002290000-0x000000000331E000-memory.dmp upx behavioral1/memory/4584-703-0x0000000000580000-0x0000000000596000-memory.dmp upx behavioral1/memory/5628-579-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/4584-509-0x0000000000580000-0x0000000000596000-memory.dmp upx behavioral1/memory/4056-459-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x000700000001aecb-2543.dat upx behavioral1/memory/3536-390-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3556-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x000300000002f921-18795.dat upx -
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched9 = "C:\\Program Files (x86)\\Java\\jre-09\\bin\\jusched.exe" 240919-vvka7szgmc09c66ce05f1a3b1014b5f7a2c114ed07c83e79ca68a6a4b9b28abdb1da58f120N.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 63 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\p: .exe File opened (read-only) \??\X: 240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe File opened (read-only) \??\z: .exe File opened (read-only) \??\t: .exe File opened (read-only) \??\V: 240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe File opened (read-only) \??\Z: 240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe File opened (read-only) \??\y: .exe File opened (read-only) \??\g: .exe File opened (read-only) \??\m: .exe File opened (read-only) \??\n: .exe File opened (read-only) \??\S: 240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe File opened (read-only) \??\T: 240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe File opened (read-only) \??\U: 240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe File opened (read-only) \??\G: 240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe File opened (read-only) \??\I: 240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe File opened (read-only) \??\L: 240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe File opened (read-only) \??\M: 240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe File opened (read-only) \??\O: 240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe File opened (read-only) \??\w: .exe File opened (read-only) \??\o: .exe File opened (read-only) \??\s: .exe File opened (read-only) \??\v: .exe File opened (read-only) \??\x: .exe File opened (read-only) \??\x: .exe File opened (read-only) \??\K: 240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe File opened (read-only) \??\e: .exe File opened (read-only) \??\u: .exe File opened (read-only) \??\v: .exe File opened (read-only) \??\i: .exe File opened (read-only) \??\r: .exe File opened (read-only) \??\w: .exe File opened (read-only) \??\q: .exe File opened (read-only) \??\n: .exe File opened (read-only) \??\t: .exe File opened (read-only) \??\h: .exe File opened (read-only) \??\y: .exe File opened (read-only) \??\W: 240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe File opened (read-only) \??\h: .exe File opened (read-only) \??\k: .exe File opened (read-only) \??\m: .exe File opened (read-only) \??\p: .exe File opened (read-only) \??\q: .exe File opened (read-only) \??\k: .exe File opened (read-only) \??\l: .exe File opened (read-only) \??\r: .exe File opened (read-only) \??\z: .exe File opened (read-only) \??\E: 240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe File opened (read-only) \??\s: .exe File opened (read-only) \??\P: 240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe File opened (read-only) \??\R: 240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe File opened (read-only) \??\g: .exe File opened (read-only) \??\u: .exe File opened (read-only) \??\H: 240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe File opened (read-only) \??\i: .exe File opened (read-only) \??\e: .exe File opened (read-only) \??\j: .exe File opened (read-only) \??\J: 240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe File opened (read-only) \??\Q: 240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe File opened (read-only) \??\j: .exe File opened (read-only) \??\o: .exe File opened (read-only) \??\N: 240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe File opened (read-only) \??\Y: 240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe File opened (read-only) \??\l: .exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 1 pastebin.com 2 pastebin.com -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 419 api.ipify.org 420 api.ipify.org 729 checkip.dyndns.org -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification \??\c:\autorun.inf .exe File opened for modification \??\f:\autorun.inf .exe File created \??\f:\autorun.inf .exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Odmgcgbi.exe 240919-vss6bszfpd2ad7ac94ed750d3e50c636392db4c2ebb61b26c5c5e6937da911ac14ffbe13bbN.exe File opened for modification C:\Windows\SysWOW64\Ofqpqo32.exe 240919-vjwvvszfqr039f29698e42f307e9620bb4e6b53238b68d2f86f83ac2db98ab47cb68611317N.exe File opened for modification C:\Windows\SysWOW64\Dcgmfg32.dll Ohnebd32.exe File created C:\Windows\SysWOW64\Bdmoejcc.dll Eecdjmfi.exe File created C:\Windows\SysWOW64\Ocbddc32.exe 240919-vvarrs1cjnc006f0529322d36535202243f2c80c528a3b619885f92060193cb58e0eb01151N.exe File created C:\Windows\SysWOW64\Llmglb32.dll 240919-vvarrs1cjnc006f0529322d36535202243f2c80c528a3b619885f92060193cb58e0eb01151N.exe File opened for modification C:\Windows\SysWOW64\Miomdk32.exe Lflgmqhd.exe File opened for modification C:\Windows\SysWOW64\Ihidnp32.dll Qnhahj32.exe File created C:\Windows\SysWOW64\Jdmmkl32.dll Lbchba32.exe File created C:\Windows\SysWOW64\Ohlimd32.exe Niklpj32.exe File opened for modification C:\Windows\SysWOW64\Mnpabe32.exe Mgaokl32.exe File opened for modification C:\Windows\SysWOW64\Pdkcde32.exe Onjegled.exe File created C:\Windows\SysWOW64\Gpijle32.dll Kpiljh32.exe File created C:\Windows\SysWOW64\Mhppji32.exe Lihfcm32.exe File created C:\Windows\SysWOW64\Phcomcng.exe Ogpepl32.exe File opened for modification C:\Windows\SysWOW64\Moobbb32.exe Medqcmki.exe File opened for modification C:\Windows\SysWOW64\Ngjbaj32.exe Mjdebfnd.exe File opened for modification C:\Windows\SysWOW64\Ogklelna.exe Nomncpcg.exe File opened for modification C:\Windows\SysWOW64\Phcomcng.exe Ogpepl32.exe File created C:\Windows\SysWOW64\Mebcop32.exe Lkeekk32.exe File created C:\Windows\SysWOW64\Hdoemjgn.dll Ogpmjb32.exe File created C:\Windows\SysWOW64\Efqidp32.dll Fedmqk32.exe File created C:\Windows\SysWOW64\Lbchba32.exe Llbidimc.exe File created C:\Windows\SysWOW64\Phcomcng.exe Ogpepl32.exe File created C:\Windows\SysWOW64\Lkeekk32.exe Ocffempp.exe File created C:\Windows\SysWOW64\Cipqnf32.dll