pony | eb41fa56f4e8bad48752209d9c5550800e0c3a9d070e4d51ed4e7d164f4675b7

Analysis

max time kernel
147s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2024 21:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14efff3aa3c6c111a95835070456fcf2_JaffaCakes118.exe
Size

92KB
MD5

14efff3aa3c6c111a95835070456fcf2
SHA1

dfaf8421c0cb90db7c352f5f44b22d49e042db73
SHA256

eb41fa56f4e8bad48752209d9c5550800e0c3a9d070e4d51ed4e7d164f4675b7
SHA512

3e50cd35bd6fd8f9b31b24cd6ca24eeb40f75663ed969d5f8c6408746c05c2c0021319a77d9148056a4ad6b0faa3bbd843b3c078b7fd86a050b73d42c6ed98b6
SSDEEP

1536:b7CWiuswxKWcTXpf5jW383jEa9Y6gzv/wAuRmGwYiyAL:aWiudQpT5f5jW38zEaHgzv/wAug5gA

Score

10^/10

pony credential_access discovery rat spyware stealer upx

Malware Config

Extracted

Family

pony

http://publichelper.in:8080/z.php?ftp=1

http://helphimnow.in:8080/z.php?ftp=1

Signatures

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	ss.exe

Executes dropped EXE 36 IoCs

pid	Process
3640	ss.exe
4304	crrss.exe
4864	crrss.exe
3172	crrss.exe
4400	crrss.exe
2612	crrss.exe
3888	crrss.exe
2920	crrss.exe
2964	crrss.exe
2016	crrss.exe
3148	crrss.exe
4228	crrss.exe
1560	crrss.exe
4124	crrss.exe
4680	crrss.exe
4320	crrss.exe
452	crrss.exe
2772	crrss.exe
2664	crrss.exe
448	crrss.exe
4784	crrss.exe
1572	crrss.exe
4976	crrss.exe
1008	crrss.exe
2932	crrss.exe
636	crrss.exe
2220	crrss.exe
4248	crrss.exe
2624	crrss.exe
2816	crrss.exe
1836	crrss.exe
1580	crrss.exe
3768	crrss.exe
2284	crrss.exe
1396	crrss.exe
4496	crrss.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\crrss.exe	crrss.exe
File opened for modification	C:\Windows\SysWOW64\crrss.exe	crrss.exe
File opened for modification	C:\Windows\SysWOW64\crrss.exe	crrss.exe
File opened for modification	C:\Windows\SysWOW64\crrss.exe	crrss.exe
File opened for modification	C:\Windows\SysWOW64\crrss.exe	crrss.exe
File opened for modification	C:\Windows\SysWOW64\crrss.exe	crrss.exe
File opened for modification	C:\Windows\SysWOW64\crrss.exe	14efff3aa3c6c111a95835070456fcf2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\crrss.exe	crrss.exe
File opened for modification	C:\Windows\SysWOW64\crrss.exe	crrss.exe
File opened for modification	C:\Windows\SysWOW64\crrss.exe	crrss.exe
File opened for modification	C:\Windows\SysWOW64\crrss.exe	crrss.exe
File opened for modification	C:\Windows\SysWOW64\crrss.exe	crrss.exe
File opened for modification	C:\Windows\SysWOW64\crrss.exe	crrss.exe
File opened for modification	C:\Windows\SysWOW64\crrss.exe	crrss.exe
File opened for modification	C:\Windows\SysWOW64\crrss.exe	crrss.exe
File opened for modification	C:\Windows\SysWOW64\crrss.exe	crrss.exe
File opened for modification	C:\Windows\SysWOW64\crrss.exe	crrss.exe
File opened for modification	C:\Windows\SysWOW64\crrss.exe	crrss.exe

