6dae0159d5da508bf4fadc7a19fba5d13d3494d75db63713ac54fc0c31b09d6e

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2024 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
Size

165KB
MD5

3799833548a3e8bdd526ae0ed3398913
SHA1

2ef660ea22a7e134196b464c9bddffd6b0d2b045
SHA256

6dae0159d5da508bf4fadc7a19fba5d13d3494d75db63713ac54fc0c31b09d6e
SHA512

3297bea07f15ebae219e913a94c425bac4bf6c6539f03c3597f9a8b6f16c5d629c5bf879e35356e131aa0311179d4a58fe5d8a150f03d90e9f22c9257b8209d2
SSDEEP

3072:FUCyJ/p6r/INNEfINdo4OpqkjdrfRL9OcEG7O8HVbdnj36vY058siwx5J:KCHfIM4Opb7klkbC5Dis

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	Client1.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client1.exe	Client1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client1.exe	Client1.exe

Executes dropped EXE 3 IoCs

pid	Process
4968	Client1.exe
380	Client1.exe
4160	Client1.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client1.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Client1.exe\" .."	Client1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client1.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Client1.exe\" .."	Client1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Kills process with taskkill 8 IoCs

evasion

pid	Process
5108	TASKKILL.exe
3572	TASKKILL.exe
2832	TASKKILL.exe
2184	TASKKILL.exe
2884	TASKKILL.exe
3284	TASKKILL.exe
1800	TASKKILL.exe
2052	TASKKILL.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1232	schtasks.exe
2440	schtasks.exe
1400	schtasks.exe
4692	schtasks.exe
4248	schtasks.exe
3768	schtasks.exe
3992	schtasks.exe
4976	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeDebugPrivilege	964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
Token: SeDebugPrivilege	2832	TASKKILL.exe
Token: SeDebugPrivilege	2184	TASKKILL.exe
Token: SeDebugPrivilege	4968	Client1.exe
Token: SeDebugPrivilege	2884	TASKKILL.exe
Token: SeDebugPrivilege	3284	TASKKILL.exe
Token: 33	4968	Client1.exe
Token: SeIncBasePriorityPrivilege	4968	Client1.exe
Token: 33	4968	Client1.exe
Token: SeIncBasePriorityPrivilege	4968	Client1.exe
Token: SeDebugPrivilege	1800	TASKKILL.exe
Token: SeDebugPrivilege	2052	TASKKILL.exe
Token: SeDebugPrivilege	380	Client1.exe
Token: 33	4968	Client1.exe
Token: SeIncBasePriorityPrivilege	4968	Client1.exe
Token: 33	4968	Client1.exe
Token: SeIncBasePriorityPrivilege	4968	Client1.exe
Token: 33	4968	Client1.exe
Token: SeIncBasePriorityPrivilege	4968	Client1.exe
Token: 33	4968	Client1.exe
Token: SeIncBasePriorityPrivilege	4968	Client1.exe
Token: 33	4968	Client1.exe
Token: SeIncBasePriorityPrivilege	4968	Client1.exe
Token: 33	4968	Client1.exe
Token: SeIncBasePriorityPrivilege	4968	Client1.exe
Token: 33	4968	Client1.exe
Token: SeIncBasePriorityPrivilege	4968	Client1.exe
Token: SeDebugPrivilege	5108	TASKKILL.exe
Token: SeDebugPrivilege	3572	TASKKILL.exe
Token: 33	4968	Client1.exe
Token: SeIncBasePriorityPrivilege	4968	Client1.exe
Token: SeDebugPrivilege	4160	Client1.exe
Token: 33	4968	Client1.exe
Token: SeIncBasePriorityPrivilege	4968	Client1.exe
Token: 33	4968	Client1.exe
Token: SeIncBasePriorityPrivilege	4968	Client1.exe
Token: 33	4968	Client1.exe
Token: SeIncBasePriorityPrivilege	4968	Client1.exe
Token: 33	4968	Client1.exe
Token: SeIncBasePriorityPrivilege	4968	Client1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 4588	964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	86
PID 964 wrote to memory of 4588	964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	86
PID 964 wrote to memory of 4588	964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	86
PID 964 wrote to memory of 2440	964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	88
PID 964 wrote to memory of 2440	964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	88