Egijmegb.exe File opened for modification C:\Windows\SysWOW64\Knippe32.exe Kelalp32.exe File created C:\Windows\SysWOW64\Mekgdl32.exe Lihfcm32.exe File opened for modification C:\Windows\SysWOW64\Ncofplba.exe Mkadfj32.exe File opened for modification C:\Windows\SysWOW64\Opakbi32.exe Likjcbkc.exe File created C:\Windows\SysWOW64\Klfjijgq.exe Jnifigpa.exe File opened for modification C:\Windows\SysWOW64\Nomncpcg.exe 240919-vbftnszcpqaa8b64dd1a42426324eb18d33cb6517b6adc86d6160fa657bc23519914966d4cN.exe File opened for modification C:\Windows\SysWOW64\Oomibind.dll Pqmjog32.exe File created C:\Windows\SysWOW64\Ehjhee32.dll Ehfjah32.exe File opened for modification C:\Windows\SysWOW64\Kfjapcii.exe Jkodhk32.exe File opened for modification C:\Windows\SysWOW64\Klfjijgq.exe Jnifigpa.exe File created C:\Windows\SysWOW64\Niklpj32.exe Miomdk32.exe File created C:\Windows\SysWOW64\Dnjonh32.dll Nbcqiope.exe File created C:\Windows\SysWOW64\Mjbbkg32.dll 240919-vrw6la1arpf43072f98e9447e10c29ee375f9d0250a48a68e12ad7b4d19ce8ccb5549a53cdN.exe File created C:\Windows\SysWOW64\Daconoae.exe Calhnpgn.exe File created C:\Windows\SysWOW64\Joicekop.dll Phcomcng.exe File created C:\Windows\SysWOW64\Ecphpc32.dll 240919-vadypazckp812b29bc2a805bf09ba6a61d196dc4d5ef1e7f588b8f13e47ba54ba58ef09374N.exe File created C:\Windows\SysWOW64\Fgeihcme.exe Eaonjngh.exe File created C:\Windows\SysWOW64\Mifcejnj.exe Mbhamajc.exe File created C:\Windows\SysWOW64\Bandgi32.dll Ocdjpmac.exe File created C:\Windows\SysWOW64\Acpcoaap.dll Ocbddc32.exe File created C:\Windows\SysWOW64\Fhgbhfbe.exe Ehfjah32.exe File created C:\Windows\SysWOW64\Dkifae32.exe Pdkcde32.exe File opened for modification C:\Windows\SysWOW64\Egijmegb.exe Doilmc32.exe File opened for modification C:\Windows\SysWOW64\Joffnk32.exe Gkglja32.exe File created C:\Windows\SysWOW64\Copkngdi.dll 240919-vjnjgszfpp7409743b80d4ea8661d0975beba77e352dddc0ed646134574c88207c3ec6593fN.exe File created C:\Windows\SysWOW64\Ngjbaj32.exe Mjdebfnd.exe File opened for modification C:\Windows\SysWOW64\Kbghfc32.exe 240919-vadypazckp812b29bc2a805bf09ba6a61d196dc4d5ef1e7f588b8f13e47ba54ba58ef09374N.exe File created C:\Windows\SysWOW64\Gdodhh32.dll Neppokal.exe File created C:\Windows\SysWOW64\Fnipgg32.dll Lkeekk32.exe File opened for modification C:\Windows\SysWOW64\Pmannhhj.exe Ogpmjb32.exe File opened for modification C:\Windows\SysWOW64\Jehhaaci.exe Joffnk32.exe File created C:\Windows\SysWOW64\Oklmii32.dll Kelalp32.exe File created C:\Windows\SysWOW64\Nqomdf32.dll Mhppji32.exe File opened for modification C:\Windows\SysWOW64\Dcgmfg32.dll Phcomcng.exe File created C:\Windows\SysWOW64\Doogdl32.dll Mnpabe32.exe File created C:\Windows\SysWOW64\Miiflecc.dll Foqkdp32.exe File opened for modification C:\Windows\SysWOW64\Kpiljh32.exe Knefeffd.exe File created C:\Windows\SysWOW64\Kfcdfbqo.exe Jehhaaci.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4176 set thread context of 8040 4176 240919-vlthhszgql04462b9e68a6e6d3d43c696da44de7200939cafdb71319146699bc61868e6c8aN.exe 179 -
Drops file in Program Files directory 27 IoCs
description ioc Process File created C:\Program Files (x86)\coolscsi.dll 240919-vsmnjs1blpebd18eac83a0b3a2be572192605241b7_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\System\.exe .exe File opened for modification C:\Program Files\meex.exe .exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\.EXE .exe File opened for modification C:\Program Files\DLD.DAT .exe File created C:\Program Files\Common Files\Microsoft Shared\.exe 240919-vflwgszanaebc8ff4682ba11477dba787d41a909c9_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\System .exe File created C:\Program Files\meex.exe .exe File created C:\Program Files\3.hiv .exe File created C:\Program Files\Common Files\Microsoft Shared\)257ta).inf .exe File opened for modification C:\Program Files\Common Files\System\.exe 240919-vflwgszanaebc8ff4682ba11477dba787d41a909c9_JaffaCakes118.exe File created C:\Program Files (x86)\Java\jre-09\bin\UF 240919-vvka7szgmc09c66ce05f1a3b1014b5f7a2c114ed07c83e79ca68a6a4b9b28abdb1da58f120N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\SYSTEM\.EXE .exe File opened for modification C:\Program Files (x86)\Java\jre-09\bin\jusched.exe 240919-vvka7szgmc09c66ce05f1a3b1014b5f7a2c114ed07c83e79ca68a6a4b9b28abdb1da58f120N.exe File opened for modification C:\Program Files\Common Files\System\.exe .exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\.exe .exe File created C:\Program Files\1.hiv .exe File created C:\Program Files\4.hiv .exe File created C:\Program Files\Common Files\System\.exe 240919-vflwgszanaebc8ff4682ba11477dba787d41a909c9_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\System\)257ta).inf .exe File created C:\Program Files\Common Files\System\)257ta).inf .exe File created C:\Program Files (x86)\Java\jre-09\bin\jusched.exe 240919-vvka7szgmc09c66ce05f1a3b1014b5f7a2c114ed07c83e79ca68a6a4b9b28abdb1da58f120N.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\.exe .exe File opened for modification C:\Program Files\Common Files\Microsoft Shared .exe File created C:\Program Files\2.hiv .exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\)257ta).inf .exe File opened for modification C:\PROGRAM FILES\COMMON FILES\SYSTEM\.EXE .exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe File created C:\Windows\Microsoft.exe 240919-vkjxpazgklebcbdcf67d668cb60850bffcab1976d3_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.exe 240919-vkjxpazgklebcbdcf67d668cb60850bffcab1976d3_JaffaCakes118.exe File opened for modification C:\windows\dini.ini 240919-vsmnjs1blpebd18eac83a0b3a2be572192605241b7_JaffaCakes118.exe File created C:\Windows\swetak.jfg Microsoft.exe File opened for modification C:\Windows\dl2sas.dtc Microsoft.exe File created C:\Windows\dl2sas.dtc Microsoft.exe File created C:\Windows\Deleteme.bat 240919-vkjxpazgklebcbdcf67d668cb60850bffcab1976d3_JaffaCakes118.exe -
