Overview

overview

10

Static

static

3

f7a46b53af...18.exe

windows7-x64

10

f7a46b53af...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26-09-2024 05:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f7a46b53afa7814e739d59fcdbd527fc_JaffaCakes118.exe

  • Size

    2.8MB

  • MD5

    f7a46b53afa7814e739d59fcdbd527fc

  • SHA1

    b1d3158156a63d3981c3d49c33bb94ef899611d6

  • SHA256

    c4d9d25dedcb02acf6eae98dec3fae4e53585ef8486d755f2b77740dd7ba7797

  • SHA512

    0bb5d13d55fd27f1feb8c055118ba43fa0a611a2512abafbaceba0d2d3c0e5e9a45520d2f8093070589df422721f568fcc6b59fc2c994288ab5d2ec898b6b5da

  • SSDEEP

    49152:Kkqgee3wKnRhpv83eiLG36HlHVQZTpzRcxen5+saw9FF9+4eIDTeWY5g:LeegihkpzHlHoFRcgn/B3P+eeW

Score
10/10
orcuscredential_accessdefense_evasiondiscoveryratspywarestealer

Malware Config

Extracted

Family

orcus

C2

18.221.17.220:1604

Mutex

1141a9276f324b1f8a2d4f8f2fec0ac5

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %temp%\drivers\ac2ftsdgj8m5ms5.exe

