pony | e11460d4bf65827d58d5790883be3993a28e56840f5133bbd91f2a75c42d6513

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-09-2024 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe
Size

3.1MB
MD5

f75717d817eaf1dce81074e7daad9262
SHA1

767162ef5358074624e7f9331c5df24cabd3f219
SHA256

e11460d4bf65827d58d5790883be3993a28e56840f5133bbd91f2a75c42d6513
SHA512

c1fe7cae0e1b53aa73a04850df2cecaf4fc8fb0535089b40eac7559b4757b27bf9b0c387b6bb18c97ab99f704e0f863d3f6f8f786ab026a7ee2e68b5d3027e52
SSDEEP

49152:IBpgkDhX3jLu+T2nVnmnRMV/lTKcnTVLnKOvnnWNT:o

Score

10^/10

pony credential_access discovery evasion persistence rat spyware stealer upx

Malware Config

Signatures

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3"	ready.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Disables taskbar notifications via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	AV Protection 2011v121.exe

Executes dropped EXE 10 IoCs

pid	Process
2772	white.exe
2656	mrace.exe
2592	ready.exe
2384	dwme.exe
2208	dwme.exe
2376	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
2440	ready.exe
1660	ready.exe
1712	9627.tmp

Loads dropped DLL 26 IoCs

pid	Process
3068	f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe
3068	f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe
3068	f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe
3068	f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe
3068	f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe
3068	f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe
3068	f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe
3068	f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe
3068	f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe
3068	f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe
3068	f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe
3068	f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe
2656	mrace.exe
2656	mrace.exe
2656	mrace.exe
2656	mrace.exe
2656	mrace.exe
2656	mrace.exe
2376	AV Protection 2011v121.exe
2376	AV Protection 2011v121.exe
2592	ready.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
2592	ready.exe
2592	ready.exe
2592	ready.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gONtxA0uc2b3n4Q = "C:\\Users\\Admin\\AppData\\Roaming\\dwme.exe"	mrace.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\L2obF4pmGsJdKfZ8234A = "C:\\Users\\Admin\\AppData\\Roaming\\dpmH5sQJ7E8R9Yw\\AV Protection 2011v121.exe"	AV Protection 2011v121.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5C6.exe = "C:\\Program Files (x86)\\LP\\32F0\\5C6.exe"	ready.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BuvS2ibF3n8234A = "C:\\Windows\\system32\\AV Protection 2011v121.exe"	mrace.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\AV Protection 2011v121.exe	mrace.exe
File created	C:\Windows\SysWOW64\AV Protection 2011v121.exe	AV Protection 2011v121.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2656-78-0x0000000000400000-0x00000000008E4000-memory.dmp	upx
behavioral1/memory/2376-144-0x0000000000400000-0x00000000008E4000-memory.dmp	upx
behavioral1/memory/2384-151-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2208-163-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2592-285-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/2440-289-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/1912-386-0x0000000000400000-0x00000000008E4000-memory.dmp	upx
behavioral1/memory/2592-506-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/1660-542-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/1912-612-0x0000000000400000-0x00000000008E4000-memory.dmp	upx
behavioral1/memory/2592-749-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/1912-826-0x0000000000400000-0x00000000008E4000-memory.dmp	upx
behavioral1/memory/2592-832-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/1912-839-0x0000000000400000-0x00000000008E4000-memory.dmp	upx
behavioral1/memory/1912-851-0x0000000000400000-0x00000000008E4000-memory.dmp	upx
behavioral1/memory/2592-871-0x0000000000400000-0x000000000046B000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\LP\32F0\5C6.exe	ready.exe
File opened for modification	C:\Program Files (x86)\LP\32F0\5C6.exe	ready.exe
File opened for modification	C:\Program Files (x86)\LP\32F0\9627.tmp	ready.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ready.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	white.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrace.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AV Protection 2011v121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AV Protection 2011v121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ready.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ready.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9627.tmp