Launches sc.exe 15 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 44300 Process not Found 55768 Process not Found 61060 Process not Found 56772 Process not Found 37696 Process not Found 46632 Process not Found 44260 Process not Found 54532 Process not Found 53876 Process not Found 18516 sc.exe 35532 Process not Found 51992 Process not Found 41604 Process not Found 49776 Process not Found 58592 Process not Found -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 7552 6540 WerFault.exe 5248 2724 WerFault.exe 77 3808 4504 WerFault.exe 87 3184 3852 WerFault.exe 78 12752 13900 WerFault.exe 774 32352 23936 Process not Found 2092 37760 32876 Process not Found 46108 46016 Process not Found 3260 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ocffempp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pcncpbmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kfjapcii.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lhkgoiqe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oileggkb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ogpepl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 240919-vv65zazgpcebd34bb14d058f27e2501c75ce3fa295_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gkglja32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgonlm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lbchba32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Moobbb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mnpabe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Microsoft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22626.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Egijmegb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eaonjngh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lkeekk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 240919-t6882azaqjPOA1702108.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6282044.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lkeekk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 240919-vvarrs1cjnc006f0529322d36535202243f2c80c528a3b619885f92060193cb58e0eb01151N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4848882.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04400.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 240919-vv9abszgpe14404e9ba4f12a186174ef0d4c1918fc8a29a0126ca31784258fb8e9c6f9691cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Knippe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nomncpcg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nbcqiope.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ohnebd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 240919-vkjxpazgklebcbdcf67d668cb60850bffcab1976d3_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmgbnq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Joffnk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mibijk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i220488.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ncofplba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dkifae32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jnifigpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Olcbmj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language g2262.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgonlm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mifcejnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Niklpj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 240919-vvl5ss1ckka665e7df7d2773e00307c95fb2b4081ee6feac3849424dd7bd1880f22f4553caN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ocbddc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pmannhhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dahhio32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Foqkdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oiihahme.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 240919-vdez6ayhne1b8c2896e6258b0993b31328f1e9db2a68c155f7babbdeeb3a0a5d34fc649ba9N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lihfcm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ogklelna.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Neppokal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 240919-vplxvazelce661a3eda783a78b5f58e0f1d240f2a74b8e8b943cb5d2b37e3d40ab24de7ea3N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Doilmc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ocdjpmac.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 240919-vdnbjazdpj70c62f4f0f3a13513b7b259c4233d26a38cd350ab5160409ac7c5d0df458b95bN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mebcop32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m2808.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phcomcng.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mmbanbmg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 240919-vm262szhmlecb603829d1ad080923bd44410f868624e8672ef2334ad7c0b1646f827063f1dN.exe -
System Time Discovery 1 TTPs 9 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 44372 Process not Found 45968 Process not Found 49544 Process not Found 49536 Process not Found 50004 Process not Found 57540 Process not Found 9604 Process not Found 46976 Process not Found 62088 Process not Found -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 240919-vq77gazfjgBackdoor.Win32.Berbew.pz-2a8744c57db58b5b6edd3161ac4315308b99f701e5efc7357334d2858a58808cN Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gihpinci.dll" Jkkjmlan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Neppokal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ogpepl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mcecjmkl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mkmkkjko.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acpcoaap.dll" Ocbddc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" 240919-vdnbjazdpj70c62f4f0f3a13513b7b259c4233d26a38cd350ab5160409ac7c5d0df458b95bN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffangg32.dll" Ogpepl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ocgmpccl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pncgmkmj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eecdjmfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oanjomjp.dll" Ncofplba.