  • reconnect_delay

    10000

  • registry_keyname

    steam

  • taskscheduler_taskname

    steam

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus
  • Orcurs Rat Executable 6 IoCs
  • Executes dropped EXE 38 IoCs
  • Loads dropped DLL 61 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Suspicious use of SetThreadContext 13 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 6 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 61 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • NTFS ADS 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 61 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f7a46b53afa7814e739d59fcdbd527fc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f7a46b53afa7814e739d59fcdbd527fc_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1820
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3044
      • C:\Users\Admin\AppData\Local\Temp\ProcessHacker.exe
        "C:\Users\Admin\AppData\Local\Temp\ProcessHacker.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2720
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2872
        • C:\Users\Admin\AppData\Local\Temp\svhost.exe
          "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2896
      • C:\Users\Admin\AppData\Local\Temp\svñhost.exe
        "C:\Users\Admin\AppData\Local\Temp\svñhost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2712
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/svñhost.exe" "%appdata%\Microsoft\MsDrvOp.exe" /Y
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1760
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%appdata%\Microsoft\MsDrvOp.exe.lnk" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2436
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\MsDrvOp.exe.lnk" /f
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1428
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %appdata%\Microsoft\MsDrvOp.exe:Zone.Identifier
          4⤵
          • Subvert Trust Controls: Mark-of-the-Web Bypass
          • System Location Discovery: System Language Discovery
          • NTFS ADS
          PID:2376
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c ren "%appdata%\Microsoft\MsDrvOp.exe.jpg" MsDrvOp.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:556
        • C:\Users\Admin\AppData\Local\Temp\tmp.exe
          "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2832
          • C:\Users\Admin\AppData\Local\Temp\ProcessHacker.exe
            "C:\Users\Admin\AppData\Local\Temp\ProcessHacker.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:1228
          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
            "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:760
            • C:\Users\Admin\AppData\Local\Temp\svhost.exe
              "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2764
          • C:\Users\Admin\AppData\Local\Temp\svñhost.exe
            "C:\Users\Admin\AppData\Local\Temp\svñhost.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1712
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/svñhost.exe" "%appdata%\Microsoft\MsDrvOp.exe" /Y
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1608
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%appdata%\Microsoft\MsDrvOp.exe.lnk" /f
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2884
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\MsDrvOp.exe.lnk" /f
                7⤵
                • System Location Discovery: System Language Discovery
                PID:492
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %appdata%\Microsoft\MsDrvOp.exe:Zone.Identifier
              6⤵
              • Subvert Trust Controls: Mark-of-the-Web Bypass
              • System Location Discovery: System Language Discovery
              • NTFS ADS
              PID:2816
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c ren "%appdata%\Microsoft\MsDrvOp.exe.jpg" MsDrvOp.exe
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2664
            • C:\Users\Admin\AppData\Local\Temp\tmp.exe
              "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:2028
              • C:\Users\Admin\AppData\Local\Temp\ProcessHacker.exe
                "C:\Users\Admin\AppData\Local\Temp\ProcessHacker.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:1756
              • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1644
                • C:\Users\Admin\AppData\Local\Temp\svhost.exe
                  "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2260
              • C:\Users\Admin\AppData\Local\Temp\svñhost.exe
                "C:\Users\Admin\AppData\Local\Temp\svñhost.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1316
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/svñhost.exe" "%appdata%\Microsoft\MsDrvOp.exe" /Y
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:1912
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%appdata%\Microsoft\MsDrvOp.exe.lnk" /f
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:1732
                  • C:\Windows\SysWOW64\reg.exe
                    reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\MsDrvOp.exe.lnk" /f
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:1676
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %appdata%\Microsoft\MsDrvOp.exe:Zone.Identifier
                  8⤵
                  • Subvert Trust Controls: Mark-of-the-Web Bypass
                  • System Location Discovery: System Language Discovery
                  • NTFS ADS
                  PID:2868
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c ren "%appdata%\Microsoft\MsDrvOp.exe.jpg" MsDrvOp.exe
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:2760
                • C:\Users\Admin\AppData\Local\Temp\tmp.exe
                  "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
                  8⤵
                  • Executes dropped EXE
                  PID:2072
                • C:\Users\Admin\AppData\Local\Temp\svñhost.exe
                  "C:/Users/Admin/AppData/Local/Temp/svñhost.exe"
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1740
            • C:\Users\Admin\AppData\Local\Temp\svñhost.exe
              "C:/Users/Admin/AppData/Local/Temp/svñhost.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2708
        • C:\Users\Admin\AppData\Local\Temp\svñhost.exe
          "C:/Users/Admin/AppData/Local/Temp/svñhost.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2796
    • C:\Users\Admin\AppData\Local\Temp\svhost.exe
      "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2348
      • C:\Users\Admin\AppData\Local\Temp\ProcessHacker.exe
        "C:\Users\Admin\AppData\Local\Temp\ProcessHacker.exe"
        3⤵
        • Executes dropped EXE
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3000
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2924
        • C:\Users\Admin\AppData\Local\Temp\svhost.exe
          "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2900
      • C:\Users\Admin\AppData\Local\Temp\svñhost.exe
        "C:\Users\Admin\AppData\Local\Temp\svñhost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2844
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/svñhost.exe" "%appdata%\Microsoft\MsDrvOp.exe" /Y
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2828
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%appdata%\Microsoft\MsDrvOp.exe.lnk" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2256
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\MsDrvOp.exe.lnk" /f
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2368
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %appdata%\Microsoft\MsDrvOp.exe:Zone.Identifier
          4⤵
          • Subvert Trust Controls: Mark-of-the-Web Bypass
          • System Location Discovery: System Language Discovery
          • NTFS ADS
          PID:2420
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c ren "%appdata%\Microsoft\MsDrvOp.exe.jpg" MsDrvOp.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1356
        • C:\Users\Admin\AppData\Local\Temp\tmp.exe
          "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3020
          • C:\Users\Admin\AppData\Local\Temp\ProcessHacker.exe
            "C:\Users\Admin\AppData\Local\Temp\ProcessHacker.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:1784
          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
            "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:752
            • C:\Users\Admin\AppData\Local\Temp\svhost.exe
              "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2496
          • C:\Users\Admin\AppData\Local\Temp\svñhost.exe
            "C:\Users\Admin\AppData\Local\Temp\svñhost.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1660
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/svñhost.exe" "%appdata%\Microsoft\MsDrvOp.exe" /Y
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2576
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%appdata%\Microsoft\MsDrvOp.exe.lnk" /f
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1800
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\MsDrvOp.exe.lnk" /f
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1676
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %appdata%\Microsoft\MsDrvOp.exe:Zone.Identifier
              6⤵
              • Subvert Trust Controls: Mark-of-the-Web Bypass
              • System Location Discovery: System Language Discovery
              • NTFS ADS
              PID:3068
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c ren "%appdata%\Microsoft\MsDrvOp.exe.jpg" MsDrvOp.exe
              6⤵
              • System Location Discovery: System Language Discovery
              PID:828
            • C:\Users\Admin\AppData\Local\Temp\tmp.exe
              "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:2412
              • C:\Users\Admin\AppData\Local\Temp\ProcessHacker.exe
                "C:\Users\Admin\AppData\Local\Temp\ProcessHacker.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:2416
              • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:888
                • C:\Users\Admin\AppData\Local\Temp\svhost.exe
                  "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1368
              • C:\Users\Admin\AppData\Local\Temp\svñhost.exe
                "C:\Users\Admin\AppData\Local\Temp\svñhost.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2580
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/svñhost.exe" "%appdata%\Microsoft\MsDrvOp.exe" /Y
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:2388
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%appdata%\Microsoft\MsDrvOp.exe.lnk" /f
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:2068
                  • C:\Windows\SysWOW64\reg.exe
                    reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\MsDrvOp.exe.lnk" /f
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:2212
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %appdata%\Microsoft\MsDrvOp.exe:Zone.Identifier
                  8⤵
                  • Subvert Trust Controls: Mark-of-the-Web Bypass
                  • System Location Discovery: System Language Discovery
                  • NTFS ADS
                  PID:2616
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c ren "%appdata%\Microsoft\MsDrvOp.exe.jpg" MsDrvOp.exe
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:2272
                • C:\Users\Admin\AppData\Local\Temp\tmp.exe
                  "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
                  8⤵
                  • Executes dropped EXE
                  PID:1292
                • C:\Users\Admin\AppData\Local\Temp\svñhost.exe
                  "C:/Users/Admin/AppData/Local/Temp/svñhost.exe"
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:492
            • C:\Users\Admin\AppData\Local\Temp\svñhost.exe
              "C:/Users/Admin/AppData/Local/Temp/svñhost.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2700
        • C:\Users\Admin\AppData\Local\Temp\svñhost.exe
          "C:/Users/Admin/AppData/Local/Temp/svñhost.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:840
  • C:\Windows\system32\conhost.exe
    \??\C:\Windows\system32\conhost.exe "14798453491518296743-1819757353-1943307198-1855389327-1920616142-1444227744552979869"
    1⤵
      PID:1732
    • C:\Windows\system32\conhost.exe
      \??\C:\Windows\system32\conhost.exe "1848386588454279316184253736945662524023948677614757790543246425371283159045"
      1⤵
        PID:2868

