57f6400d0bc15b86ba457676acd549522e276aadbf1dc2e3b2b25d10f6c7ab64

Analysis

max time kernel
126s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 05:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
Size

792KB
MD5

fb9eb4462f8fe117dc159b8784f9e2a9
SHA1

62f54696563c2f474cd2a6225e3ab57facf5cb4f
SHA256

57f6400d0bc15b86ba457676acd549522e276aadbf1dc2e3b2b25d10f6c7ab64
SHA512

401d9c7c4c146520d35c2c2ae2df384faea80c388a6d48231c1826c9f92cfa27c16f03081efccfe986ecf4b17b2625343a1edbf9e6408d7ae9335c32381e4a5a
SSDEEP

12288:JjcxeMzYtcFERJmrbWeAynyfumsb26/f:lcxeMz/GJmWeAyncu1bV

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe gphone.exe"	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe

Disables Task Manager via registry modification
evasion

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Windows\\system32\\gphone.exe"	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\z:	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
File opened (read-only)	\??\n:	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
File opened (read-only)	\??\o:	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
File opened (read-only)	\??\r:	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
File opened (read-only)	\??\u:	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
File opened (read-only)	\??\v:	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
File opened (read-only)	\??\x:	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
File opened (read-only)	\??\g:	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
File opened (read-only)	\??\i:	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
File opened (read-only)	\??\j:	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
File opened (read-only)	\??\k:	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
File opened (read-only)	\??\p:	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
File opened (read-only)	\??\s:	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
File opened (read-only)	\??\b:	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
File opened (read-only)	\??\e:	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
File opened (read-only)	\??\l:	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
File opened (read-only)	\??\m:	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
File opened (read-only)	\??\q:	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
File opened (read-only)	\??\a:	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
File opened (read-only)	\??\h:	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
File opened (read-only)	\??\t:	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
File opened (read-only)	\??\w:	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
File opened (read-only)	\??\y:	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2112-0-0x0000000000400000-0x0000000000495000-memory.dmp	autoit_exe
behavioral1/files/0x00070000000193d9-10.dat	autoit_exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\\autorun.inf	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
File created	\??\d:\autorun.inf	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
File created	\??\f:\autorun.inf	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\gphone.exe	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\gphone.exe	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\autorun.ini	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\gphone.exe	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
File opened for modification	C:\Windows\gphone.exe	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://rnd009.googlepages.com/google.html"	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://rnd009.googlepages.com/google.html"	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://rnd009.googlepages.com/google.html"	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://rnd009.googlepages.com/google.html"	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://rnd009.googlepages.com/google.html"	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: 33	2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
Token: 33	2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
Token: 33	2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2792	2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe	30
PID 2112 wrote to memory of 2792	2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe	30
PID 2112 wrote to memory of 2792	2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe	30
PID 2112 wrote to memory of 2792	2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe	30
PID 2792 wrote to memory of 2816	2792	cmd.exe	32
PID 2792 wrote to memory of 2816	2792	cmd.exe	32
PID 2792 wrote to memory of 2816	2792	cmd.exe	32
PID 2792 wrote to memory of 2816	2792	cmd.exe	32
PID 2112 wrote to memory of 2708	2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe	33
PID 2112 wrote to memory of 2708	2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe	33
PID 2112 wrote to memory of 2708	2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe	33
PID 2112 wrote to memory of 2708	2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe	33
PID 2708 wrote to memory of 2108	2708	cmd.exe	35
PID 2708 wrote to memory of 2108	2708	cmd.exe	35
PID 2708 wrote to memory of 2108	2708	cmd.exe	35
PID 2708 wrote to memory of 2108	2708	cmd.exe	35
PID 2112 wrote to memory of 2688	2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe	36
PID 2112 wrote to memory of 2688	2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe	36
PID 2112 wrote to memory of 2688	2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe	36
PID 2112 wrote to memory of 2688	2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe	36
PID 2688 wrote to memory of 2664	2688	cmd.exe	38
PID 2688 wrote to memory of 2664	2688	cmd.exe	38
PID 2688 wrote to memory of 2664	2688	cmd.exe	38
PID 2688 wrote to memory of 2664	2688	cmd.exe	38
PID 2112 wrote to memory of 2740	2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe	39
PID 2112 wrote to memory of 2740	2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe	39
PID 2112 wrote to memory of 2740	2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe	39
PID 2112 wrote to memory of 2740	2112	fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe	39
PID 2740 wrote to memory of 2588	2740	cmd.exe	41
PID 2740 wrote to memory of 2588	2740	cmd.exe	41
PID 2740 wrote to memory of 2588	2740	cmd.exe	41
PID 2740 wrote to memory of 2588	2740	cmd.exe	41

C:\Users\Admin\AppData\Local\Temp\fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fb9eb4462f8fe117dc159b8784f9e2a9_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT /delete /yes
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\SysWOW64\at.exe
    AT /delete /yes
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\gphone.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\SysWOW64\at.exe
    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\gphone.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C cacls "C:\system volume information" /e /g "Admin":f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\system volume information" /e /g "Admin":f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C cacls "C:\system volume information" /e /g "Admin":f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\system volume information" /e /g "Admin":f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\gphone.exe

Filesize
792KB

MD5
fb9eb4462f8fe117dc159b8784f9e2a9

SHA1
62f54696563c2f474cd2a6225e3ab57facf5cb4f

SHA256
57f6400d0bc15b86ba457676acd549522e276aadbf1dc2e3b2b25d10f6c7ab64

SHA512
401d9c7c4c146520d35c2c2ae2df384faea80c388a6d48231c1826c9f92cfa27c16f03081efccfe986ecf4b17b2625343a1edbf9e6408d7ae9335c32381e4a5a

Download Submit
F:\autorun.inf

Filesize
96B

MD5
0450bd6f856c038a41ab0e645b3b293b

SHA1
ebbca685215823672fd692f6c3612f06dc30e084

SHA256
11c6c38ee3e9cf9802cac107f4e4c24a070b0e43467842f401feee33b6967d5d

SHA512
d1b0ed2662b274abd80e8d33775fcfaa30fe693707dc61ff2e0c2bd2f2ce50d2f3cac5d2a9f4f2fdf4232ebe72206fd47b86305d0c4d4d1bd147ba913e110fb8

Download Submit
memory/2112-0-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download