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pmannhhj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" 240919-vsemyazfmh9a383b731834440490195dd6d014d14922aac052ed8467402644ecd4ba26e539N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 240919-vplxvazelce661a3eda783a78b5f58e0f1d240f2a74b8e8b943cb5d2b37e3d40ab24de7ea3N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fehfljca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efqidp32.dll" Fedmqk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lflgmqhd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\TypeLib\ = "{CE673B02-973C-4268-A819-DA005C782B5D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dmgbnq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekbngp32.dll" Doilmc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ammegk32.dll" Jgonlm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jkkjmlan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lflgmqhd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ocffempp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdheac32.dll" Pdkcde32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Moobbb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lkeekk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naeheh32.dll" Qnjnnj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmgabj32.dll" Opakbi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffangg32.dll" Ogpepl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khddfdcl.dll" Doilmc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Eaonjngh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kfcdfbqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ohlimd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ohnebd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnipgg32.dll" Lkeekk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mcjmel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jajnolnk.dll" Oqhacgdh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgqpjb32.dll" Knippe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kfcdfbqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Nbcqiope.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ogklelna.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jilkmnni.dll" Olhlhjpd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmphmhjc.dll" Pqpgdfnp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjmkqm32.dll" Eejjjl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jieqei32.dll" Jgonlm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kbghfc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" 240919-vlswzszcqe64918dfacc11cad87abfe9b80cfe6dd73f1d0299ea8bc3b64ab8ed6e1a6a9269N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jkodhk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mhppji32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oomibind.dll" Ocgmpccl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pqnalj32.dll" Fehfljca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nboahd32.dll" Kfcdfbqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nbcqiope.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ogpepl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Likjcbkc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jgonlm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjdcihik.dll" Jnnpdg32.exe -
Runs net.exe
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 64236 Process not Found 51628 Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3200 240919-vkjxpazgklebcbdcf67d668cb60850bffcab1976d3_JaffaCakes118.exe 3200 240919-vkjxpazgklebcbdcf67d668cb60850bffcab1976d3_JaffaCakes118.exe 3200 240919-vkjxpazgklebcbdcf67d668cb60850bffcab1976d3_JaffaCakes118.exe 3200 240919-vkjxpazgklebcbdcf67d668cb60850bffcab1976d3_JaffaCakes118.exe 3200 240919-vkjxpazgklebcbdcf67d668cb60850bffcab1976d3_JaffaCakes118.exe 3200 240919-vkjxpazgklebcbdcf67d668cb60850bffcab1976d3_JaffaCakes118.exe 4584 Microsoft.exe 4584 Microsoft.exe 4584 Microsoft.exe 4584 Microsoft.exe 4584 Microsoft.exe 4584 Microsoft.exe 5280 .exe 5280 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe -
Suspicious behavior: MapViewOfSection 64 IoCs
pid Process 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 3852 240919-vpj39azelaafe2c96862b4f2822d6aa5edb58411a9fdf84f336dd7281ffe0be18017aad01aN.exe Token: SeRestorePrivilege 3852 240919-vpj39azelaafe2c96862b4f2822d6aa5edb58411a9fdf84f336dd7281ffe0be18017aad01aN.exe Token: SeBackupPrivilege 3852 240919-vpj39azelaafe2c96862b4f2822d6aa5edb58411a9fdf84f336dd7281ffe0be18017aad01aN.exe Token: SeChangeNotifyPrivilege 3852 240919-vpj39azelaafe2c96862b4f2822d6aa5edb58411a9fdf84f336dd7281ffe0be18017aad01aN.exe Token: SeTakeOwnershipPrivilege 3852 240919-vpj39azelaafe2c96862b4f2822d6aa5edb58411a9fdf84f336dd7281ffe0be18017aad01aN.exe Token: SeRestorePrivilege 3852 240919-vpj39azelaafe2c96862b4f2822d6aa5edb58411a9fdf84f336dd7281ffe0be18017aad01aN.exe Token: SeBackupPrivilege 3852 240919-vpj39azelaafe2c96862b4f2822d6aa5edb58411a9fdf84f336dd7281ffe0be18017aad01aN.exe Token: SeChangeNotifyPrivilege 3852 240919-vpj39azelaafe2c96862b4f2822d6aa5edb58411a9fdf84f336dd7281ffe0be18017aad01aN.exe Token: SeTakeOwnershipPrivilege 3852 240919-vpj39azelaafe2c96862b4f2822d6aa5edb58411a9fdf84f336dd7281ffe0be18017aad01aN.exe Token: SeRestorePrivilege 3852 240919-vpj39azelaafe2c96862b4f2822d6aa5edb58411a9fdf84f336dd7281ffe0be18017aad01aN.exe Token: SeBackupPrivilege 3852 240919-vpj39azelaafe2c96862b4f2822d6aa5edb58411a9fdf84f336dd7281ffe0be18017aad01aN.exe Token: SeChangeNotifyPrivilege 3852 240919-vpj39azelaafe2c96862b4f2822d6aa5edb58411a9fdf84f336dd7281ffe0be18017aad01aN.exe Token: SeBackupPrivilege 5280 .exe Token: SeRestorePrivilege 5280 .exe Token: SeBackupPrivilege 5280 .exe Token: SeRestorePrivilege 5280 .exe Token: SeBackupPrivilege 5844 .exe Token: SeRestorePrivilege 5844 .exe Token: SeBackupPrivilege 5844 .exe Token: SeRestorePrivilege 5844 .exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Token: SeDebugPrivilege 5992 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 11 IoCs
pid Process 5280 .exe 5844 .exe 5844 .exe 2024 240919-vl9vhazhjp053b148abb83b29b9f0f6618ae0c3eefc79cf910d691ce191a2945c3763ce429N.exe 5844 .exe 5844 .exe 5844 .exe 5844 .exe 6444 240919-vv9abszgpe14404e9ba4f12a186174ef0d4c1918fc8a29a0126ca31784258fb8e9c6f9691cN.exe 5844 .exe 5844 .exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4364 240919-vv65zazgpcebd34bb14d058f27e2501c75ce3fa295_JaffaCakes118.exe 3852 240919-vpj39azelaafe2c96862b4f2822d6aa5edb58411a9fdf84f336dd7281ffe0be18017aad01aN.exe 2024 240919-vl9vhazhjp053b148abb83b29b9f0f6618ae0c3eefc79cf910d691ce191a2945c3763ce429N.exe 4584 Microsoft.exe 4584 Microsoft.exe 4584 Microsoft.exe 1360 240919-t63fgszanrebc17ac21deb7d464d1d1e4bc28c6231_JaffaCakes118.exe 5620 240919-vjyz8azcjbebcb6d206ccb19e27aa78a0720b5a5d5_JaffaCakes118.exe 6444 240919-vv9abszgpe14404e9ba4f12a186174ef0d4c1918fc8a29a0126ca31784258fb8e9c6f9691cN.exe 6540 240919-vg2y4azfkkebca36ababa9d4991d30306df4a8f75e_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3956 wrote to memory of 4956 3956 DoomRat.exe 73 PID 3956 wrote to memory of 4956 3956 DoomRat.exe 73 PID 4956 wrote to memory of 1776 4956 DoomRat.exe 74 PID 4956 wrote to memory of 1776 4956 DoomRat.exe 74 PID 4956 wrote to memory of 2896 4956 DoomRat.exe 75 PID 4956 wrote to memory of 2896 4956 DoomRat.exe 75 PID 4956 wrote to memory of 2896 4956 DoomRat.exe 75 PID 4956 wrote to memory of 4364 4956 DoomRat.exe 76 PID 4956 wrote to memory of 4364 4956 