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\CabCA34.tmp
        Filesize

        70KB

        MD5

        49aebf8cbd62d92ac215b2923fb1b9f5

        SHA1

        1723be06719828dda65ad804298d0431f6aff976

        SHA256

        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

        SHA512

        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\TarCAB4.tmp
        Filesize

        181KB

        MD5

        4ea6026cf93ec6338144661bf1202cd1

        SHA1

        a1dec9044f750ad887935a01430bf49322fbdcb7

        SHA256

        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

        SHA512

        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        Filesize

        408KB

        MD5

        bcc445de41fcfbbad5c4b0b0a4ea859a

        SHA1

        520466387cc8283238d2b69252051de0853e2e74

        SHA256

        aac1eb531b6f215859319664221f762e837d5c19db39f75193ff28f768170bf0

        SHA512

        c2696bba3ffd74e2421de45a55c76a6dbbdd0c1c3266d711a533b9d38d9cee5a33c55b1053044ca7373b625aba37aa87d6b0b1ea61bc899ac113fdac31e92c5b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\svhost.exe
        Filesize

        255KB

        MD5

        9af17c8393f0970ee5136bd3ffa27001

        SHA1

        4b285b72c1a11285a25f31f2597e090da6bbc049

        SHA256

        71d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019

        SHA512

        b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\svñhost.exe
        Filesize

        1009KB

        MD5

        eee2282277e64485627c058793aa65e0

        SHA1

        ed5ae121bf074decf9b7a95214e67874733a5cf2

        SHA256

        79e31aa291777d936bdbd198ebf53f3b7d230972fcf95f92908872aca6bf888c

        SHA512

        b5ea27c4b0e14687065c94b72fa3c177fe161a92c15aad7db48a466ea34745fbfd15d7305f022ef322f41169b81df621253ace5d0720d11eb8ccc688a251767b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\tmp.exe
        Filesize

        2.5MB

        MD5

        79682b35bc0d20012d115b060b13d59e

        SHA1

        187d5ae4ce46095c2a05fe45fe768bbb92b3e164

        SHA256

        c06240ad1258978e6588fd6b4c9efe32e90d109e5728848b0aed413a4c568b5e

        SHA512

        b727075ce2f003de057f0aeb8e53bcadeaa5bc685bc606b8e94078bbb61a1ea84a4f66d60e50a1574785d9ad0352235028861e0625929d77cafa52fb3e9ff24e

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\vlmi{lolz}yg.col
        Filesize

        148KB

        MD5

        90a1d4b55edf36fa8b4cc6974ed7d4c4

        SHA1

        aba1b8d0e05421e7df5982899f626211c3c4b5c1

        SHA256

        7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

        SHA512

        ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\MsDrvOp.exe.lnk
        Filesize

        764B

        MD5

        e55660256a086b722f1700b2a629b679

        SHA1

        61f25d6145f6c7ba252ba23d52061065e5b6be48

        SHA256

        5b08a07dcaa6ca0ba33d42df419908b67d53fe984c4a6299ae03e45216e7d76e

        SHA512

        a0ab1e794bea163c3ca9d71486bc1e53a761405589f2b6a3a79b7bd245f42c6e5aa89942d7cd3f0afaf29db70a5ff6362bd6b833747ef43694d4a2032bd9df7e

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\MsDrvOp.exe:Zone.Identifier
        Filesize

        27B

        MD5

        130a75a932a2fe57bfea6a65b88da8f6

        SHA1

        b66d7530d150d45c0a390bb3c2cd4ca4fc404d1c

        SHA256

        f2b79cae559d6772afc1c2ed9468988178f8b6833d5028a15dea73ce47d0196e

        SHA512

        6cd147c6f3af95803b7b0898e97ec2ed374c1f56a487b50e3d22003a67cec26a6fa12a3920b1b5624bde156f9601469ae3c7b7354fa8cf37be76c84121767eed

        Download Submit

      • C:\Users\Admin\AppData\Roaming\ptst3s8u7y4q9s3s8u7y4q9s\Files\AssertWatch.docx
        Filesize

        15KB

        MD5

        faaddff32731eacc3fb7719ade52a451

        SHA1

        65fdb728f2edd43a0e2901361f7c9e046708bea9

        SHA256

        98e869511a290ed0de52bcdfe55fff8a8b8bb8365861f54f419e64be1b06474e

        SHA512

        a263653188007052dbb1cbfc403651efc992fd983dacf09c3d724410d40635a5b841380e8d655bab41aeb921f44ab366ced17674c09df99da4b23bb279396b1f

        Download Submit

      • C:\Users\Admin\AppData\Roaming\ptst3s8u7y4q9s3s8u7y4q9s\Files\GetRestore.docx
        Filesize

        13KB

        MD5

        d54347e08727b7cdf00c9c5570e58d1e

        SHA1

        fa3896d04db8aa956ef9d99c5cb5a773c81491ca

        SHA256

        9b1cbe30607f8203ee554b05f9a44c4576b4428aa8fd717373c66a7bfcba734e

        SHA512

        0fd20b1261278f4f00a1fd4e1e95f506b409843b47e1be7849b0a3732fbe6d3058baa6b6069291032ca61f308a1ecfdc9aeea1255572c98383ad4f8309048882

        Download Submit

      • C:\Users\Admin\AppData\Roaming\ptst3s8u7y4q9s3s8u7y4q9s\Files\ShowInvoke.docx
        Filesize

