a720168be35c26ca77f9895a1f919b8ce0f8c744a5a733075f760c61336b1c3a

Analysis

max time kernel
149s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
Size 156KB
Sample241009-lekscstfpr
SHA256 a720168be35c26ca77f9895a1f919b8ce0f8c744a5a733075f760c61336b1c3a
MD5 2ea9a754c4b1b76dfb1c61e276047788
SHA1 834a767d997b6b235f85892004d593f717dff6b1
SHA512 8fd78b624313dde1fa9a949a0e2bedf952c22638d9fba012ab756a45ccfc3f601947d6d9702b8e6ba6a7cb4b93c276d19029ef79533d021e3139436dad78eae7
SSDEEP 3072:lhzTydTQ+pZcrlgDEbOHFP06KGczo2vCnYu/Mw2It:lhnKQ+7ElgSoFlyXvYYiIIt
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (215) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe

Executes dropped EXE 2 IoCs

pid	Process
824	Logo1_.exe
452	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe

Loads dropped DLL 2 IoCs

pid	Process
112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
824	Logo1_.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe.Exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\RichDll.dll	Logo1_.exe
File created	C:\Windows\uninstall\rundl132.exe	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
File created	C:\Windows\Logo1_.exe	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe
824	Logo1_.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 852	112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe	86
PID 112 wrote to memory of 852	112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe	86
PID 112 wrote to memory of 336	112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe	87
PID 112 wrote to memory of 336	112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe	87
PID 112 wrote to memory of 336	112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe	87
PID 336 wrote to memory of 4960	336	net.exe	89
PID 336 wrote to memory of 4960	336	net.exe	89
PID 336 wrote to memory of 4960	336	net.exe	89
PID 112 wrote to memory of 1548	112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe	90
PID 112 wrote to memory of 1548	112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe	90
PID 112 wrote to memory of 1548	112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe	90
PID 112 wrote to memory of 824	112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe	91
PID 112 wrote to memory of 824	112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe	91
PID 112 wrote to memory of 824	112	2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe	91
PID 824 wrote to memory of 1556	824	Logo1_.exe	93
PID 824 wrote to memory of 1556	824	Logo1_.exe	93
PID 824 wrote to memory of 1556	824	Logo1_.exe	93
PID 1548 wrote to memory of 452	1548	cmd.exe	94
PID 1548 wrote to memory of 452	1548	cmd.exe	94
PID 1548 wrote to memory of 452	1548	cmd.exe	94
PID 1556 wrote to memory of 1972	1556	net.exe	96
PID 1556 wrote to memory of 1972	1556	net.exe	96
PID 1556 wrote to memory of 1972	1556	net.exe	96
PID 824 wrote to memory of 3824	824	Logo1_.exe	97
PID 824 wrote to memory of 3824	824	Logo1_.exe	97
PID 824 wrote to memory of 3824	824	Logo1_.exe	97
PID 3824 wrote to memory of 4044	3824	net.exe	99
PID 3824 wrote to memory of 4044	3824	net.exe	99
PID 3824 wrote to memory of 4044	3824	net.exe	99
PID 824 wrote to memory of 852	824	Logo1_.exe	86
PID 824 wrote to memory of 852	824	Logo1_.exe	86

C:\Users\Admin\AppData\Local\Temp\2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:112
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:852
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:336
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8230.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Users\Admin\AppData\Local\Temp\2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe"
    3⤵
    - Executes dropped EXE
    PID:452
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1556
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1972
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3824
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe.Exe

Path C:\Program Files\7-Zip\7z.exe.Exe
Size 639KB
SHA256 2d535731f4ae6df4c91cea0826196e536e248dadb9a38ccb4052fea5c90eba07
MD5 3ab178942fcec9c0cbe332d860727079
SHA1 1827c3b6f919f1d773b097a19c7eb4c14212b348
SHA512 4e7bd063d6dc58d67a1fd3b1190729b754b3a2f5ecbd5d7199e74ed3b5f63aa71bdf6cb9e04d7b204a41f0e6ff3e278ea05c6d19a7d297645f090f277909cece
SSDEEP 12288:lhKt7ElgJFlZ7a3iwbihym2g7XO3LWUQfh4Co:DK9ElgJFG+gkE2fh4Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

$$a8230.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a8230.bat
Size 614B
SHA256 8bb39d2f44b5387cfb13212e4852b9754d59e352b0695785865b57a13f43ceb6
MD5 34edd3c176700136e739e9a4529ece12
SHA1 c0ae0bac6332e397d67104be9dc97af59e8718f3
SHA512 2f3b7113b566de50720af4c18b5f1760182d9877292efe447c2c048fd43de76c1dddb13cbf7ac5303147e38e4cebcc60e1254338cc20d2aa309eb4571ee4a2af
MD5 SHA1 SHA512

Submit Download

2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2ea9a754c4b1b76dfb1c61e276047788_JaffaCakes118.exe.exe
Size 61KB
SHA256 85694d5c264af2f33be3a73c5ae593f3bc0b013fa15e84e02b3515c03ea27b4c
MD5 d86ee74ac99f7a9391f2d09576e06f7e
SHA1 911188843ecf618ea9fe8b4f40dbe03176cb298f
SHA512 e1a53c30e3fc279633f8b2c6428fd5d5f5c6f3c7a0e1bacab6851fb38448f91f6a607d5a60e1bca3569f6341c4beabce705bb88f1de72581d08abfc998726e8c
SSDEEP 768:uGHoUwaYNv4OR7UM9dNZBXtu/0OWDm2WuAz6gxvWKMwsIMIt:uIo1acrdFQ/7WDm2gz6u/MwsIMIt
MD5 SHA1 SHA512 SSDEEP

Submit Download

jpy97d8.dll

Path C:\Users\Admin\AppData\Local\Temp\jpy97d8.dll
Size 29KB
SHA256 63c7cf8ebd1b9e8423ff81c01e41cce0910ffdb1914888e4aa647a0f66ed1e1c
MD5 ca3602c57f5635671d7cc102094634e5
SHA1 90a5f1aea2039d9f69d7e14f03dbbe034c9e3ce3
SHA512 e48bf73a922265f39a13382f0995fcaf38147939c91a25de1e01883b8495ebcc0ad24cc5e167e778e77b0d9af3ea1e509b2a7528ef9885e44b3d4ed4a2a113ca
SSDEEP 768:pWUzqqvvX9oGE17uero3sGgX96dv5qtyt:pWUzqMBEtChI690g
MD5 SHA1 SHA512 SSDEEP

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 95KB
SHA256 9447a6e3b7a0ea46f6ff52f5d9ec48e8ef6b47881f1a1f724097de21e180201f
MD5 88aec204440d75ec4f16efbe0160bd4b
SHA1 bd4288a427bdbfd19d1a036049b38d35f4a0bd6e
SHA512 cff46463dccb3ae86890e36621c7f53357c53deff31b33e21b7895ad4adc89b9d6e2e1d916ff4afec48a6bf2057b571ba4a6cdebe056849e47b3909367dee0e5
SSDEEP 1536:4LKhzq8yd+h862k+8ekSpAWyZrlgcj6q8F/YHzVdjiXmKF8zmJn06NKhkB8/y:lhzTydTQ+pZcrlgDEbOHFP06KG1
MD5 SHA1 SHA512 SSDEEP

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
MD5 SHA1 SHA512

Submit Download

memory/112-6-0x0000000000540000-0x0000000000560000-memory.dmp

Download

memory/112-21-0x0000000000400000-0x000000000044F000-memory.dmp

Download

memory/112-22-0x0000000010000000-0x0000000010018000-memory.dmp

Download

memory/112-9-0x0000000000520000-0x0000000000540000-memory.dmp

Download

memory/112-0-0x0000000000400000-0x000000000044F000-memory.dmp

Download

memory/112-5-0x0000000010000000-0x0000000010018000-memory.dmp

Download

memory/452-31-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/824-25-0x0000000000400000-0x000000000044F000-memory.dmp

Download

memory/824-24-0x0000000000550000-0x0000000000590000-memory.dmp

Download

memory/824-23-0x0000000010000000-0x0000000010018000-memory.dmp

Download

memory/824-35-0x0000000000550000-0x0000000000590000-memory.dmp

Download

memory/824-36-0x0000000010000000-0x0000000010018000-memory.dmp

Download

memory/824-37-0x0000000000400000-0x000000000044F000-memory.dmp

Download

memory/824-26-0x0000000000530000-0x0000000000550000-memory.dmp

Download