latentbot | 97f9d64f13c13f657e1a6ee124b5addb02bbf8e4c60746c29ca7ce80c617deb2

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23-09-2024 15:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe
Size

141KB
MD5

f29cebec13239b10170d4ab18f500a9f
SHA1

4a85345921f537c8852c37e39b5d409122b34ce8
SHA256

97f9d64f13c13f657e1a6ee124b5addb02bbf8e4c60746c29ca7ce80c617deb2
SHA512

0018f27d80949be0c2d32857012b3ff8c73da774a089c5041758c97cbcfca0d616e776d28103794a0d860834767084a1f16096e3d55af678f15bfa168a480ec8
SSDEEP

3072:6jaeY9QFVyoALuV2xnHNi+ofCSn8w4m1qjJK+nJ8/mpczn94bSL5Jfu6:jQ4A2HoDV4VjJNnJ8/cK4OL5Jfu6

Score

10^/10

latentbot discovery persistence trojan upx

Malware Config

Extracted

Family

latentbot

bluelightning.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Windows = "C:\\Windows\\system32\\windows\\iexplorer.exe"	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Windows = "C:\\Windows\\system32\\windows\\iexplorer.exe"	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{OE3084E7-X4N6-TOVC-60C2-6XR6OOAX5OUP}	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{OE3084E7-X4N6-TOVC-60C2-6XR6OOAX5OUP}\StubPath = "C:\\Windows\\system32\\windows\\iexplorer.exe Restart"	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Windows\\system32\\windows\\iexplorer.exe"	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Windows\\system32\\windows\\iexplorer.exe"	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\windows\logs.dat	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\windows\logs.dat	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\windows\iexplorer.exe	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\windows\iexplorer.exe	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\windows\plugin.dat	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\windows\	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2068 set thread context of 1516	2068	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	82

UPX packed file 33 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1516-3-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/1516-8-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/1516-7-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/1516-6-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/1516-10-0x0000000010410000-0x0000000010446000-memory.dmp	upx
behavioral2/memory/1516-11-0x0000000010410000-0x0000000010446000-memory.dmp	upx
behavioral2/memory/1516-15-0x0000000000580000-0x000000000058D000-memory.dmp	upx
behavioral2/memory/1516-19-0x0000000000590000-0x000000000059D000-memory.dmp	upx
behavioral2/memory/1516-22-0x00000000005A0000-0x00000000005AD000-memory.dmp	upx
behavioral2/memory/1516-27-0x00000000005C0000-0x00000000005CD000-memory.dmp	upx
behavioral2/memory/1516-30-0x00000000005D0000-0x00000000005DD000-memory.dmp	upx
behavioral2/memory/1516-31-0x00000000005D0000-0x00000000005DD000-memory.dmp	upx
behavioral2/memory/1516-34-0x00000000005E0000-0x00000000005ED000-memory.dmp	upx
behavioral2/memory/1516-35-0x00000000005E0000-0x00000000005ED000-memory.dmp	upx
behavioral2/memory/1516-38-0x00000000005F0000-0x00000000005FD000-memory.dmp	upx
behavioral2/memory/1516-39-0x00000000005F0000-0x00000000005FD000-memory.dmp	upx
behavioral2/memory/1516-42-0x0000000010450000-0x000000001045D000-memory.dmp	upx
behavioral2/memory/1516-43-0x0000000010450000-0x000000001045D000-memory.dmp	upx
behavioral2/memory/1516-47-0x0000000000600000-0x000000000060D000-memory.dmp	upx
behavioral2/memory/1516-46-0x0000000000600000-0x000000000060D000-memory.dmp	upx
behavioral2/memory/1516-50-0x0000000010460000-0x000000001046D000-memory.dmp	upx
behavioral2/memory/1516-51-0x0000000010460000-0x000000001046D000-memory.dmp	upx
behavioral2/memory/1516-54-0x0000000010470000-0x000000001047D000-memory.dmp	upx
behavioral2/memory/1516-55-0x0000000010470000-0x000000001047D000-memory.dmp	upx
behavioral2/memory/1516-58-0x0000000010480000-0x000000001048D000-memory.dmp	upx
behavioral2/memory/1516-59-0x0000000010480000-0x000000001048D000-memory.dmp	upx
behavioral2/memory/1516-63-0x0000000010490000-0x000000001049D000-memory.dmp	upx
behavioral2/memory/1516-66-0x00000000104A0000-0x00000000104AD000-memory.dmp	upx
behavioral2/memory/1516-67-0x00000000104A0000-0x00000000104AD000-memory.dmp	upx
behavioral2/memory/1516-70-0x00000000104B0000-0x00000000104BD000-memory.dmp	upx
behavioral2/memory/1516-71-0x00000000104B0000-0x00000000104BD000-memory.dmp	upx
behavioral2/memory/1516-278-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/1516-391-0x0000000000400000-0x0000000000425000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe
1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe
1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe
1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe
1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe
1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4340	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe
Token: SeDebugPrivilege	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe
Token: SeDebugPrivilege	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe
Token: SeDebugPrivilege	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe
Token: SeDebugPrivilege	4340	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe
Token: SeDebugPrivilege	4340	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2068	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 1516	2068	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	82
PID 2068 wrote to memory of 1516	2068	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	82
PID 2068 wrote to memory of 1516	2068	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	82
PID 2068 wrote to memory of 1516	2068	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	82
PID 2068 wrote to memory of 1516	2068	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	82
PID 2068 wrote to memory of 1516	2068	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	82
PID 2068 wrote to memory of 1516	2068	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	82
PID 2068 wrote to memory of 1516	2068	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	82
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83
PID 1516 wrote to memory of 2984	1516	f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe	83