DoomRat.exe 76 PID 4956 wrote to memory of 4364 4956 DoomRat.exe 76 PID 4956 wrote to memory of 2724 4956 DoomRat.exe 77 PID 4956 wrote to memory of 2724 4956 DoomRat.exe 77 PID 4956 wrote to memory of 2724 4956 DoomRat.exe 77 PID 4956 wrote to memory of 3852 4956 DoomRat.exe 78 PID 4956 wrote to memory of 3852 4956 DoomRat.exe 78 PID 4956 wrote to memory of 3852 4956 DoomRat.exe 78 PID 4956 wrote to memory of 3712 4956 DoomRat.exe 79 PID 4956 wrote to memory of 3712 4956 DoomRat.exe 79 PID 4956 wrote to memory of 3712 4956 DoomRat.exe 79 PID 3712 wrote to memory of 576 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 5 PID 3712 wrote to memory of 576 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 5 PID 3712 wrote to memory of 576 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 5 PID 3712 wrote to memory of 576 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 5 PID 3712 wrote to memory of 576 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 5 PID 3712 wrote to memory of 576 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 5 PID 3712 wrote to memory of 644 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 7 PID 3712 wrote to memory of 644 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 7 PID 3712 wrote to memory of 644 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 7 PID 3712 wrote to memory of 644 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 7 PID 3712 wrote to memory of 644 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 7 PID 3712 wrote to memory of 644 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 7 PID 3712 wrote to memory of 720 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 8 PID 3712 wrote to memory of 720 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 8 PID 3712 wrote to memory of 720 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 8 PID 3712 wrote to memory of 720 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 8 PID 3712 wrote to memory of 720 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 8 PID 3712 wrote to memory of 720 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 8 PID 3712 wrote to memory of 724 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 9 PID 3712 wrote to memory of 724 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 9 PID 3712 wrote to memory of 724 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 9 PID 3712 wrote to memory of 724 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 9 PID 3712 wrote to memory of 724 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 9 PID 3712 wrote to memory of 724 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 9 PID 3712 wrote to memory of 740 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 10 PID 3712 wrote to memory of 740 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 10 PID 3712 wrote to memory of 740 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 10 PID 3712 wrote to memory of 740 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 10 PID 3712 wrote to memory of 740 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 10 PID 3712 wrote to memory of 740 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 10 PID 3712 wrote to memory of 812 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 11 PID 3712 wrote to memory of 812 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 11 PID 3712 wrote to memory of 812 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 11 PID 3712 wrote to memory of 812 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 11 PID 3712 wrote to memory of 812 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 11 PID 3712 wrote to memory of 812 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 11 PID 3712 wrote to memory of 872 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 12 PID 3712 wrote to memory of 872 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 12 PID 3712 wrote to memory of 872 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 12 PID 3712 wrote to memory of 872 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 12 PID 3712 wrote to memory of 872 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 12 PID 3712 wrote to memory of 872 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 12 PID 3712 wrote to memory of 924 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 13 PID 3712 wrote to memory of 924 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 13 PID 3712 wrote to memory of 924 3712 240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe 13 -
System policy modification 1 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" 240919-vl9vhazhjp053b148abb83b29b9f0f6618ae0c3eefc79cf910d691ce191a2945c3763ce429N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "145" .exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 240919-vdedmayhndebc6b028cc5dd28a22f1244c9b98ac1c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 240919-vv9abszgpe14404e9ba4f12a186174ef0d4c1918fc8a29a0126ca31784258fb8e9c6f9691cN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" 240919-vv9abszgpe14404e9ba4f12a186174ef0d4c1918fc8a29a0126ca31784258fb8e9c6f9691cN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 240919-vpj39azelaafe2c96862b4f2822d6aa5edb58411a9fdf84f336dd7281ffe0be18017aad01aN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" 240919-vpj39azelaafe2c96862b4f2822d6aa5edb58411a9fdf84f336dd7281ffe0be18017aad01aN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 240919-vl9vhazhjp053b148abb83b29b9f0f6618ae0c3eefc79cf910d691ce191a2945c3763ce429N.exe -
Views/modifies file attributes 1 TTPs 5 IoCs
pid Process 9912 attrib.exe 17336 attrib.exe 67780 Process not Found 70640 Process not Found 86596 Process not Found
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:576
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:720
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:1012
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:644
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:724
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay1⤵PID:740
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch1⤵PID:812
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding2⤵PID:2996
-
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca2⤵PID:3620
-
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca2⤵PID:3660
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3880
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3480
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:2668
-
-
C:\Windows\system32\ApplicationFrameHost.exeC:\Windows\system32\ApplicationFrameHost.exe -Embedding2⤵PID:4900