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\Registry\User\S-1-5-21-2872745919-2748461613-2989606286-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "133698140135220000"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\PastIconsStream = 1400000005000000010001000200000014000000494c200602000400300010001000ffffffff2110ffffffffffffffff424d36000000000000003600000028000000100000004000000001002000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c000000410000000c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0000004b818181c00000004b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0000004b818181c0ffffffff00000080000000000000000000000000000000002e2e2e8a0000004b000000000000000000000000000000000000000c0000004b818181c0ffffffffffffffff0000008000000000000000000000000000000000b7b7b7b73838388e00000045000000000000004b0000008000000080818181c0ffffffffffffffffffffffff0000008000000000000000000f0f0f810000004242424242ecececf40b0b0b810000000e00000080ffffffff808080ffffffffffffffffffffffffffffffffff000000800000000000000000e5e5e5ed191919830000002381818181646464a20000004200000080ffffffff808080ffffffffffffffffffffffffffffffffff000000800000005c000000276c6c6c6c939393bb0000005730303030bababad30000006800000080ffffffff808080ffffffffffffffffffffffffffffffffff000000809d9d9dc10000005c0c0c0c0cecececf40000007a0c0c0c0cecececf40000007a00000080ffffffff808080ffffffffffffffffffffffffffffffffff00000080a4a4a4c50000005f0c0c0c0cecececf40000007a0f0f0f0fe8e8e8f10000007800000080ffffffff808080ffffffffffffffffffffffffffffffffff000000800000005f0000002a6c6c6c6c939393bb0000005730303030bababad30000006800000080ffffffff808080ffffffffffffffffffffffffffffffffff000000800000000000000000e5e5e5ed191919830000002384848484646464a2000000420000004b00000080000000807e7e7ebfffffffffffffffffffffffff0000008000000000000000000f0f0f810000004245454545ecececf40a0a0a800000000e00000000000000000000000b0000004b7e7e7ebfffffffffffffffff0000008000000000000000000000000000000000c0c0c0c03636368d00000045000000000000000000000000000000000000000b0000004b7e7e7ebfffffffff0000008000000000000000000000000000000000272727880000004b0000000000000000000000000000000000000000000000000000000b0000004b7e7e7ebf0000004b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b0000003f0000000b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000035696969690000007000000080000000800000008000000080000000800000008000000080000000800000004b0000000000000000000000000000000000000058b0b0b0b0000000adffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0000008000000000000000000000000000000000000000a5ffffffff000000c0000000800000008000000080ffffffffffffffff00000080000000800000008000000080000000800000004b0000000000000000000000c0ffffffff7f7f7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff000000800000000000000000000000c0ffffffff000000a60000004d0000004d0000004d0000004d0000004d0000004d0000004d0000004d0000004dffffffff000000800000000000000000000000c0ffffffff000000a60000004d0000004d0000004d0000004d0000004d0000004d0000004d0000004d0000004dffffffff000000800000000000000000000000c0ffffffff030303a80303034f0000004d0000004d0000004d0000004d0000004d0000004d0000004d0000004dffffffff000000800000000000000000000000e07f7f7fff030303d6101010580f0f0f580a0a0a54030303500000004d0000004d0000004d0000004d0000004dffffffff000000800000004b00000080000000c07f7f7fff0e0e0eb00e0e0eb0141414901c1c1c611c1c1c611717175d0c0c0c550202024e0000004d0000004dffffffff0000008000000080ffffffffffffffffffffffffffffffffffffffff141414b428282869282828692828286928282869262626681818185e08080853ffffffff0000008000000080ffffffff808080ff808080ff808080ffffffffff1f1f1fbc3e3e3e783e3e3e783e3e3e783e3e3e783e3e3e783e3e3e783e3e3e78ffffffff0000008000000080ffffffff808080ffffffffff808080ffffffffff333333ca66666694666666946666669466666694666666946666669466666694ffffffff0000008000000080ffffffff808080ffffffffff808080ffffffffff7f7f7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0000008000000080ffffffff808080ffffffffff808080ffffffffff000000c000000080000000800000008000000080000000800000008000000080000000800000004b0000004b0000008000000080ffffffff00000080000000800000004b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004b000000800000004b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000400000000100010000000000000100000000000000000000000000000000000000000000ffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8ff0000f0ff0000e0f30000c0f1000000c0000000c000000000000000000000000000000000000000c0000000c00000c0f10000e0f30000f0ff0000f8ff0000c0030000c0030000c0000000c0000000c0000000c0000000c0000000c000000000000000000000000000000000000000000000000000000001ff0000c7ff000000000000000000000000000000000000000000000000010000000800000002000000040000002400000001000000000000000100000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\LastAdvertisement = "133717924790134000"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010003000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000eac000000000000002000000e80709004100720067006a0062006500780020002000330020005600610067007200650061007200670020006e007000700072006600660000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000074ae2078e323294282c1e41cb67d5b9c000000000000000000000000f0fa0752ba0fdb0100000000000000000000000000000d20218f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000e80709004600630072006e0078007200650066003a002000360037002500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000073ae2078e323294282c1e41cb67d5b9c00000000000000000000000010c77651ba0fdb0100000000000000000000000000000d20218f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	white.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	white.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2772	white.exe
2592	ready.exe
2592	ready.exe
2592	ready.exe
2592	ready.exe
2592	ready.exe
2592	ready.exe
2376	AV Protection 2011v121.exe
2376	AV Protection 2011v121.exe
2376	AV Protection 2011v121.exe
2376	AV Protection 2011v121.exe
2376	AV Protection 2011v121.exe
2376	AV Protection 2011v121.exe
2376	AV Protection 2011v121.exe
2376	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1912	AV Protection 2011v121.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2772	white.exe
Token: SeRestorePrivilege	1384	msiexec.exe
Token: SeTakeOwnershipPrivilege	1384	msiexec.exe
Token: SeSecurityPrivilege	1384	msiexec.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
1912	AV Protection 2011v121.exe
2552	explorer.exe
2552	explorer.exe
1912	AV Protection 2011v121.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2656	mrace.exe
2376	AV Protection 2011v121.exe
2376	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe
1912	AV Protection 2011v121.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2772	3068	f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe	30
PID 3068 wrote to memory of 2772	3068	f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe	30
PID 3068 wrote to memory of 2772	3068	f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe	30
PID 3068 wrote to memory of 2772	3068	f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe	30
PID 3068 wrote to memory of 2656	3068	f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe	31
PID 3068 wrote to memory of 2656	3068	f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe	31
PID 3068 wrote to memory of 2656	3068	f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe	31
PID 3068 wrote to memory of 2656	3068	f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe	31
PID 3068 wrote to memory of 2592	3068	f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe	32
PID 3068 wrote to memory of 2592	3068	f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe	32
PID 3068 wrote to memory of 2592	3068	f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe	32
PID 3068 wrote to memory of 2592	3068	f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe	32
PID 2656 wrote to memory of 2384	2656	mrace.exe	33
PID 2656 wrote to memory of 2384	2656	mrace.exe	33
PID 2656 wrote to memory of 2384	2656	mrace.exe	33
PID 2656 wrote to memory of 2384	2656	mrace.exe	33
PID 2656 wrote to memory of 2208	2656	mrace.exe	34
PID 2656 wrote to memory of 2208	2656	mrace.exe	34
PID 2656 wrote to memory of 2208	2656	mrace.exe	34
PID 2656 wrote to memory of 2208	2656	mrace.exe	34
PID 2656 wrote to memory of 2376	2656	mrace.exe	35
PID 2656 wrote to memory of 2376	2656	mrace.exe	35
PID 2656 wrote to memory of 2376	2656	mrace.exe	35
PID 2656 wrote to memory of 2376	2656	mrace.exe	35
PID 2376 wrote to memory of 1912	2376	AV Protection 2011v121.exe	37
PID 2376 wrote to memory of 1912	2376	AV Protection 2011v121.exe	37
PID 2376 wrote to memory of 1912	2376	AV Protection 2011v121.exe	37
PID 2376 wrote to memory of 1912	2376	AV Protection 2011v121.exe	37
PID 2592 wrote to memory of 2440	2592	ready.exe	39
PID 2592 wrote to memory of 2440	2592	ready.exe	39
PID 2592 wrote to memory of 2440	2592	ready.exe	39
PID 2592 wrote to memory of 2440	2592	ready.exe	39
PID 2592 wrote to memory of 1660	2592	ready.exe	41
PID 2592 wrote to memory of 1660	2592	ready.exe	41
PID 2592 wrote to memory of 1660	2592	ready.exe	41
PID 2592 wrote to memory of 1660	2592	ready.exe	41
PID 2592 wrote to memory of 1712	2592	ready.exe	44
PID 2592 wrote to memory of 1712	2592	ready.exe	44
PID 2592 wrote to memory of 1712	2592	ready.exe	44
PID 2592 wrote to memory of 1712	2592	ready.exe	44