Suspicious use of SetThreadContext 18 IoCs

description	pid	Process	procid_target
PID 4224 set thread context of 3872	4224	14efff3aa3c6c111a95835070456fcf2_JaffaCakes118.exe	82
PID 4304 set thread context of 4864	4304	crrss.exe	89
PID 3172 set thread context of 4400	3172	crrss.exe	94
PID 2612 set thread context of 3888	2612	crrss.exe	96
PID 2920 set thread context of 2964	2920	crrss.exe	102
PID 2016 set thread context of 3148	2016	crrss.exe	104
PID 4228 set thread context of 1560	4228	crrss.exe	106
PID 4124 set thread context of 4680	4124	crrss.exe	108
PID 4320 set thread context of 452	4320	crrss.exe	110
PID 2772 set thread context of 2664	2772	crrss.exe	112
PID 448 set thread context of 4784	448	crrss.exe	114
PID 1572 set thread context of 4976	1572	crrss.exe	116
PID 1008 set thread context of 2932	1008	crrss.exe	118
PID 636 set thread context of 2220	636	crrss.exe	120
PID 4248 set thread context of 2624	4248	crrss.exe	122
PID 2816 set thread context of 1836	2816	crrss.exe	124
PID 1580 set thread context of 3768	1580	crrss.exe	126
PID 2284 set thread context of 1396	2284	crrss.exe	128