        17KB

        MD5

        9efa5309e2b5c875842231434e60668f

        SHA1

        e9f22ecfc969485ad16e8102be0109f567f77955

        SHA256

        0062292c795bbbcf704eb920f9d824b7cd809b247b73aace7e51c142991906a9

        SHA512

        c5c4eaffeb71d45964557d9ca0a69451624c15fddef7dc84c65b5cedac01ce001507e28c98716f75f7d79d64215a45a0b7ab16bffe80f84dab2f11e0a9af8d36

        Download Submit

      • C:\Users\Admin\AppData\Roaming\ptst3s8u7y4q9s3s8u7y4q9s\Files\SwitchGet.docx
        Filesize

        601KB

        MD5

        e39bcb7354a7bad50a6459976c75a118

        SHA1

        6899e437880c30428ffed9aa1987f813bdc458f6

        SHA256

        8a13d69a4577c522c1022cb0fc03ce15e0bc3861b51cb1986dff2e6c76e21e83

        SHA512

        8925302664c04c105af851473e1e00a497f986c18dc8ea17ffe0be0e626dfa2b76f0b98e0cad2195d7f928446df8ed1d6923260a2a8c7061b5afd71a4bec9947

        Download Submit

      • C:\Users\Admin\AppData\Roaming\ptst3s8u7y4q9s3s8u7y4q9s\Files\SyncRevoke.docx
        Filesize

        14KB

        MD5

        1916333ac1269b376b17b8bf3ff17a5f

        SHA1

        d94dc8366db381bd59395da996b6c9dc65867b03

        SHA256

        996dd0736269e7e30305d1528f4ce4be505ec72649d7b53c802bd443180ccb76

        SHA512

        6e7a1a9b310f9c0485c565cf57ebc24d0dd6890b71bba28fc7d1103945ac789f1f580fbe2add3c6ea304be1a147f01c78f88e6422aa35f1e8dc76b484e0c7a59

        Download Submit

      • \Users\Admin\AppData\Local\Temp\ProcessHacker.exe
        Filesize

        1.6MB

        MD5

        b365af317ae730a67c936f21432b9c71

        SHA1

        a0bdfac3ce1880b32ff9b696458327ce352e3b1d

        SHA256

        bd2c2cf0631d881ed382817afcce2b093f4e412ffb170a719e2762f250abfea4

        SHA512

        cc3359e16c6fe905a9e176a87acf4c4ed5e22c29bfca11949799caf8442e00ec0d1679b3d8754dbc3e313528d3e8e82c0ec1941e2c3530b48229c1cb337f6b8b

        Download Submit

      • memory/840-134-0x0000000000400000-0x00000000004E8000-memory.dmp

        Filesize

        928KB

        Download

      • memory/840-138-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/840-130-0x0000000000400000-0x00000000004E8000-memory.dmp

        Filesize

        928KB

        Download

      • memory/840-132-0x0000000000400000-0x00000000004E8000-memory.dmp

        Filesize

        928KB

        Download

      • memory/840-136-0x0000000000400000-0x00000000004E8000-memory.dmp

        Filesize

        928KB

        Download

      • memory/840-139-0x0000000000400000-0x00000000004E8000-memory.dmp

        Filesize

        928KB

        Download

      • memory/840-141-0x0000000000400000-0x00000000004E8000-memory.dmp

        Filesize

        928KB

        Download

      • memory/840-142-0x0000000000400000-0x00000000004E8000-memory.dmp

        Filesize

        928KB

        Download

      • memory/840-146-0x00000000002F0000-0x00000000002FE000-memory.dmp

        Filesize

        56KB

        Download

      • memory/840-159-0x0000000004940000-0x000000000499C000-memory.dmp

        Filesize

        368KB

        Download

      • memory/1820-2-0x0000000074060000-0x000000007474E000-memory.dmp

        Filesize

        6.9MB

        Download

      • memory/1820-1-0x0000000000E60000-0x0000000001126000-memory.dmp

        Filesize

        2.8MB

        Download

      • memory/1820-3-0x0000000004FC0000-0x000000000524C000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/1820-471-0x000000007406E000-0x000000007406F000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1820-0-0x000000007406E000-0x000000007406F000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1820-476-0x0000000074060000-0x000000007474E000-memory.dmp

        Filesize

        6.9MB

        Download

      • memory/1820-500-0x0000000074060000-0x000000007474E000-memory.dmp

        Filesize

        6.9MB

        Download

      • memory/2072-358-0x0000000001000000-0x00000000010E8000-memory.dmp

        Filesize

        928KB

        Download

      • memory/2348-21-0x0000000000400000-0x0000000000697000-memory.dmp

        Filesize

        2.6MB

        Download

      • memory/2348-29-0x0000000000400000-0x0000000000697000-memory.dmp

        Filesize

        2.6MB

        Download

      • memory/2348-112-0x0000000000400000-0x0000000000697000-memory.dmp

        Filesize

        2.6MB

        Download

      • memory/2348-23-0x0000000000400000-0x0000000000697000-memory.dmp

        Filesize

        2.6MB

        Download

      • memory/2348-17-0x0000000000400000-0x0000000000697000-memory.dmp

        Filesize

        2.6MB

        Download

      • memory/2348-18-0x0000000000400000-0x0000000000697000-memory.dmp

        Filesize

        2.6MB

        Download

      • memory/2348-19-0x0000000000400000-0x0000000000697000-memory.dmp

        Filesize

        2.6MB

        Download

      • memory/2348-20-0x0000000000400000-0x0000000000697000-memory.dmp

        Filesize

        2.6MB

        Download

      • memory/2348-26-0x0000000000400000-0x0000000000697000-memory.dmp

        Filesize

        2.6MB

        Download

      • memory/2348-22-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2708-338-0x0000000000740000-0x0000000000750000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2708-305-0x00000000006D0000-0x00000000006E8000-memory.dmp

        Filesize

        96KB

        Download

      • memory/2708-304-0x00000000003F0000-0x0000000000402000-memory.dmp

        Filesize

        72KB

        Download

      • memory/2712-107-0x0000000000C10000-0x0000000000D12000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/2712-108-0x0000000004690000-0x0000000004776000-memory.dmp

        Filesize

        920KB

        Download

      • memory/2872-47-0x00000000012E0000-0x000000000134C000-memory.dmp

        Filesize

        432KB

        Download

      • memory/2900-66-0x0000000000400000-0x0000000000449000-memory.dmp

        Filesize

        292KB

        Download

      • memory/2900-71-0x0000000000400000-0x0000000000449000-memory.dmp

        Filesize

        292KB

        Download

      • memory/2900-62-0x0000000000400000-0x0000000000449000-memory.dmp

        Filesize

        292KB

        Download

      • memory/2900-70-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2900-68-0x0000000000400000-0x0000000000449000-memory.dmp

        Filesize

        292KB

        Download

      • memory/2900-64-0x0000000000400000-0x0000000000449000-memory.dmp

        Filesize

        292KB

        Download

      • memory/2900-60-0x0000000000400000-0x0000000000449000-memory.dmp

        Filesize

        292KB

        Download

      • memory/2900-73-0x0000000000400000-0x0000000000449000-memory.dmp

        Filesize

        292KB

        Download

      • memory/2924-54-0x0000000000AB0000-0x0000000000AFA000-memory.dmp

        Filesize

        296KB

        Download

      • memory/3000-75-0x0000000140000000-0x00000001405E8000-memory.dmp

        Filesize

        5.9MB

        Download

      • memory/3000-76-0x0000000140000000-0x00000001405E8000-memory.dmp

        Filesize

        5.9MB

        Download

      • memory/3000-499-0x0000000140000000-0x00000001405E8000-memory.dmp

        Filesize

        5.9MB

        Download

      • memory/3000-498-0x0000000140000000-0x00000001405E8000-memory.dmp

        Filesize

        5.9MB

        Download

      • memory/3000-74-0x0000000140000000-0x00000001405E8000-memory.dmp

        Filesize

        5.9MB

        Download