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	ready.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	ready.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\white.exe
  "C:\Users\Admin\AppData\Local\Temp\white.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2772
- C:\Users\Admin\AppData\Local\Temp\mrace.exe
  "C:\Users\Admin\AppData\Local\Temp\mrace.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Users\Admin\AppData\Local\Temp\dwme.exe
    "C:\Users\Admin\AppData\Local\Temp\dwme.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2384
- - C:\Users\Admin\AppData\Roaming\dwme.exe
    C:\Users\Admin\AppData\Roaming\dwme.exe auto
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2208
- - C:\Windows\SysWOW64\AV Protection 2011v121.exe
    C:\Windows\system32\AV Protection 2011v121.exe 5985C:\Users\Admin\AppData\Local\Temp\mrace.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\Users\Admin\AppData\Roaming\dpmH5sQJ7E8R9Yw\AV Protection 2011v121.exe
      C:\Users\Admin\AppData\Roaming\dpmH5sQJ7E8R9Yw\AV Protection 2011v121.exe 5985C:\Windows\SysWOW64\AV Protection 2011v121.exe
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:1912
- C:\Users\Admin\AppData\Local\Temp\ready.exe
  "C:\Users\Admin\AppData\Local\Temp\ready.exe"
  2⤵
  - Modifies security service
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2592
- - C:\Users\Admin\AppData\Local\Temp\ready.exe
    C:\Users\Admin\AppData\Local\Temp\ready.exe startC:\Users\Admin\AppData\Roaming\03311\AC432.exe%C:\Users\Admin\AppData\Roaming\03311
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2440
- - C:\Users\Admin\AppData\Local\Temp\ready.exe
    C:\Users\Admin\AppData\Local\Temp\ready.exe startC:\Program Files (x86)\11E36\lvvm.exe%C:\Program Files (x86)\11E36
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1660
- - C:\Program Files (x86)\LP\32F0\9627.tmp
    "C:\Program Files (x86)\LP\32F0\9627.tmp"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1712