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:788
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:384

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:780
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:944
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3772
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3860
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3924
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:4012
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4108
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:2072
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:2880
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:2876
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4932

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1048

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1180
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2912

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1424

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1544
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1636

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1804

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1928

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1976

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1996

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2160

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2204

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2764

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2828

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3288

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3464
- C:\Users\Admin\AppData\Local\Temp\f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Users\Admin\AppData\Local\Temp\f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1516
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\f29cebec13239b10170d4ab18f500a9f_JaffaCakes118.exe
      4⤵
      Adds policy Run key to start application
      Boot or Logon Autostart Execution: Active Setup
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:4340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3588

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:3324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4636

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2080

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1516-42-0x0000000010450000-0x000000001045D000-memory.dmp

Filesize
52KB

Download
memory/1516-55-0x0000000010470000-0x000000001047D000-memory.dmp

Filesize
52KB

Download
memory/1516-38-0x00000000005F0000-0x00000000005FD000-memory.dmp

Filesize
52KB

Download
memory/1516-39-0x00000000005F0000-0x00000000005FD000-memory.dmp

Filesize
52KB

Download
memory/1516-7-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1516-6-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1516-10-0x0000000010410000-0x0000000010446000-memory.dmp

Filesize
216KB

Download
memory/1516-11-0x0000000010410000-0x0000000010446000-memory.dmp

Filesize
216KB

Download
memory/1516-15-0x0000000000580000-0x000000000058D000-memory.dmp

Filesize
52KB

Download
memory/1516-19-0x0000000000590000-0x000000000059D000-memory.dmp

Filesize
52KB

Download
memory/1516-22-0x00000000005A0000-0x00000000005AD000-memory.dmp

Filesize
52KB

Download
memory/1516-27-0x00000000005C0000-0x00000000005CD000-memory.dmp

Filesize
52KB

Download
memory/1516-30-0x00000000005D0000-0x00000000005DD000-memory.dmp

Filesize
52KB

Download
memory/1516-31-0x00000000005D0000-0x00000000005DD000-memory.dmp

Filesize
52KB

Download
memory/1516-34-0x00000000005E0000-0x00000000005ED000-memory.dmp

Filesize
52KB

Download
memory/1516-35-0x00000000005E0000-0x00000000005ED000-memory.dmp

Filesize
52KB

Download
memory/1516-8-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1516-391-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1516-3-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1516-43-0x0000000010450000-0x000000001045D000-memory.dmp

Filesize
52KB

Download
memory/1516-47-0x0000000000600000-0x000000000060D000-memory.dmp

Filesize
52KB

Download
memory/1516-46-0x0000000000600000-0x000000000060D000-memory.dmp

Filesize
52KB

Download
memory/1516-50-0x0000000010460000-0x000000001046D000-memory.dmp

Filesize
52KB

Download
memory/1516-51-0x0000000010460000-0x000000001046D000-memory.dmp

Filesize
52KB

Download
memory/1516-54-0x0000000010470000-0x000000001047D000-memory.dmp

Filesize
52KB

Download
memory/1516-278-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1516-58-0x0000000010480000-0x000000001048D000-memory.dmp

Filesize
52KB

Download
memory/1516-59-0x0000000010480000-0x000000001048D000-memory.dmp

Filesize
52KB

Download
memory/1516-63-0x0000000010490000-0x000000001049D000-memory.dmp

Filesize
52KB

Download
memory/1516-66-0x00000000104A0000-0x00000000104AD000-memory.dmp

Filesize
52KB

Download
memory/1516-67-0x00000000104A0000-0x00000000104AD000-memory.dmp

Filesize
52KB

Download
memory/1516-70-0x00000000104B0000-0x00000000104BD000-memory.dmp

Filesize
52KB

Download
memory/1516-71-0x00000000104B0000-0x00000000104BD000-memory.dmp

Filesize
52KB

Download
memory/2068-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2068-9-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4340-408-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download