-
-
C:\Windows\System32\InstallAgent.exeC:\Windows\System32\InstallAgent.exe -Embedding2⤵PID:4508
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}2⤵PID:4500
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k rpcss1⤵PID:872
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s LSM1⤵PID:924
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts1⤵PID:376
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵PID:512
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService1⤵PID:964
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork1⤵PID:1084
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog1⤵PID:1092
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵PID:1112
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:3008
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s nsi1⤵PID:1212
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵PID:1280
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp1⤵PID:1324
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵PID:1332
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s EventSystem1⤵PID:1340
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵PID:1428
-
c:\windows\system32\sihost.exesihost.exe2⤵PID:2816
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵PID:1464
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s NlaSvc1⤵PID:1520
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s Dnscache1⤵PID:1552
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder1⤵PID:1580
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted1⤵PID:1664
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s netprofm1⤵PID:1724
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted1⤵PID:1768
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted1⤵PID:1784
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵PID:1864
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k appmodel -s StateRepository1⤵PID:1908
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1516
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation1⤵PID:2112
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵PID:2136
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc1⤵PID:2276
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵PID:2476
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent1⤵PID:2484
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵PID:2516
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵PID:2672
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2700
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s CryptSvc1⤵PID:2712
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks1⤵PID:2740
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵PID:2768
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵PID:2832
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s TokenBroker1⤵PID:3228
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\DoomRat.exe"C:\Users\Admin\AppData\Local\Temp\DoomRat.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3728
-
-
C:\Users\Admin\AppData\Local\Temp\DoomRat.exe"C:\Users\Admin\AppData\Local\Temp\DoomRat.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵PID:1776
-
-
C:\Users\Admin\Downloads\240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exeC:\Users\Admin\Downloads\240919-vwdj2s1clr7ef6ae99560698082f0b7e91132cab5ce70f2ee291e8623212d996b0dd597f86N.exe4⤵
- Modifies firewall policy service
- Drops file in Drivers directory
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:2896
-
-
C:\Users\Admin\Downloads\240919-vv65zazgpcebd34bb14d058f27e2501c75ce3fa295_JaffaCakes118.exeC:\Users\Admin\Downloads\240919-vv65zazgpcebd34bb14d058f27e2501c75ce3fa295_JaffaCakes118.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4364
-
-
C:\Users\Admin\Downloads\240919-vvka7szgmc09c66ce05f1a3b1014b5f7a2c114ed07c83e79ca68a6a4b9b28abdb1da58f120N.exeC:\Users\Admin\Downloads\240919-vvka7szgmc09c66ce05f1a3b1014b5f7a2c114ed07c83e79ca68a6a4b9b28abdb1da58f120N.exe4⤵
- Modifies firewall policy service
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:2724 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 9765⤵
- Program crash
PID:5248
-
-
-
C:\Users\Admin\Downloads\240919-vpj39azelaafe2c96862b4f2822d6aa5edb58411a9fdf84f336dd7281ffe0be18017aad01aN.exeC:\Users\Admin\Downloads\240919-vpj39azelaafe2c96862b4f2822d6aa5edb58411a9fdf84f336dd7281ffe0be18017aad01aN.exe4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3852 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 9525⤵
- Program crash
PID:3184
-
-
-
C:\Users\Admin\Downloads\240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exeC:\Users\Admin\Downloads\240919-vpyxeazembebcf9d91eb0e5d5543f532dfdd759a64_JaffaCakes118.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3712
-
-
C:\Users\Admin\Downloads\240919-vm262szhmlecb603829d1ad080923bd44410f868624e8672ef2334ad7c0b1646f827063f1dN.exeC:\Users\Admin\Downloads\240919-vm262szhmlecb603829d1ad080923bd44410f868624e8672ef2334ad7c0b1646f827063f1dN.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4612 -
C:\Windows\SysWOW64\Lpcfkm32.exeC:\Windows\system32\Lpcfkm32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2420 -
C:\Windows\SysWOW64\Odmgcgbi.exeC:\Windows\system32\Odmgcgbi.exe6⤵
- Executes dropped EXE
PID:1928 -
C:\Windows\SysWOW64\Ogpmjb32.exeC:\Windows\system32\Ogpmjb32.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5244 -
C:\Windows\SysWOW64\Pmannhhj.exeC:\Windows\system32\Pmannhhj.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5656
-
-
-
-
-
-
C:\Users\Admin\Downloads\240919-vq77gazfjgBackdoor.Win32.Berbew.pz-2a8744c57db58b5b6edd3161ac4315308b99f701e5efc7357334d2858a58808cNC:\Users\Admin\Downloads\240919-vq77gazfjgBackdoor.Win32.Berbew.pz-2a8744c57db58b5b6edd3161ac4315308b99f701e5efc7357334d2858a58808cN4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:5056 -
C:\Windows\SysWOW64\Likjcbkc.exeC:\Windows\system32\Likjcbkc.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3600 -
C:\Windows\SysWOW64\Opakbi32.exeC:\Windows\system32\Opakbi32.exe6⤵
- Executes dropped EXE
- Modifies registry class
PID:5092 -
C:\Windows\SysWOW64\Ocdqjceo.exeC:\Windows\system32\Ocdqjceo.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:5212 -
C:\Windows\SysWOW64\Pncgmkmj.exeC:\Windows\system32\Pncgmkmj.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:4520 -
C:\Windows\SysWOW64\Dmgbnq32.exeC:\Windows\system32\Dmgbnq32.exe9⤵
- Modifies registry class
PID:5896 -
C:\Windows\SysWOW64\Eecdjmfi.exeC:\Windows\system32\Eecdjmfi.exe10⤵
- Drops file in System32 directory
- Modifies registry class
