d7d9a3a20c6b18326eea28d5634e3d9b93e459b8adaf5fc93ad44a37cae07991

Analysis

max time kernel
150s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 01:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0837e03363624724cc20a00f4ee4fa57_JaffaCakes118.exe
Size

823KB
MD5

0837e03363624724cc20a00f4ee4fa57
SHA1

3698c034fa3bc1754fcca06f11fd87185d5101f6
SHA256

d7d9a3a20c6b18326eea28d5634e3d9b93e459b8adaf5fc93ad44a37cae07991
SHA512

a67fee7bbc4fcbd324df26358d5d0ca8889c40b3532cbe99c85b471ed744f0609f522761bad13ec2e27747fd5744ac19c1f29e938a42b433703d0805cf2d175c
SSDEEP

12288:9X/eOyaiq38GMQJ1ypmbX/eOyaiq38GMQJ1yuXq:9X/eO4qsMJ1y2X/eO4qsMJ1yuXq

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\cehl.exe -dwup"	cehl.exe

Executes dropped EXE 49 IoCs

pid	Process
2412	cehl.exe
4932	cehl.exe
516	cehl.exe
3144	cehl.exe
1336	cehl.exe
2476	cehl.exe
2544	cehl.exe
1968	cehl.exe
2484	cehl.exe
4428	cehl.exe
1844	cehl.exe
644	cehl.exe
3020	cehl.exe
4008	cehl.exe
3712	cehl.exe
1368	cehl.exe
3296	cehl.exe
1588	cehl.exe
4508	cehl.exe
1464	cehl.exe
3384	cehl.exe
1820	cehl.exe
872	cehl.exe
468	cehl.exe
4056	cehl.exe
400	cehl.exe
3216	cehl.exe
4360	cehl.exe
2380	cehl.exe
3428	cehl.exe
5072	cehl.exe
2192	cehl.exe
1244	cehl.exe
2312	cehl.exe
3004	cehl.exe
1128	cehl.exe
4928	cehl.exe
704	cehl.exe
4512	cehl.exe
2984	cehl.exe
2488	cehl.exe
4120	cehl.exe
1956	cehl.exe
4856	cehl.exe
3728	cehl.exe
1752	cehl.exe
4920	cehl.exe
2348	cehl.exe
1960	cehl.exe

Suspicious use of SetThreadContext 25 IoCs

description	pid	Process	procid_target
PID 2904 set thread context of 4988	2904	0837e03363624724cc20a00f4ee4fa57_JaffaCakes118.exe	89
PID 2412 set thread context of 4932	2412	cehl.exe	91
PID 3144 set thread context of 1336	3144	cehl.exe	102
PID 2476 set thread context of 2544	2476	cehl.exe	104
PID 1968 set thread context of 2484	1968	cehl.exe	106
PID 4428 set thread context of 1844	4428	cehl.exe	110
PID 644 set thread context of 3020	644	cehl.exe	112
PID 4008 set thread context of 3712	4008	cehl.exe	114
PID 1368 set thread context of 3296	1368	cehl.exe	116
PID 1588 set thread context of 4508	1588	cehl.exe	118
PID 1464 set thread context of 3384	1464	cehl.exe	120
PID 1820 set thread context of 872	1820	cehl.exe	122
PID 468 set thread context of 4056	468	cehl.exe	124
PID 400 set thread context of 3216	400	cehl.exe	126
PID 4360 set thread context of 2380	4360	cehl.exe	128
PID 3428 set thread context of 5072	3428	cehl.exe	130
PID 2192 set thread context of 1244	2192	cehl.exe	132
PID 2312 set thread context of 3004	2312	cehl.exe	134
PID 1128 set thread context of 4928	1128	cehl.exe	136
PID 704 set thread context of 4512	704	cehl.exe	138
PID 2984 set thread context of 2488	2984	cehl.exe	140
PID 4120 set thread context of 1956	4120	cehl.exe	142
PID 4856 set thread context of 3728	4856	cehl.exe	144
PID 1752 set thread context of 4920	1752	cehl.exe	146
PID 2348 set thread context of 1960	2348	cehl.exe	148