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00070000000233ee-13.dat	upx
behavioral2/memory/3640-15-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral2/memory/3640-46-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral2/memory/3640-73-0x0000000000400000-0x0000000000415000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	14efff3aa3c6c111a95835070456fcf2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	14efff3aa3c6c111a95835070456fcf2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crrss.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeImpersonatePrivilege	3640	ss.exe
Token: SeTcbPrivilege	3640	ss.exe
Token: SeChangeNotifyPrivilege	3640	ss.exe
Token: SeCreateTokenPrivilege	3640	ss.exe
Token: SeBackupPrivilege	3640	ss.exe
Token: SeRestorePrivilege	3640	ss.exe
Token: SeIncreaseQuotaPrivilege	3640	ss.exe
Token: SeAssignPrimaryTokenPrivilege	3640	ss.exe
Token: SeImpersonatePrivilege	3640	ss.exe
Token: SeTcbPrivilege	3640	ss.exe
Token: SeChangeNotifyPrivilege	3640	ss.exe
Token: SeCreateTokenPrivilege	3640	ss.exe
Token: SeBackupPrivilege	3640	ss.exe
Token: SeRestorePrivilege	3640	ss.exe
Token: SeIncreaseQuotaPrivilege	3640	ss.exe
Token: SeAssignPrimaryTokenPrivilege	3640	ss.exe
Token: SeImpersonatePrivilege	3640	ss.exe
Token: SeTcbPrivilege	3640	ss.exe
Token: SeChangeNotifyPrivilege	3640	ss.exe
Token: SeCreateTokenPrivilege	3640	ss.exe
Token: SeBackupPrivilege	3640	ss.exe
Token: SeRestorePrivilege	3640	ss.exe
Token: SeIncreaseQuotaPrivilege	3640	ss.exe
Token: SeAssignPrimaryTokenPrivilege	3640	ss.exe
Token: SeImpersonatePrivilege	3640	ss.exe
Token: SeTcbPrivilege	3640	ss.exe
Token: SeChangeNotifyPrivilege	3640	ss.exe
Token: SeCreateTokenPrivilege	3640	ss.exe
Token: SeBackupPrivilege	3640	ss.exe
Token: SeRestorePrivilege	3640	ss.exe
Token: SeIncreaseQuotaPrivilege	3640	ss.exe
Token: SeAssignPrimaryTokenPrivilege	3640	ss.exe
Token: SeImpersonatePrivilege	3640	ss.exe
Token: SeTcbPrivilege	3640	ss.exe
Token: SeChangeNotifyPrivilege	3640	ss.exe
Token: SeCreateTokenPrivilege	3640	ss.exe
Token: SeBackupPrivilege	3640	ss.exe
Token: SeRestorePrivilege	3640	ss.exe
Token: SeIncreaseQuotaPrivilege	3640	ss.exe
Token: SeAssignPrimaryTokenPrivilege	3640	ss.exe
Token: SeImpersonatePrivilege	3640	ss.exe
Token: SeTcbPrivilege	3640	ss.exe
Token: SeChangeNotifyPrivilege	3640	ss.exe
Token: SeCreateTokenPrivilege	3640	ss.exe
Token: SeBackupPrivilege	3640	ss.exe
Token: SeRestorePrivilege	3640	ss.exe
Token: SeIncreaseQuotaPrivilege	3640	ss.exe
Token: SeAssignPrimaryTokenPrivilege	3640	ss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 3872	4224	14efff3aa3c6c111a95835070456fcf2_JaffaCakes118.exe	82
PID 4224 wrote to memory of 3872	4224	14efff3aa3c6c111a95835070456fcf2_JaffaCakes118.exe	82
PID 4224 wrote to memory of 3872	4224	14efff3aa3c6c111a95835070456fcf2_JaffaCakes118.exe	82
PID 4224 wrote to memory of 3872	4224	14efff3aa3c6c111a95835070456fcf2_JaffaCakes118.exe	82
PID 4224 wrote to memory of 3872	4224	14efff3aa3c6c111a95835070456fcf2_JaffaCakes118.exe	82
PID 4224 wrote to memory of 3872	4224	14efff3aa3c6c111a95835070456fcf2_JaffaCakes118.exe	82
PID 4224 wrote to memory of 3872	4224	14efff3aa3c6c111a95835070456fcf2_JaffaCakes118.exe	82
PID 4224 wrote to memory of 3872	4224	14efff3aa3c6c111a95835070456fcf2_JaffaCakes118.exe	82
PID 4224 wrote to memory of 3872	4224	14efff3aa3c6c111a95835070456fcf2_JaffaCakes118.exe	82
PID 3872 wrote to memory of 3640	3872	14efff3aa3c6c111a95835070456fcf2_JaffaCakes118.exe	83
PID 3872 wrote to memory of 3640	3872	14efff3aa3c6c111a95835070456fcf2_JaffaCakes118.exe	83
PID 3872 wrote to memory of 3640	3872	14efff3aa3c6c111a95835070456fcf2_JaffaCakes118.exe	83
PID 3872 wrote to memory of 4304	3872	14efff3aa3c6c111a95835070456fcf2_JaffaCakes118.exe	84
PID 3872 wrote to memory of 4304	3872	14efff3aa3c6c111a95835070456fcf2_JaffaCakes118.exe	84
PID 3872 wrote to memory of 4304	3872	14efff3aa3c6c111a95835070456fcf2_JaffaCakes118.exe	84
PID 4304 wrote to memory of 4864	4304	crrss.exe	89
PID 4304 wrote to memory of 4864	4304	crrss.exe	89
PID 4304 wrote to memory of 4864	4304	crrss.exe	89
PID 4304 wrote to memory of 4864	4304	crrss.exe	89
PID 4304 wrote to memory of 4864	4304	crrss.exe	89
PID 4304 wrote to memory of 4864	4304	crrss.exe	89
PID 4304 wrote to memory of 4864	4304	crrss.exe	89
PID 4304 wrote to memory of 4864	4304	crrss.exe	89
PID 4304 wrote to memory of 4864	4304	crrss.exe	89
PID 4864 wrote to memory of 3172	4864	crrss.exe	91
PID 4864 wrote to memory of 3172	4864	crrss.exe	91
PID 4864 wrote to memory of 3172	4864	crrss.exe	91
PID 3172 wrote to memory of 4400	3172	crrss.exe	94
PID 3172 wrote to memory of 4400	3172	crrss.exe	94
PID 3172 wrote to memory of 4400	3172	crrss.exe	94
PID 3172 wrote to memory of 4400	3172	crrss.exe	94
PID 3172 wrote to memory of 4400	3172	crrss.exe	94
PID 3172 wrote to memory of 4400	3172	crrss.exe	94
PID 3172 wrote to memory of 4400	3172	crrss.exe	94
PID 3172 wrote to memory of 4400	3172	crrss.exe	94
PID 3172 wrote to memory of 4400	3172	crrss.exe	94
PID 4400 wrote to memory of 2612	4400	crrss.exe	95
PID 4400 wrote to memory of 2612	4400	crrss.exe	95
PID 4400 wrote to memory of 2612	4400	crrss.exe	95
PID 2612 wrote to memory of 3888	2612	crrss.exe	96
PID 2612 wrote to memory of 3888	2612	crrss.exe	96
PID 2612 wrote to memory of 3888	2612	crrss.exe	96
PID 2612 wrote to memory of 3888	2612	crrss.exe	96
PID 2612 wrote to memory of 3888	2612	crrss.exe	96
PID 2612 wrote to memory of 3888	2612	crrss.exe	96
PID 2612 wrote to memory of 3888	2612	crrss.exe	96
PID 2612 wrote to memory of 3888	2612	crrss.exe	96
PID 2612 wrote to memory of 3888	2612	crrss.exe	96
PID 3640 wrote to memory of 724	3640	ss.exe	98
PID 3640 wrote to memory of 724	3640	ss.exe	98
PID 3640 wrote to memory of 724	3640	ss.exe	98
PID 3888 wrote to memory of 2920	3888	crrss.exe	101
PID 3888 wrote to memory of 2920	3888	crrss.exe	101
PID 3888 wrote to memory of 2920	3888	crrss.exe	101
PID 2920 wrote to memory of 2964	2920	crrss.exe	102
PID 2920 wrote to memory of 2964	2920	crrss.exe	102
PID 2920 wrote to memory of 2964	2920	crrss.exe	102
PID 2920 wrote to memory of 2964	2920	crrss.exe	102
PID 2920 wrote to memory of 2964	2920	crrss.exe	102
PID 2920 wrote to memory of 2964	2920	crrss.exe	102
PID 2920 wrote to memory of 2964	2920	crrss.exe	102
PID 2920 wrote to memory of 2964	2920	crrss.exe	102
PID 2920 wrote to memory of 2964	2920	crrss.exe	102
PID 2964 wrote to memory of 2016	2964	crrss.exe	103

C:\Users\Admin\AppData\Local\Temp\14efff3aa3c6c111a95835070456fcf2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\14efff3aa3c6c111a95835070456fcf2_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Users\Admin\AppData\Local\Temp\14efff3aa3c6c111a95835070456fcf2_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\14efff3aa3c6c111a95835070456fcf2_JaffaCakes118.exe
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3872
- - C:\Users\Admin\ss.exe
    "C:\Users\Admin\ss.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3640
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oid.bat" "C:\Users\Admin\ss.exe" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:724
- - C:\Windows\SysWOW64\crrss.exe
    "C:\Windows\system32\crrss.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\Windows\SysWOW64\crrss.exe
      C:\Windows\SysWOW64\crrss.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4864
    - - C:\Windows\SysWOW64\crrss.exe
        
        "C:\Windows\system32\crrss.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3172
      - C:\Windows\SysWOW64\crrss.exe
        
        C:\Windows\SysWOW64\crrss.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4400
        
        C:\Windows\SysWOW64\crrss.exe
        
        "C:\Windows\system32\crrss.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2612
        
        C:\Windows\SysWOW64\crrss.exe
        
        C:\Windows\SysWOW64\crrss.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3888
        
        C:\Windows\SysWOW64\crrss.exe
        
        "C:\Windows\system32\crrss.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2920
        
        C:\Windows\SysWOW64\crrss.exe
        
        C:\Windows\SysWOW64\crrss.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2964
        
        C:\Windows\SysWOW64\crrss.exe
        
        "C:\Windows\system32\crrss.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2016
        
        C:\Windows\SysWOW64\crrss.exe
        
        C:\Windows\SysWOW64\crrss.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3148
        
        C:\Windows\SysWOW64\crrss.exe
        
        "C:\Windows\system32\crrss.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4228
        
        C:\Windows\SysWOW64\crrss.exe
        
        C:\Windows\SysWOW64\crrss.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1560
        
        C:\Windows\SysWOW64\crrss.exe
        
        "C:\Windows\system32\crrss.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4124
        
        C:\Windows\SysWOW64\crrss.exe
        
        C:\Windows\SysWOW64\crrss.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4680
        
        C:\Windows\SysWOW64\crrss.exe
        
        "C:\Windows\system32\crrss.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4320
        
        C:\Windows\SysWOW64\crrss.exe
        
        C:\Windows\SysWOW64\crrss.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:452
        
        C:\Windows\SysWOW64\crrss.exe
        
        "C:\Windows\system32\crrss.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2772
        
        C:\Windows\SysWOW64\crrss.exe
        
        C:\Windows\SysWOW64\crrss.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2664
        
        C:\Windows\SysWOW64\crrss.exe
        
        "C:\Windows\system32\crrss.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:448
        
        C:\Windows\SysWOW64\crrss.exe
        
        C:\Windows\SysWOW64\crrss.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4784
        
        C:\Windows\SysWOW64\crrss.exe
        
        "C:\Windows\system32\crrss.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1572
        
        C:\Windows\SysWOW64\crrss.exe
        
        C:\Windows\SysWOW64\crrss.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4976
        
        C:\Windows\SysWOW64\crrss.exe
        
        "C:\Windows\system32\crrss.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1008
        
        C:\Windows\SysWOW64\crrss.exe
        
        C:\Windows\SysWOW64\crrss.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2932
        
        C:\Windows\SysWOW64\crrss.exe
        
        "C:\Windows\system32\crrss.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:636
        
        C:\Windows\SysWOW64\crrss.exe
        
        C:\Windows\SysWOW64\crrss.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2220
        
        C:\Windows\SysWOW64\crrss.exe
        
        "C:\Windows\system32\crrss.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4248
        
        C:\Windows\SysWOW64\crrss.exe
        
        C:\Windows\SysWOW64\crrss.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2624
        
        C:\Windows\SysWOW64\crrss.exe
        
        "C:\Windows\system32\crrss.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2816
        
        C:\Windows\SysWOW64\crrss.exe
        
        C:\Windows\SysWOW64\crrss.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1836
        
        C:\Windows\SysWOW64\crrss.exe
        
        "C:\Windows\system32\crrss.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1580
        
        C:\Windows\SysWOW64\crrss.exe
        
        C:\Windows\SysWOW64\crrss.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3768
        
        C:\Windows\SysWOW64\crrss.exe
        
        "C:\Windows\system32\crrss.exe"
        35⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2284
        
        C:\Windows\SysWOW64\crrss.exe
        
        C:\Windows\SysWOW64\crrss.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1396
        
        C:\Windows\SysWOW64\crrss.exe
        
        "C:\Windows\system32\crrss.exe"
        37⤵
        Executes dropped EXE
        
        PID:4496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\oid.bat

Filesize
71B

MD5
e6b031b9b7d40fa332ebc6f38b2f9f64

SHA1
d6dbffcfcc6a26188fd8d2e5b6257af4821fb48f

SHA256
66a04ff993916bce61351e4c3b94ea079c806efb1723c7cd79bd32aaf6847e0b

SHA512
7d17655334fcda4c3326110d340fd91cd23ee284dec99c3a8bbc8408342fda5f51e27aaba75fba4cccd513c342c22f07ad2cf6e2326ba575e3cc0eba4ea91948

Download Submit
C:\Users\Admin\ss.exe

Filesize
24KB

MD5
f829ece056926c27fca081e8bc896f47

SHA1
233845a38a8753f4e65602de794607341c5c8f6d

SHA256
3a3a6fa1bf6583a4f735f82512f72bed7239f51cc924ea4873850434f902385b

SHA512
ec070bc92bb64fad4413695efe8a2f720987493caa702a03a66a794de9bd7b76d0e2729171f3d9ad3fc7f9db5a52ca4c63a8c6713592f77fb4ed640411233401

Download Submit
C:\Users\Admin\uidsave.dat

Filesize
36B

MD5
96f24aa398278bb9ef94c0c2320c71a2

SHA1
294c3e3e9ce23dd320b7880377142863684ea77f

SHA256
64626156d77042fa0faca5f96559d708acf8bc1a3c374d199fd07ddee2817968

SHA512
b4a9d4fb2061ff58f53899ae1e5e4b90c466660edaee117d79cd2880eb392b99c710248a7a624a85f9b4b60e738a789ed8a7fae270a786e2f043a2dc28a9d141

Download Submit
C:\Windows\SysWOW64\crrss.exe

Filesize
92KB

MD5
14efff3aa3c6c111a95835070456fcf2

SHA1
dfaf8421c0cb90db7c352f5f44b22d49e042db73

SHA256
eb41fa56f4e8bad48752209d9c5550800e0c3a9d070e4d51ed4e7d164f4675b7

SHA512
3e50cd35bd6fd8f9b31b24cd6ca24eeb40f75663ed969d5f8c6408746c05c2c0021319a77d9148056a4ad6b0faa3bbd843b3c078b7fd86a050b73d42c6ed98b6

Download Submit
memory/2016-101-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2612-69-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2920-87-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2964-92-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2964-88-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3148-107-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3172-52-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3640-15-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3640-46-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3640-73-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3872-24-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3872-8-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3872-2-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3872-7-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3888-78-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3888-66-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4224-1-0x0000000000510000-0x0000000000520000-memory.dmp

Filesize
64KB

Download
memory/4224-0-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/4224-6-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4304-33-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4400-57-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4864-41-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4864-35-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4864-36-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download