Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/10/2024, 20:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
16 signatures
150 seconds
General
-
Target
24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe
-
Size
756KB
-
MD5
24b43f22c10554fb53c649e0dd8b1fd9
-
SHA1
1e0412a9ce9f4b08cda04c14a278839dfdfeb693
-
SHA256
b61b142137ce43d4061ff841f090158a742d31bfcafb2dffa40eae56fd991926
-
SHA512
0c0db7bfb2074a5544033d03904bbfc2347c31cb0de6743aa281b7b946df804852640ba55bc374dc4f284b59eeec83f99a37765d79ce3eb25fdb023b8865ce47
-
SSDEEP
12288:whuRH8dwXnls/WsbPPUzbDzfE6U7TKKuSBsBPj2urayrHt+VXVonKgjkw:whuF82Xls/WiH4D7gqTSB8C14+XU
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Windupdt\\winupdate.exe" 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe -
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" winupdate.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" winupdate.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile winupdate.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate winupdate.exe -
Executes dropped EXE 3 IoCs
pid Process 2376 winupdate.exe 1652 winupdate.exe 1836 winupdate.exe -
Loads dropped DLL 12 IoCs
pid Process 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 2376 winupdate.exe 2376 winupdate.exe 2376 winupdate.exe 2376 winupdate.exe 1652 winupdate.exe 1652 winupdate.exe 1652 winupdate.exe 1652 winupdate.exe 1836 winupdate.exe 1836 winupdate.exe 1836 winupdate.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Users\\Admin\\AppData\\Roaming\\Windupdt\\winupdate.exe" 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Users\\Admin\\AppData\\Roaming\\Windupdt\\winupdate.exe" notepad.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe File opened for modification \??\PhysicalDrive0 winupdate.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2652 set thread context of 2928 2652 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 30 PID 2928 set thread context of 2832 2928 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 31 PID 2376 set thread context of 1652 2376 winupdate.exe 35 PID 1652 set thread context of 1836 1652 winupdate.exe 36 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier winupdate.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 winupdate.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier winupdate.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Token: SeSecurityPrivilege 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Token: SeSystemtimePrivilege 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Token: SeBackupPrivilege 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Token: SeRestorePrivilege 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Token: SeShutdownPrivilege 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Token: SeDebugPrivilege 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Token: SeUndockPrivilege 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Token: SeManageVolumePrivilege 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Token: SeImpersonatePrivilege 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Token: 33 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Token: 34 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Token: 35 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 1836 winupdate.exe Token: SeSecurityPrivilege 1836 winupdate.exe Token: SeTakeOwnershipPrivilege 1836 winupdate.exe Token: SeLoadDriverPrivilege 1836 winupdate.exe Token: SeSystemProfilePrivilege 1836 winupdate.exe Token: SeSystemtimePrivilege 1836 winupdate.exe Token: SeProfSingleProcessPrivilege 1836 winupdate.exe Token: SeIncBasePriorityPrivilege 1836 winupdate.exe Token: SeCreatePagefilePrivilege 1836 winupdate.exe Token: SeBackupPrivilege 1836 winupdate.exe Token: SeRestorePrivilege 1836 winupdate.exe Token: SeShutdownPrivilege 1836 winupdate.exe Token: SeDebugPrivilege 1836 winupdate.exe Token: SeSystemEnvironmentPrivilege 1836 winupdate.exe Token: SeChangeNotifyPrivilege 1836 winupdate.exe Token: SeRemoteShutdownPrivilege 1836 winupdate.exe Token: SeUndockPrivilege 1836 winupdate.exe Token: SeManageVolumePrivilege 1836 winupdate.exe Token: SeImpersonatePrivilege 1836 winupdate.exe Token: SeCreateGlobalPrivilege 1836 winupdate.exe Token: 33 1836 winupdate.exe Token: 34 1836 winupdate.exe Token: 35 1836 winupdate.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2652 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 2928 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 2376 winupdate.exe 1652 winupdate.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2652 wrote to memory of 2928 2652 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 30 PID 2652 wrote to memory of 2928 2652 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 30 PID 2652 wrote to memory of 2928 2652 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 30 PID 2652 wrote to memory of 2928 2652 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 30 PID 2652 wrote to memory of 2928 2652 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 30 PID 2652 wrote to memory of 2928 2652 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 30 PID 2652 wrote to memory of 2928 2652 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 30 PID 2652 wrote to memory of 2928 2652 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 30 PID 2652 wrote to memory of 2928 2652 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 30 PID 2928 wrote to memory of 2832 2928 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 31 PID 2928 wrote to memory of 2832 2928 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 31 PID 2928 wrote to memory of 2832 2928 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 