System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0837e03363624724cc20a00f4ee4fa57_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0837e03363624724cc20a00f4ee4fa57_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cehl.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 4988	2904	0837e03363624724cc20a00f4ee4fa57_JaffaCakes118.exe	89
PID 2904 wrote to memory of 4988	2904	0837e03363624724cc20a00f4ee4fa57_JaffaCakes118.exe	89
PID 2904 wrote to memory of 4988	2904	0837e03363624724cc20a00f4ee4fa57_JaffaCakes118.exe	89
PID 2904 wrote to memory of 4988	2904	0837e03363624724cc20a00f4ee4fa57_JaffaCakes118.exe	89
PID 2904 wrote to memory of 4988	2904	0837e03363624724cc20a00f4ee4fa57_JaffaCakes118.exe	89
PID 2904 wrote to memory of 4988	2904	0837e03363624724cc20a00f4ee4fa57_JaffaCakes118.exe	89
PID 2904 wrote to memory of 4988	2904	0837e03363624724cc20a00f4ee4fa57_JaffaCakes118.exe	89
PID 2904 wrote to memory of 4988	2904	0837e03363624724cc20a00f4ee4fa57_JaffaCakes118.exe	89
PID 4988 wrote to memory of 2412	4988	0837e03363624724cc20a00f4ee4fa57_JaffaCakes118.exe	90
PID 4988 wrote to memory of 2412	4988	0837e03363624724cc20a00f4ee4fa57_JaffaCakes118.exe	90
PID 4988 wrote to memory of 2412	4988	0837e03363624724cc20a00f4ee4fa57_JaffaCakes118.exe	90
PID 2412 wrote to memory of 4932	2412	cehl.exe	91
PID 2412 wrote to memory of 4932	2412	cehl.exe	91
PID 2412 wrote to memory of 4932	2412	cehl.exe	91
PID 2412 wrote to memory of 4932	2412	cehl.exe	91
PID 2412 wrote to memory of 4932	2412	cehl.exe	91
PID 2412 wrote to memory of 4932	2412	cehl.exe	91
PID 2412 wrote to memory of 4932	2412	cehl.exe	91
PID 2412 wrote to memory of 4932	2412	cehl.exe	91
PID 4932 wrote to memory of 516	4932	cehl.exe	95
PID 4932 wrote to memory of 516	4932	cehl.exe	95
PID 4932 wrote to memory of 516	4932	cehl.exe	95
PID 4932 wrote to memory of 516	4932	cehl.exe	95
PID 4932 wrote to memory of 516	4932	cehl.exe	95
PID 516 wrote to memory of 3144	516	cehl.exe	101
PID 516 wrote to memory of 3144	516	cehl.exe	101
PID 516 wrote to memory of 3144	516	cehl.exe	101
PID 3144 wrote to memory of 1336	3144	cehl.exe	102
PID 3144 wrote to memory of 1336	3144	cehl.exe	102
PID 3144 wrote to memory of 1336	3144	cehl.exe	102
PID 3144 wrote to memory of 1336	3144	cehl.exe	102
PID 3144 wrote to memory of 1336	3144	cehl.exe	102
PID 3144 wrote to memory of 1336	3144	cehl.exe	102
PID 3144 wrote to memory of 1336	3144	cehl.exe	102
PID 3144 wrote to memory of 1336	3144	cehl.exe	102
PID 516 wrote to memory of 2476	516	cehl.exe	103
PID 516 wrote to memory of 2476	516	cehl.exe	103
PID 516 wrote to memory of 2476	516	cehl.exe	103
PID 2476 wrote to memory of 2544	2476	cehl.exe	104
PID 2476 wrote to memory of 2544	2476	cehl.exe	104
PID 2476 wrote to memory of 2544	2476	cehl.exe	104
PID 2476 wrote to memory of 2544	2476	cehl.exe	104
PID 2476 wrote to memory of 2544	2476	cehl.exe	104
PID 2476 wrote to memory of 2544	2476	cehl.exe	104
PID 2476 wrote to memory of 2544	2476	cehl.exe	104
PID 2476 wrote to memory of 2544	2476	cehl.exe	104
PID 516 wrote to memory of 1968	516	cehl.exe	105
PID 516 wrote to memory of 1968	516	cehl.exe	105
PID 516 wrote to memory of 1968	516	cehl.exe	105
PID 1968 wrote to memory of 2484	1968	cehl.exe	106
PID 1968 wrote to memory of 2484	1968	cehl.exe	106
PID 1968 wrote to memory of 2484	1968	cehl.exe	106
PID 1968 wrote to memory of 2484	1968	cehl.exe	106
PID 1968 wrote to memory of 2484	1968	cehl.exe	106
PID 1968 wrote to memory of 2484	1968	cehl.exe	106
PID 1968 wrote to memory of 2484	1968	cehl.exe	106
PID 1968 wrote to memory of 2484	1968	cehl.exe	106
PID 516 wrote to memory of 4428	516	cehl.exe	109
PID 516 wrote to memory of 4428	516	cehl.exe	109
PID 516 wrote to memory of 4428	516	cehl.exe	109
PID 4428 wrote to memory of 1844	4428	cehl.exe	110
PID 4428 wrote to memory of 1844	4428	cehl.exe	110
PID 4428 wrote to memory of 1844	4428	cehl.exe	110
PID 4428 wrote to memory of 1844	4428	cehl.exe	110