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1384

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9UR26M8S\the-causes-and-consequences-of-the-global-chip-shortage[1].htm

Filesize
7KB

MD5
0892695fa35bdde9927774c50e9baf59

SHA1
27b4506380b6aeb2bd2f1357b7dcc67f56b51047

SHA256
be2ce6130d53993dac515e9d8eb0b92407c56802b3185d0cf87034ad07e0b25b

SHA512
5ca4ec8553c73481c15758e0d91ebf087ff3de7e6059dcf87f25c334591ddb047d1ecf0c5fe9e08f6c88db981fd120401123eff3981390270ed28624bea2a0b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AS91FDNI\categories[1].htm

Filesize
3KB

MD5
9a4e4486de14cf62932629508d3ee735

SHA1
c1c699f533487b1f058751cceb7be1e6cdd7f37b

SHA256
5bff863bee1fb0e087b8791ac5eb2ed3d98a49102c3ff86e3272b38ad903404e

SHA512
56627047dc28b74c8a439495122792573286e4f8c2967584cbbe50e1444d663a33e9e2906d94e521f2509a3aee8fc444d796c251c1274666c73f99de26aa000e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AS91FDNI\dogs[1].htm

Filesize
6KB

MD5
e4cc0864d952b5dc9a8e82a3d5749a0d

SHA1
9fcfb189c789768469b76256ee99cb5e368b3b7f

SHA256
2b4180a98e93f65f8b992e5aecfe794e2d890c71d9f86b699eb994caed8afc3e

SHA512
2a14ad904f3407cb3cdcbaf9efef3d76318c9e3f0e488427a6e497bc09626aee785644da95f3c2bb6350cf114c26aaceb908a6228a6e3a0fcfc3cd9724e746e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AS91FDNI\internet-on-mars-and-interplanetary-file-system[1].htm

Filesize
13KB

MD5
6cc813f9b3053662e8e2e787ae508c07

SHA1
aa8bf474c128102fe9a4375b931c76557ec66d08

SHA256
8ba534e1b11360cc428b1a6d39c0c923a0e4879eb5e5eddc3b746f18ca003a6d

SHA512
ce11d07bd8ba98e3f47ea7d1bc6d089b28f18e19c8069de5ca6115d356d41d08c58bcd8cd5c58a2b196bcab7b45758e03d041a2745797c47460600dfd02dfa36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZKZ95V4R\comparing-energy-efficient-home-server-options-making-the-green-choice[1].htm

Filesize
14KB

MD5
2531c38d6be14a78764a32d2fc5d455b

SHA1
2e1e0a79fb69ecddae2458bef617cafa1db704b7

SHA256
1a928165ba149a0fc842f83e11a55e513dd345153e1cf4fa30e340e7150c943d

SHA512
2629073c765c4adeeeda348996c70ddb389159f81e01e004d8402242774070e4fe53aa21635a9e72db13320504608ccf735946483926def5af8d8f7a5761ac93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZKZ95V4R\economy[2].htm

Filesize
9KB

MD5
8385bf8cd7f127bb19a5f45196172d1a

SHA1
1b4f64ee9665680657180f825058c52277dafd14

SHA256
0c1a109959f5543637e10f2af911a2687c467aca3ececd9cd473d3f32d473836

SHA512
9d11d71047a259acbeb293f1f316ecc43b2ab09621c32a1dba0be597ca94b1ff7fa3fdf45f4a01e95148fc6a749c62fe52791a9dbb66e85a4e58c959631a1c3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZKZ95V4R\the-definitive-guide-to-measuring-pounds-and-ounces[1].htm

Filesize
9KB

MD5
0245f12a46aa981eafa0f10cee085017

SHA1
2b459c4262fc5f88b93fea3a7536d60573b93325

SHA256
4169291376ac8c329a72fbce2f67a73b022db6f3c9c96e9d3c181dacdac2c3e1

SHA512
2567b2857b52f665b9ed3ab642d15b58a2e97f338cbd9fbd6250fb5ae104cf703e7a4d878bc6d8dcb906a537d99b19bc001514a627e97450344c5f69e828d18e

Download Submit
C:\Users\Admin\AppData\Local\Temp\~!#4DA4.tmp

Filesize
14KB

MD5
259a8d3ad888cbcb252f4794fdbf67db

SHA1
55822a43b09cc79d9f1fa79199db216c7bf05714

SHA256
eb5c7c97ffa33e21a63e6815bb44d9d75ba21dec2f199c68457f014c68a44e4a

SHA512
dc975cd8d963358436b8430dc92c0b4246a07348d5435804335c855a7de1625dad686f150c2058bad75fc43b898033630d7827cb02e5f08c3c2acab22d94db5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~!#69C8.tmp

Filesize
9KB

MD5
3d1e1165023417f138d0391e6dd3989c

SHA1
22adf9e91dd3eede677436a73e675688ebbbbd4b

SHA256
fcc41d0799711f0a2a3ceebdf4da6aa9fcd4c3e204a29e82371573165ba15a23

SHA512
aa6bd1de09f97c00805e11c3f403c443047e82dc57a241c8f35a77acfe749022e85bbfc233f540bf630788a50ed962030bbbf7b584c8c1819f69a97f32ffabf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\~!#7241.tmp

Filesize
6KB

MD5
af00aab327e33679235de5a456547f24

SHA1
8c33e37e9343fc553472df974ae8993bbaf3e168

SHA256
12c5fbe07d2ff84765532ecda72e099a92c47b56e5dc55633649a7e9573baa5c

SHA512
d3ced6191e0c9ec12ec626f248ed20bffa26aec7683322841c919a438846b21df29525ae5c9fcaf5736b461f250072be54621432898a4a26d92bbc319109dbce

Download Submit
C:\Users\Admin\AppData\Local\Temp\~!#8127.tmp

Filesize
9KB

MD5
e22d9f2a7e7fddab9cb05ca63d9d28b8

SHA1
65e4c5f1b6d6d0f47f1d016f06ff16b663601370

SHA256
436f298462058002ef4358fda5294a8fef5a587af7681c6d27386b0e127b4c8e

SHA512
9d714d9017f8d0d88ee8214b58294b0f3b0248060bb2ce5dea1b8c18bfc11168b637e777046ab2c936ce96e5a2f2d355235da1ee0508f7cb350951b98c22efc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\~!#81A5.tmp

Filesize
13KB

MD5
11d4ef2d2274dc2b2997a9d8b2236927

SHA1
61748b3f8557131f166204104b36a2c6239ef6f0

SHA256
bf98c73b850b220124c503dce46a4efc4c5c9425678361bc31165118008e5dcf

SHA512
8807d68552d50680b9ac5aa705b81561aeaeccd68e78c76cae55362bba5a6018a87fe36cc649b08de27e0d08bea1c32488765b80711f9a9e232686453cfa5691

Download Submit
C:\Users\Admin\AppData\Local\Temp\~!#830F.tmp

Filesize
3KB

MD5
860d8826f614920dc5b53b003c46a334

SHA1
3a1a3dccb5a98985d5e45ce4d275f0d10dd8432c

SHA256
c84bba2ae4755636014416f755ea4bc587b69002e690dba585bf66308159b15f

SHA512
2d0436926941baca87099fe3444946d1a9b9b3979f29e2a2711dd3efd51f73cf9a3e6c82db08f400a577da1263419f0b293de4be9e0f45501c7cef4cec752515

Download Submit
C:\Users\Admin\AppData\Local\Temp\~!#8CE3.tmp

Filesize
7KB

MD5
a4769d88270ef5eb614804ae06408772

SHA1
29a5e08c2a8f48445fa6929cca74ab0c2d0eec55

SHA256
46104ba5128ff3296f7407dee1294b01f8fea57b57de15fc9857f7c37da1a0be

SHA512
3a7e4fe9a7ceafbc0bb7c2abeee404fac87e2961d789a8becbac8b951618e4f3844e6860963d9b3e0db3ba69ee78e768ce1a2ffd399ef979ed40040166ed6954

Download Submit
C:\Users\Admin\AppData\Roaming\03311\1E36.331

Filesize
600B

MD5
3a7b6e15d0323f2e3b59d1ceb409d174

SHA1
f9b5dfb664faa357091410f09963417a1c585633

SHA256
a9e9a67208e95185decee5aa9aecaf4ded4f8cd92aec9adda3e1ca0b4eed7ad6

SHA512
bb63130526ee446dec6cec185002e30e5984ee6a853bb0572d46d804f37ad936b0f6fed97bbd97244614edd029faec31f7e7a71dee230bcfc20489a387e6349b

Download Submit
C:\Users\Admin\AppData\Roaming\03311\1E36.331

Filesize
996B

MD5
767b3ba020ae62fbbe5eafe9f645b4c6

SHA1
7334289c0f33ab570adf7bf36f911e6fa15d0567

SHA256
999d9824b2658317c86a7052bfe7c58fbcf569db4914ce7081d9bf94037018d3

SHA512
27caf9edc5128eed377343ac84db784681833925c316d1c107f267d657d6127f77c22aaff10fc2c468e53bfd4fb346b3a7bfaedc9aa92fba5d57a821b3449943

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AV Protection 2011\AV Protection 2011.lnk

Filesize
1KB

MD5
caf6a1e23b02b66869fae7e1e989250d

SHA1
39161b604381fae27ebafe7d730ab832ac85579e

SHA256
126db749562984e46488cf5e308727cc5803157b0eda7426cee80cf96f50f4c0

SHA512
0791d8ac08e31ba6b7c33df96504c7390365cfa5adfa46508eb1fc0fd47eea4d48e156b09bc773399fb514b2acb180b1f21c3d578c1ea15deb974fab356fcacc

Download Submit
C:\Users\Admin\AppData\Roaming\WfEL9gTZqYwIrOt\AV Protection 2011.ico

Filesize
12KB

MD5
bb87f71a6e7f979fcb716926d452b6a8

SHA1
f41e3389760eaea099720e980e599a160f0413b9

SHA256
14c9c49d8ead9ab59a56c328008f59c20b32c3ad22c00e02d34e16ad7086fe84

SHA512
e1d14363274e367ea600afc357d012233fc68f0636e8d05b29992e762d31e9a55b4fa38b08613c2ca528d7fb0f547774a3a3dc79aada32c2c7359c3edcdb549d

Download Submit
C:\Users\Admin\AppData\Roaming\ldr.ini

Filesize
612B

MD5
d4dc561a052d4f5f5f2f4ca054a6d9d0

SHA1
43bf254b60a98e6688a5f3a882462ed014644d40

SHA256
c95eae8e6d05801474aeb7cc35e4e02ccbdaf354b12a48acd1189e84739cccf9

SHA512
2a343307831d9eaac7ab1d876a354f654148f74bfa755da21c249fe6c782ea944708c1c41d803641a60c70927325bca4564ecd92e572f37bc22836c0b6617ec1

Download Submit
C:\Users\Admin\AppData\Roaming\ldr.ini

Filesize
1KB

MD5
0fa63e0b235a49b1883114ac089d06a8

SHA1
24c8a397e8af9bc3303529ce2ea4cf4549f6fe43

SHA256
8e0bd99920ea87510586aa2427983a72ffb8ec1fa9fb8b0380a5dc0eb3342282

SHA512
49c589d13cfcf8d36c746cff079a1c0f42c003427eb0ae3ff6ac3f390db20631010a3d6bb134075f432ad5226affe18364b7e13d10ee5399c9878ddb0193998d

Download Submit
C:\Users\Admin\Desktop\AV Protection 2011.lnk

Filesize
1KB

MD5
48b07e5b865e53da6e25ad7ac10ea65a

SHA1
328ab1007d847dcca576ccf309ee03dd6606a374

SHA256
738171e75b306970ad8764d06680bfeec284dd85569412f945e6f10108dc67a7

SHA512
9b02d459ddd8da7235bcb41b5006a1335aff12a737584d732b536a34e3b16e8fb685e3ddfdc67cf3a0903f000e0f1a8509ad31aa360bf129f1d56a35d6a3275c

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
0c7507b36c53bb50ab29842ceda6bf5e

SHA1
a772f99514dd18a29b1233d16392bdedd384b7de

SHA256
7a270ccdfd864348c0f4eb9f35caf0e57bda75f2aa7d525a72c18fe82b313f97

SHA512
f937ebda34dcff296fbb1dff04428f7b0f308e8927f6d5fc9f715687abea342b7eacf372fb0c1e6e99ef3df04f120ee581f6fcf14a519347ba3ae3a9cdeb46aa

Download Submit
\Program Files (x86)\LP\32F0\9627.tmp

Filesize
99KB

MD5
82d50af33ff156670a076dc834a99b4d

SHA1
d5e3662e28d51a8366fb214d77585b95984541d1

SHA256
7f57b37aa39698068271e64bbb42ff74b1a2b6157d233d8bdef1f683a7230a7d

SHA512
527986d4cca9998059e278de71989f3f46851eace0370cb2bfd69dc7292d5a1597a373ff2b350137eeea8dd7dd13a0e8de8b6306795e4b5a6428fab6c1b27563

Download Submit
\Users\Admin\AppData\Local\Temp\dwme.exe

Filesize
283KB

MD5
cc6f0b2fd70c63672de6c1249f0e9cbb

SHA1
72caa65da6f0a4ce78a0c22b5ad64540b87e2912

SHA256
3e4d6fd109879dc3f608f08e0e152b26b93dce0d08e10d4c2308aedf2fbc1177

SHA512
a8b2199357092780aa62db1959bc631cd8138e54fb62312fbc10738fa5543afa3e252e0fc3ec08399e7c80e2cfcfa795262b0060ad4386811219cac94b032db6

Download Submit
\Users\Admin\AppData\Local\Temp\mrace.exe

Filesize
1.9MB

MD5
a814cab54088bb64dd76909325d8255c

SHA1
87beb3172b2c5e1f80d945d2081963b89a71d405

SHA256
8777bc9b25e97841baa95f8c33a7f48386feec1ece6e642fa8c305c359737a29

SHA512
51854b2ee5f73ff4861cf4724ee9c23e882c4c21fd15c56987c8c4e4f88f8571c3488cecac13cb7c08013fe84b1aa1ed61e14e8ed19fa4ab92d718f48860df5b

Download Submit
\Users\Admin\AppData\Local\Temp\ready.exe

Filesize
283KB

MD5
9943ac3536f8595fa7d492f89d67a179

SHA1
730bcfa82e14745f88b99dbcc78e438899215963

SHA256
e6a961219d4c28fbc8301a3e84e5d72b984ad42245569881a80450af0984b703

SHA512
db825f1db2b9ce560110b148f3de131c77c5d6aab854fa3537db7609b090d1246ee25f82a00005de9dacdfcb09d8f0e9e473febce4872377f045fe000d5e2a78

Download Submit
\Users\Admin\AppData\Local\Temp\white.exe

Filesize
17KB

MD5
e2f50ad18ee46952ea1910b826ef2ad1

SHA1
531b13b6beb89d4fb74ffd2b44d241f0c0b5ccb7

SHA256
882ad3e502cfa58fcb568fbd8ab0da8c0628475e497370e73b137e394e850cc6

SHA512
a540aeabc761c9338eee5625351515dd1830aed6cf5d86a5b5c68e62ff653f8ef9fab497679de739e9ba260b81bc4544d5f283b5b98c016060237b3225eed482

Download Submit
memory/1660-542-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1712-831-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1912-386-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/1912-826-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/1912-851-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/1912-839-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/1912-612-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/1912-168-0x0000000002DA0000-0x0000000003191000-memory.dmp

Filesize
3.9MB

Download
memory/2208-162-0x0000000000580000-0x0000000000680000-memory.dmp

Filesize
1024KB

Download
memory/2208-163-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2376-144-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/2376-79-0x0000000002EE0000-0x00000000032D1000-memory.dmp

Filesize
3.9MB

Download
memory/2384-151-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2440-289-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2592-749-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2592-832-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2592-871-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2592-285-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2592-506-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2656-52-0x0000000002DC0000-0x00000000031B1000-memory.dmp

Filesize
3.9MB

Download
memory/2656-78-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/2772-21-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3068-51-0x0000000000400000-0x0000000000967000-memory.dmp

Filesize
5.4MB

Download
memory/3068-1-0x0000000000400000-0x0000000000967000-memory.dmp

Filesize
5.4MB

Download
memory/3068-2-0x0000000000400000-0x0000000000967000-memory.dmp

Filesize
5.4MB

Download
memory/3068-0-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download
memory/3068-4-0x0000000000400000-0x0000000000967000-memory.dmp

Filesize
5.4MB

Download