PID:4068 -
C:\Windows\SysWOW64\Eaonjngh.exeC:\Windows\system32\Eaonjngh.exe11⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5132 -
C:\Windows\SysWOW64\Fgeihcme.exeC:\Windows\system32\Fgeihcme.exe12⤵PID:5880
-
C:\Windows\SysWOW64\Gkglja32.exeC:\Windows\system32\Gkglja32.exe13⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3004 -
C:\Windows\SysWOW64\Joffnk32.exeC:\Windows\system32\Joffnk32.exe14⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:7688 -
C:\Windows\SysWOW64\Jehhaaci.exeC:\Windows\system32\Jehhaaci.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:8012 -
C:\Windows\SysWOW64\Kfcdfbqo.exeC:\Windows\system32\Kfcdfbqo.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5932 -
C:\Windows\SysWOW64\Lihfcm32.exeC:\Windows\system32\Lihfcm32.exe17⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5256 -
C:\Windows\SysWOW64\Mhppji32.exeC:\Windows\system32\Mhppji32.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:3804 -
C:\Windows\SysWOW64\Mibijk32.exeC:\Windows\system32\Mibijk32.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6836 -
C:\Windows\SysWOW64\Mekgdl32.exeC:\Windows\system32\Mekgdl32.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5452 -
C:\Windows\SysWOW64\Nbcqiope.exeC:\Windows\system32\Nbcqiope.exe21⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6188 -
C:\Windows\SysWOW64\Ogklelna.exeC:\Windows\system32\Ogklelna.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:5336 -
C:\Windows\SysWOW64\Ogpepl32.exeC:\Windows\system32\Ogpepl32.exe23⤵
- Drops file in System32 directory
- Modifies registry class
PID:8176 -
C:\Windows\SysWOW64\Phcomcng.exeC:\Windows\system32\Phcomcng.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:7436 -
C:\Windows\SysWOW64\Lkeekk32.exeC:\Windows\system32\Lkeekk32.exe25⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:232 -
C:\Windows\SysWOW64\Mgaokl32.exeC:\Windows\system32\Mgaokl32.exe26⤵
- Drops file in System32 directory
PID:9116 -
C:\Windows\SysWOW64\Mnpabe32.exeC:\Windows\system32\Mnpabe32.exe27⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:9856 -
C:\Windows\SysWOW64\Nlfnaicd.exeC:\Windows\system32\Nlfnaicd.exe28⤵PID:10152
-
C:\Windows\SysWOW64\Nlkgmh32.exeC:\Windows\system32\Nlkgmh32.exe29⤵PID:10320
-
C:\Windows\SysWOW64\Oalipoiq.exeC:\Windows\system32\Oalipoiq.exe30⤵PID:10596
-
C:\Windows\SysWOW64\Oldjcg32.exeC:\Windows\system32\Oldjcg32.exe31⤵PID:10876
-
C:\Windows\SysWOW64\Omgcpokp.exeC:\Windows\system32\Omgcpokp.exe32⤵PID:11136
-
C:\Windows\SysWOW64\Peahgl32.exeC:\Windows\system32\Peahgl32.exe33⤵PID:8172
-
C:\Windows\SysWOW64\Plmmif32.exeC:\Windows\system32\Plmmif32.exe34⤵PID:8884
-
C:\Windows\SysWOW64\Phigif32.exeC:\Windows\system32\Phigif32.exe35⤵PID:9080
-
C:\Windows\SysWOW64\Qlgpod32.exeC:\Windows\system32\Qlgpod32.exe36⤵PID:9312
-
C:\Windows\SysWOW64\Qklmpalf.exeC:\Windows\system32\Qklmpalf.exe37⤵PID:9636
-
C:\Windows\SysWOW64\Aknifq32.exeC:\Windows\system32\Aknifq32.exe38⤵PID:7216
-
C:\Windows\SysWOW64\Aajohjon.exeC:\Windows\system32\Aajohjon.exe39⤵PID:7560
-
C:\Windows\SysWOW64\Aehgnied.exeC:\Windows\system32\Aehgnied.exe40⤵PID:10444
-
C:\Windows\SysWOW64\Aekddhcb.exeC:\Windows\system32\Aekddhcb.exe41⤵PID:10820
-
C:\Windows\SysWOW64\Bdpaeehj.exeC:\Windows\system32\Bdpaeehj.exe42⤵PID:11248
-
C:\Windows\SysWOW64\Bhpfqcln.exeC:\Windows\system32\Bhpfqcln.exe43⤵PID:8480
-
C:\Windows\SysWOW64\Blnoga32.exeC:\Windows\system32\Blnoga32.exe44⤵PID:8472
-
C:\Windows\SysWOW64\Ckclhn32.exeC:\Windows\system32\Ckclhn32.exe45⤵PID:9680
-
C:\Windows\SysWOW64\Cbpajgmf.exeC:\Windows\system32\Cbpajgmf.exe46⤵PID:10708
-
C:\Windows\SysWOW64\Cbbnpg32.exeC:\Windows\system32\Cbbnpg32.exe47⤵PID:4384
-
C:\Windows\SysWOW64\Cdbfab32.exeC:\Windows\system32\Cdbfab32.exe48⤵PID:9156
-
C:\Windows\SysWOW64\Cdecgbfa.exeC:\Windows\system32\Cdecgbfa.exe49⤵PID:9088
-
C:\Windows\SysWOW64\Dhclmp32.exeC:\Windows\system32\Dhclmp32.exe50⤵PID:11516
-
C:\Windows\SysWOW64\Ddligq32.exeC:\Windows\system32\Ddligq32.exe51⤵PID:11780
-
C:\Windows\SysWOW64\Dkhnjk32.exeC:\Windows\system32\Dkhnjk32.exe52⤵PID:12016
-
C:\Windows\SysWOW64\Eecphp32.exeC:\Windows\system32\Eecphp32.exe53⤵PID:8440
-
C:\Windows\SysWOW64\Eokqkh32.exeC:\Windows\system32\Eokqkh32.exe54⤵PID:10120
-
C:\Windows\SysWOW64\Eblimcdf.exeC:\Windows\system32\Eblimcdf.exe55⤵PID:10984
-
C:\Windows\SysWOW64\Efjbcakl.exeC:\Windows\system32\Efjbcakl.exe56⤵PID:11272
-
C:\Windows\SysWOW64\Fijkdmhn.exeC:\Windows\system32\Fijkdmhn.exe57⤵PID:11728
-
C:\Windows\SysWOW64\Fechomko.exeC:\Windows\system32\Fechomko.exe58⤵PID:12152
-
C:\Windows\SysWOW64\Fnnjmbpm.exeC:\Windows\system32\Fnnjmbpm.exe59⤵PID:10748
-
C:\Windows\SysWOW64\Gblbca32.exeC:\Windows\system32\Gblbca32.exe60⤵PID:12488
-
C:\Windows\SysWOW64\Gemkelcd.exeC:\Windows\system32\Gemkelcd.exe61⤵PID:12748
-
C:\Windows\SysWOW64\Geohklaa.exeC:\Windows\system32\Geohklaa.exe62⤵PID:12984
-
C:\Windows\SysWOW64\Gmimai32.exeC:\Windows\system32\Gmimai32.exe63⤵PID:13256
-
C:\Windows\SysWOW64\Holfoqcm.exeC:\Windows\system32\Holfoqcm.exe64⤵PID:11320
-
C:\Windows\SysWOW64\Hblkjo32.exeC:\Windows\system32\Hblkjo32.exe65⤵PID:12012
-
C:\Windows\SysWOW64\Hmdlmg32.exeC:\Windows\system32\Hmdlmg32.exe66⤵PID:12328
-
C:\Windows\SysWOW64\Ipeeobbe.exeC:\Windows\system32\Ipeeobbe.exe67⤵PID:12692
-
C:\Windows\SysWOW64\Igajal32.exeC:\Windows\system32\Igajal32.exe68⤵PID:13172
-
C:\Windows\SysWOW64\Imnocf32.exeC:\Windows\system32\Imnocf32.exe69⤵PID:13348
-
C:\Windows\SysWOW64\Jcmdaljn.exeC:\Windows\system32\Jcmdaljn.exe70⤵PID:13608
-
C:\Windows\SysWOW64\Jenmcggo.exeC:\Windows\system32\Jenmcggo.exe71⤵PID:13860
-
C:\Windows\SysWOW64\Jebfng32.exeC:\Windows\system32\Jebfng32.exe72⤵PID:14064
-
C:\Windows\SysWOW64\Jedccfqg.exeC:\Windows\system32\Jedccfqg.exe73⤵PID:14292
-
C:\Windows\SysWOW64\Kegpifod.exeC:\Windows\system32\Kegpifod.exe74⤵PID:9760
-
C:\Windows\SysWOW64\Knqepc32.exeC:\Windows\system32\Knqepc32.exe75⤵PID:12812
-
C:\Windows\SysWOW64\Kodnmkap.exeC:\Windows\system32\Kodnmkap.exe76⤵PID:9684
-
C:\Windows\SysWOW64\Kcbfcigf.exeC:\Windows\system32\Kcbfcigf.exe77⤵PID:13704
-
C:\Windows\SysWOW64\Lfbped32.exeC:\Windows\system32\Lfbped32.exe78⤵PID:14168
-
C:\Windows\SysWOW64\Onmfimga.exeC:\Windows\system32\Onmfimga.exe79⤵PID:14912
-
C:\Windows\SysWOW64\Ppahmb32.exeC:\Windows\system32\Ppahmb32.exe80⤵PID:20388
-
C:\Windows\SysWOW64\Dhphmj32.exeC:\Windows\system32\Dhphmj32.exe81⤵PID:15316
-
C:\Windows\SysWOW64\Dhdbhifj.exeC:\Windows\system32\Dhdbhifj.exe82⤵PID:15628
-
C:\Windows\SysWOW64\Hnnljj32.exeC:\Windows\system32\Hnnljj32.exe83⤵PID:15700
-
C:\Windows\SysWOW64\Hnphoj32.exeC:\Windows\system32\Hnphoj32.exe84⤵PID:16124
-
C:\Windows\SysWOW64\Iolhkh32.exeC:\Windows\system32\Iolhkh32.exe85⤵PID:7364
-
C:\Windows\SysWOW64\Lcmodajm.exeC:\Windows\system32\Lcmodajm.exe86⤵PID:14752
-
C:\Windows\SysWOW64\Mledmg32.exeC:\Windows\system32\Mledmg32.exe87⤵PID:15508
-
C:\Windows\SysWOW64\Mfpell32.exeC:\Windows\system32\Mfpell32.exe88⤵PID:15192
-
C:\Windows\SysWOW64\Pcpnhl32.exeC:\Windows\system32\Pcpnhl32.exe89⤵PID:16508
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\240919-vp3wcszenb07ccd182b9a63c0ca1dbdd05338b53fb9d10efdaca2d6e69b0e54e45fa2b38afN.exeC:\Users\Admin\Downloads\240919-vp3wcszenb07ccd182b9a63c0ca1dbdd05338b53fb9d10efdaca2d6e69b0e54e45fa2b38afN.exe4⤵
- Executes dropped EXE
PID:3556 -
\??\c:\22626.exec:\22626.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3536 -
\??\c:\808648.exec:\808648.exe6⤵
- Executes dropped EXE
PID:4056 -
\??\c:\bttbbh.exec:\bttbbh.exe7⤵
- Executes dropped EXE
PID:5628 -
\??\c:\82606.exec:\82606.exe8⤵
- Executes dropped EXE
PID:3172 -
\??\c:\dvpjd.exec:\dvpjd.exe9⤵
- Executes dropped EXE
PID:5668 -
\??\c:\4848882.exec:\4848882.exe10⤵
- System Location Discovery: System Language Discovery
PID:5728 -
\??\c:\jdjjp.exec:\jdjjp.exe11⤵PID:760
-
\??\c:\04400.exec:\04400.exe12⤵
- System Location Discovery: System Language Discovery
PID:5956 -
\??\c:\xrrlfxf.exec:\xrrlfxf.exe13⤵PID:7880
-
\??\c:\3tthbb.exec:\3tthbb.exe14⤵PID:7236
-
\??\c:\xllrlll.exec:\xllrlll.exe15⤵PID:1368
-
\??\c:\4026606.exec:\4026606.exe16⤵PID:7696
-
\??\c:\9rlxlxl.exec:\9rlxlxl.exe17⤵PID:7268
-
\??\c:\6282044.exec:\6282044.exe18⤵
- System Location Discovery: System Language Discovery
PID:6468 -
\??\c:\446668.exec:\446668.exe19⤵PID:6952
-
\??\c:\g2262.exec:\g2262.exe20⤵
- System Location Discovery: System Language Discovery
PID:7836 -
\??\c:\i220488.exec:\i220488.exe21⤵
- System Location Discovery: System Language Discovery
PID:7712 -
\??\c:\pjjdd.exec:\pjjdd.exe22⤵
- System Location Discovery: System Language Discovery
PID:8984 -
\??\c:\hbhhtt.exec:\hbhhtt.exe23⤵
- System Location Discovery: System Language Discovery
PID:9684 -
\??\c:\m2808.exec:\m2808.exe24⤵
- System Location Discovery: System Language Discovery
PID:9952 -
\??\c:\04040.exec:\04040.exe25⤵PID:8108
-
\??\c:\bnnhbt.exec:\bnnhbt.exe26⤵PID:10404
-
\??\c:\lxflfrr.exec:\lxflfrr.exe27⤵PID:10704
-
\??\c:\7tbttt.exec:\7tbttt.exe28⤵PID:10996
-
\??\c:\vpppp.exec:\vpppp.exe29⤵PID:5344
-
\??\c:\jjjjd.exec:\jjjjd.exe30⤵PID:7888
-
\??\c:\pvvdd.exec:\pvvdd.exe31⤵PID:9336
-
\??\c:\xxxxrll.exec:\xxxxrll.exe32⤵PID:9664
-
\??\c:\fffxrlf.exec:\fffxrlf.exe33⤵PID:9916
-
\??\c:\82604.exec:\82604.exe34⤵PID:7776
-
\??\c:\62040.exec:\62040.exe35⤵PID:10488
-
\??\c:\vppjv.exec:\vppjv.exe36⤵PID:10868
-
\??\c:\vppjd.exec:\vppjd.exe37⤵PID:2340
-
\??\c:\hbbttt.exec:\hbbttt.exe38⤵PID:8532
-
\??\c:\dddvp.exec:\dddvp.exe39⤵PID:9144
-
\??\c:\rrlxrrx.exec:\rrlxrrx.exe40⤵PID:9760
-
\??\c:\5rxfrxx.exec:\5rxfrxx.exe41⤵PID:6748
-
\??\c:\jdjvv.exec:\jdjvv.exe42⤵PID:10748
-
\??\c:\w84048.exec:\w84048.exe43⤵PID:11180
-
\??\c:\882888.exec:\882888.exe44⤵PID:11292
-
\??\c:\q00488.exec:\q00488.exe45⤵PID:11544
-
\??\c:\266060.exec:\266060.exe46⤵PID:11808
-
\??\c:\vjpdp.exec:\vjpdp.exe47⤵PID:12044
-
\??\c:\8226826.exec:\8226826.exe48⤵PID:9188
-
\??\c:\xlxxxrx.exec:\xlxxxrx.exe49⤵PID:6524
-
\??\c:\4440440.exec:\4440440.exe50⤵PID:8564
-
\??\c:\8284622.exec:\8284622.exe51⤵PID:11328
-
\??\c:\280662.exec:\280662.exe52⤵PID:11800
-
\??\c:\200888.exec:\200888.exe53⤵PID:12192
-
\??\c:\62260.exec:\62260.exe54⤵PID:10976
-
\??\c:\002266.exec:\002266.exe55⤵PID:12516
-
\??\c:\000488.exec:\000488.exe56⤵PID:12780
-
\??\c:\pjddv.exec:\pjddv.exe57⤵PID:13016
-
\??\c:\nhnhbh.exec:\nhnhbh.exe58⤵PID:13284
-
\??\c:\dvpjd.exec:\dvpjd.exe59⤵PID:11408
-
\??\c:\w02626.exec:\w02626.exe60⤵PID:12120
-
\??\c:\206604.exec:\206604.exe61⤵PID:12376
-
\??\c:\thhbbt.exec:\thhbbt.exe62⤵PID:12740
-
\??\c:\hbbtnh.exec:\hbbtnh.exe63⤵PID:13200
-
\??\c:\rlrlllf.exec:\rlrlllf.exe64⤵PID:13380
-
\??\c:\00026.exec:\00026.exe65⤵PID:13640
-
\??\c:\q84482.exec:\q84482.exe66⤵PID:13884
-
\??\c:\1pjvp.exec:\1pjvp.exe67⤵PID:14092
-
\??\c:\888804.exec:\888804.exe68⤵PID:14320
-
\??\c:\rlfxllx.exec:\rlfxllx.exe69⤵PID:11124
-
\??\c:\vvvdd.exec:\vvvdd.exe70⤵PID:13288
-
\??\c:\bttnhb.exec:\bttnhb.exe71⤵PID:13340
-
\??\c:\64004.exec:\64004.exe72⤵PID:13744
-
\??\c:\48464.exec:\48464.exe73⤵PID:12756
-
\??\c:\s6882.exec:\s6882.exe74⤵PID:14896
-
\??\c:\ffrlxrf.exec:\ffrlxrf.exe75⤵PID:20304
-
\??\c:\xlfxxxx.exec:\xlfxxxx.exe76⤵PID:12848
-
\??\c:\4888664.exec:\4888664.exe77⤵PID:14852
-
\??\c:\82444.exec:\82444.exe78⤵PID:15380
-
\??\c:\402624.exec:\402624.exe79⤵PID:15844
-
\??\c:\dpjjd.exec:\dpjjd.exe80⤵PID:14180
-
\??\c:\008828.exec:\008828.exe81⤵PID:16124
-
\??\c:\o244484.exec:\o244484.exe82⤵PID:4028
-
\??\c:\frrllff.exec:\frrllff.exe83⤵PID:16380
-
\??\c:\4882000.exec:\4882000.exe84⤵PID:16532
-
\??\c:\7xrlxfr.exec:\7xrlxfr.exe85⤵PID:16732
-
\??\c:\9nnhtb.exec:\9nnhtb.exe86⤵PID:16948
-
\??\c:\pvvdv.exec:\pvvdv.exe87⤵PID:17140
-
\??\c:\o228262.exec:\o228262.exe88⤵PID:17332
-
\??\c:\4404440.exec:\4404440.exe89⤵PID:17512
-
\??\c:\thbnnt.exec:\thbnnt.exe90⤵PID:17732
-
\??\c:\62482.exec:\62482.exe91⤵PID:17948
-
\??\c:\866086.exec:\866086.exe92⤵PID:18176
-
\??\c:\3jdpd.exec:\3jdpd.exe93⤵PID:18416
-
\??\c:\djdvj.exec:\djdvj.exe94⤵PID:18620
-
\??\c:\60002.exec:\60002.exe95⤵PID:18828
-
\??\c:\e22084.exec:\e22084.exe96⤵PID:18916
-
\??\c:\fxrfxxl.exec:\fxrfxxl.exe97⤵PID:19124
-
\??\c:\66666.exec:\66666.exe98⤵PID:19332
-
\??\c:\1rxrffr.exec:\1rxrffr.exe99⤵PID:19440
-
\??\c:\thbthh.exec:\thbthh.exe100⤵PID:19600
-
\??\c:\262820.exec:\262820.exe101⤵PID:19808
-
\??\c:\w06044.exec:\w06044.exe102⤵PID:20028
-
\??\c:\9ffrrrr.exec:\9ffrrrr.exe103⤵PID:20232
-
\??\c:\0004200.exec:\0004200.exe104⤵PID:20376
-
\??\c:\040004.exec:\040004.exe105⤵PID:13672
-
\??\c:\042664.exec:\042664.exe106⤵PID:12940
-
\??\c:\22628.exec:\22628.exe107⤵PID:14488
-
\??\c:\jdpjd.exec:\jdpjd.exe108⤵PID:14704
-
\??\c:\vpjvp.exec:\vpjvp.exe109⤵PID:6756
-
\??\c:\860826.exec:\860826.exe110⤵PID:14828
-
\??\c:\a8488.exec:\a8488.exe111⤵PID:15012
-
\??\c:\o842486.exec:\o842486.exe112⤵PID:15156
-
\??\c:\262260.exec:\262260.exe113⤵PID:9396
-
\??\c:\pjpjd.exec:\pjpjd.exe114⤵PID:20256
-
\??\c:\866482.exec:\866482.exe115⤵PID:6580
-
\??\c:\bbnbhh.exec:\bbnbhh.exe116⤵PID:13372
-
\??\c:\486442.exec:\486442.exe117⤵PID:14140
-
\??\c:\ppjpp.exec:\ppjpp.exe118⤵PID:15476
-
\??\c:\04604.exec:\04604.exe119⤵PID:14908
-
\??\c:\c444482.exec:\c444482.exe120⤵PID:14224
-
\??\c:\8482048.exec:\8482048.exe121⤵PID:13244
-
\??\c:\4282228.exec:\4282228.exe122⤵PID:16740
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-