PID 964 wrote to memory of 2440	964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	88
PID 964 wrote to memory of 2832	964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	89
PID 964 wrote to memory of 2832	964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	89
PID 964 wrote to memory of 2832	964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	89
PID 964 wrote to memory of 2184	964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	91
PID 964 wrote to memory of 2184	964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	91
PID 964 wrote to memory of 2184	964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	91
PID 964 wrote to memory of 3436	964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	95
PID 964 wrote to memory of 3436	964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	95
PID 964 wrote to memory of 3436	964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	95
PID 964 wrote to memory of 1400	964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	97
PID 964 wrote to memory of 1400	964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	97
PID 964 wrote to memory of 1400	964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	97
PID 964 wrote to memory of 4968	964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	99
PID 964 wrote to memory of 4968	964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	99
PID 964 wrote to memory of 4968	964	3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe	99
PID 4968 wrote to memory of 1628	4968	Client1.exe	100
PID 4968 wrote to memory of 1628	4968	Client1.exe	100
PID 4968 wrote to memory of 1628	4968	Client1.exe	100
PID 4968 wrote to memory of 4692	4968	Client1.exe	102
PID 4968 wrote to memory of 4692	4968	Client1.exe	102
PID 4968 wrote to memory of 4692	4968	Client1.exe	102
PID 4968 wrote to memory of 2884	4968	Client1.exe	104
PID 4968 wrote to memory of 2884	4968	Client1.exe	104
PID 4968 wrote to memory of 2884	4968	Client1.exe	104
PID 4968 wrote to memory of 3284	4968	Client1.exe	105
PID 4968 wrote to memory of 3284	4968	Client1.exe	105
PID 4968 wrote to memory of 3284	4968	Client1.exe	105
PID 4968 wrote to memory of 3180	4968	Client1.exe	110
PID 4968 wrote to memory of 3180	4968	Client1.exe	110
PID 4968 wrote to memory of 3180	4968	Client1.exe	110
PID 4968 wrote to memory of 4248	4968	Client1.exe	112
PID 4968 wrote to memory of 4248	4968	Client1.exe	112
PID 4968 wrote to memory of 4248	4968	Client1.exe	112
PID 380 wrote to memory of 1532	380	Client1.exe	117
PID 380 wrote to memory of 1532	380	Client1.exe	117
PID 380 wrote to memory of 1532	380	Client1.exe	117
PID 380 wrote to memory of 3768	380	Client1.exe	119
PID 380 wrote to memory of 3768	380	Client1.exe	119
PID 380 wrote to memory of 3768	380	Client1.exe	119
PID 380 wrote to memory of 1800	380	Client1.exe	120
PID 380 wrote to memory of 1800	380	Client1.exe	120
PID 380 wrote to memory of 1800	380	Client1.exe	120
PID 380 wrote to memory of 2052	380	Client1.exe	123
PID 380 wrote to memory of 2052	380	Client1.exe	123
PID 380 wrote to memory of 2052	380	Client1.exe	123
PID 380 wrote to memory of 3632	380	Client1.exe	125
PID 380 wrote to memory of 3632	380	Client1.exe	125
PID 380 wrote to memory of 3632	380	Client1.exe	125
PID 380 wrote to memory of 3992	380	Client1.exe	127
PID 380 wrote to memory of 3992	380	Client1.exe	127
PID 380 wrote to memory of 3992	380	Client1.exe	127
PID 4160 wrote to memory of 464	4160	Client1.exe	130
PID 4160 wrote to memory of 464	4160	Client1.exe	130
PID 4160 wrote to memory of 464	4160	Client1.exe	130
PID 4160 wrote to memory of 4976	4160	Client1.exe	132
PID 4160 wrote to memory of 4976	4160	Client1.exe	132
PID 4160 wrote to memory of 4976	4160	Client1.exe	132
PID 4160 wrote to memory of 5108	4160	Client1.exe	133

C:\Users\Admin\AppData\Local\Temp\3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYANP /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4588
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe" /sc minute /mo 5
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2440
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM wscript.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2832
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2184
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYAN /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3436
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\3799833548a3e8bdd526ae0ed3398913_JaffaCakes118.exe" /sc minute /mo 1
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1400
- C:\Users\Admin\AppData\Roaming\Client1.exe
  "C:\Users\Admin\AppData\Roaming\Client1.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /tn NYANP /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1628
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Roaming\Client1.exe" /sc minute /mo 5
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4692
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /F /IM wscript.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2884
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /F /IM cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /tn NYAN /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3180
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Roaming\Client1.exe" /sc minute /mo 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4248

C:\Users\Admin\AppData\Roaming\Client1.exe
C:\Users\Admin\AppData\Roaming\Client1.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:380
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYANP /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1532
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Roaming\Client1.exe" /sc minute /mo 5
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3768
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM wscript.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1800
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2052
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYAN /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3632
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Roaming\Client1.exe" /sc minute /mo 1
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3992

C:\Users\Admin\AppData\Roaming\Client1.exe
C:\Users\Admin\AppData\Roaming\Client1.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYANP /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:464
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Roaming\Client1.exe" /sc minute /mo 5
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4976
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM wscript.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5108
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3572
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYAN /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4580
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Roaming\Client1.exe" /sc minute /mo 1
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Client1.exe.log

Filesize
408B

MD5
40b0c3caa1b14a4c83e8475c46bf2016

SHA1
af9575cda4d842f028d18b17063796a894ecd9d0

SHA256
70e88a428d92b6ab5905dac9f324824c4c6f120bc3f385c82b2d12f707a4a867

SHA512
916437df737de4b6063b7116b4d148229d4a975eb4046122d47434b81fba06e88e09e5f273ec496c81ef3feecb843ccad20a7a04074224416c1fa9951acbdac7

Download Submit
C:\Users\Admin\AppData\Roaming\Client1.exe

Filesize
165KB

MD5
3799833548a3e8bdd526ae0ed3398913

SHA1
2ef660ea22a7e134196b464c9bddffd6b0d2b045

SHA256
6dae0159d5da508bf4fadc7a19fba5d13d3494d75db63713ac54fc0c31b09d6e

SHA512
3297bea07f15ebae219e913a94c425bac4bf6c6539f03c3597f9a8b6f16c5d629c5bf879e35356e131aa0311179d4a58fe5d8a150f03d90e9f22c9257b8209d2

Download Submit
memory/964-6-0x0000000074BB0000-0x0000000075161000-memory.dmp

Filesize
5.7MB

Download
memory/964-3-0x0000000074BB0000-0x0000000075161000-memory.dmp

Filesize
5.7MB

Download
memory/964-4-0x0000000074BB0000-0x0000000075161000-memory.dmp

Filesize
5.7MB

Download
memory/964-5-0x0000000074BB2000-0x0000000074BB3000-memory.dmp

Filesize
4KB

Download
memory/964-0-0x0000000074BB2000-0x0000000074BB3000-memory.dmp

Filesize
4KB

Download
memory/964-7-0x0000000074BB0000-0x0000000075161000-memory.dmp

Filesize
5.7MB

Download
memory/964-8-0x0000000074BB0000-0x0000000075161000-memory.dmp

Filesize
5.7MB

Download
memory/964-9-0x0000000074BB0000-0x0000000075161000-memory.dmp

Filesize
5.7MB

Download
memory/964-2-0x0000000074BB0000-0x0000000075161000-memory.dmp

Filesize
5.7MB

Download
memory/964-19-0x0000000074BB0000-0x0000000075161000-memory.dmp

Filesize
5.7MB

Download
memory/964-1-0x0000000074BB0000-0x0000000075161000-memory.dmp

Filesize
5.7MB

Download