31 PID 2928 wrote to memory of 2832 2928 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 31 PID 2928 wrote to memory of 2832 2928 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 31 PID 2928 wrote to memory of 2832 2928 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 31 PID 2928 wrote to memory of 2832 2928 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 31 PID 2928 wrote to memory of 2832 2928 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 31 PID 2928 wrote to memory of 2832 2928 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 31 PID 2928 wrote to memory of 2832 2928 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 31 PID 2928 wrote to memory of 2832 2928 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 31 PID 2928 wrote to memory of 2832 2928 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 31 PID 2928 wrote to memory of 2832 2928 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 31 PID 2832 wrote to memory of 2572 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 32 PID 2832 wrote to memory of 2572 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 32 PID 2832 wrote to memory of 2572 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 32 PID 2832 wrote to memory of 2572 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 32 PID 2832 wrote to memory of 2572 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 32 PID 2832 wrote to memory of 2572 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 32 PID 2832 wrote to memory of 2572 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 32 PID 2832 wrote to memory of 2572 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 32 PID 2832 wrote to memory of 2572 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 32 PID 2832 wrote to memory of 2572 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 32 PID 2832 wrote to memory of 2572 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 32 PID 2832 wrote to memory of 2572 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 32 PID 2832 wrote to memory of 2572 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 32 PID 2832 wrote to memory of 2572 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 32 PID 2832 wrote to memory of 2572 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 32 PID 2832 wrote to memory of 2572 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 32 PID 2832 wrote to memory of 2572 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 32 PID 2832 wrote to memory of 2572 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 32 PID 2832 wrote to memory of 2572 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 32 PID 2832 wrote to memory of 2572 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 32 PID 2832 wrote to memory of 2572 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 32 PID 2832 wrote to memory of 2572 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 32 PID 2832 wrote to memory of 2572 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 32 PID 2832 wrote to memory of 2572 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 32 PID 2832 wrote to memory of 2800 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 33 PID 2832 wrote to memory of 2800 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 33 PID 2832 wrote to memory of 2800 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 33 PID 2832 wrote to memory of 2800 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 33 PID 2832 wrote to memory of 2376 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 34 PID 2832 wrote to memory of 2376 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 34 PID 2832 wrote to memory of 2376 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 34 PID 2832 wrote to memory of 2376 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 34 PID 2832 wrote to memory of 2376 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 34 PID 2832 wrote to memory of 2376 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 34 PID 2832 wrote to memory of 2376 2832 24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe 34 PID 2376 wrote to memory of 1652 2376 winupdate.exe 35 PID 2376 wrote to memory of 1652 2376 winupdate.exe 35 PID 2376 wrote to memory of 1652 2376 winupdate.exe 35 PID 2376 wrote to memory of 1652 2376 winupdate.exe 35 PID 2376 wrote to memory of 1652 2376 winupdate.exe 35 PID 2376 wrote to memory of 1652 2376 winupdate.exe 35 PID 2376 wrote to memory of 1652 2376 winupdate.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe"2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\24b43f22c10554fb53c649e0dd8b1fd9_JaffaCakes118.exe"3⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\notepad.exenotepad4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2572
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"4⤵PID:2800
-
-
C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe"C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe"C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1652 -
C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe"C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe"6⤵
- Modifies firewall policy service
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:1836 -
C:\Windows\SysWOW64\notepad.exeC:\Windows\SysWOW64\notepad.exe7⤵
- System Location Discovery: System Language Discovery
PID:836
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
756KB
MD524b43f22c10554fb53c649e0dd8b1fd9
SHA11e0412a9ce9f4b08cda04c14a278839dfdfeb693
SHA256b61b142137ce43d4061ff841f090158a742d31bfcafb2dffa40eae56fd991926
SHA5120c0db7bfb2074a5544033d03904bbfc2347c31cb0de6743aa281b7b946df804852640ba55bc374dc4f284b59eeec83f99a37765d79ce3eb25fdb023b8865ce47