C:\Users\Admin\AppData\Local\Temp\0837e03363624724cc20a00f4ee4fa57_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0837e03363624724cc20a00f4ee4fa57_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Users\Admin\AppData\Local\Temp\0837e03363624724cc20a00f4ee4fa57_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0837e03363624724cc20a00f4ee4fa57_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Users\Admin\AppData\Roaming\cehl.exe
    C:\Users\Admin\AppData\Local\Temp\0837e03363624724cc20a00f4ee4fa57_JaffaCakes118.exe -dwup
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2412
  - - C:\Users\Admin\AppData\Roaming\cehl.exe
      C:\Users\Admin\AppData\Local\Temp\0837e03363624724cc20a00f4ee4fa57_JaffaCakes118.exe -dwup
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4932
    - - C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:516
      - C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3144
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        7⤵
        Executes dropped EXE
        
        PID:1336
      - C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2476
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        7⤵
        Executes dropped EXE
        
        PID:2544
      - C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1968
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        7⤵
        Executes dropped EXE
        
        PID:2484
      - C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4428
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        7⤵
        Executes dropped EXE
        
        PID:1844
      - C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:644
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        7⤵
        Executes dropped EXE
        
        PID:3020
      - C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4008
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        7⤵
        Executes dropped EXE
        
        PID:3712
      - C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1368
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        7⤵
        Executes dropped EXE
        
        PID:3296
      - C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1588
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        7⤵
        Executes dropped EXE
        
        PID:4508
      - C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1464
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        7⤵
        Executes dropped EXE
        
        PID:3384
      - C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1820
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        7⤵
        Executes dropped EXE
        
        PID:872
      - C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:468
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        7⤵
        Executes dropped EXE
        
        PID:4056
      - C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:400
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        7⤵
        Executes dropped EXE
        
        PID:3216
      - C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4360
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        7⤵
        Executes dropped EXE
        
        PID:2380
      - C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3428
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        7⤵
        Executes dropped EXE
        
        PID:5072
      - C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2192
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        7⤵
        Executes dropped EXE
        
        PID:1244
      - C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2312
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        7⤵
        Executes dropped EXE
        
        PID:3004
      - C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1128
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        7⤵
        Executes dropped EXE
        
        PID:4928
      - C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:704
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        7⤵
        Executes dropped EXE
        
        PID:4512
      - C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2984
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        7⤵
        Executes dropped EXE
        
        PID:2488
      - C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4120
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        7⤵
        Executes dropped EXE
        
        PID:1956
      - C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4856
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        7⤵
        Executes dropped EXE
        
        PID:3728
      - C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1752
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        7⤵
        Executes dropped EXE
        
        PID:4920
      - C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2348
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        
        C:\Users\Admin\AppData\Roaming\cehl.exe
        7⤵
        Executes dropped EXE
        
        PID:1960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4248,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:8
1⤵
PID:752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\cehl.exe

Filesize
600KB

MD5
e736c05948e4a2e300665525c0760e25

SHA1
daec68c5c6274fd94616c31102d032229745b511

SHA256
a751027172ba0e9fa6027c22dfb51f13a9d989400fd2d3c6201fb1788b15b795

SHA512
43613b6f558b7f47004781277331712604c8eb5004a65e6b6e0a96df74e27fd2206ceb31563892fa03f85d86df78bf1a3aad5cb765ca1f9081c07701c378d021

Download Submit
C:\Users\Admin\AppData\Roaming\cehl.exe

Filesize
823KB

MD5
0837e03363624724cc20a00f4ee4fa57

SHA1
3698c034fa3bc1754fcca06f11fd87185d5101f6

SHA256
d7d9a3a20c6b18326eea28d5634e3d9b93e459b8adaf5fc93ad44a37cae07991

SHA512
a67fee7bbc4fcbd324df26358d5d0ca8889c40b3532cbe99c85b471ed744f0609f522761bad13ec2e27747fd5744ac19c1f29e938a42b433703d0805cf2d175c

Download Submit
memory/516-19-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/516-21-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/872-88-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1336-28-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1844-49-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2484-42-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2544-35-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3020-55-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3296-68-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3384-82-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3712-62-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4056-95-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4508-75-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4932-51-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4932-22-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4932-16-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4932-15-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4988-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4988-3-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4988-2-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads