e45b483a0aa176d186448b35c45de6e027087bea1fa79f003c49fe7e06282b26

Analysis

max time kernel
144s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 14:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a807c2d16ec69437d4da710a7754159_JaffaCakes118.exe
Size

4.3MB
MD5

3a807c2d16ec69437d4da710a7754159
SHA1

8103d72b998ee92c77a95fcfcc99dfa7efc26813
SHA256

e45b483a0aa176d186448b35c45de6e027087bea1fa79f003c49fe7e06282b26
SHA512

a280e9d7cae2c1e02254580b6ed46fe14a71011580f7798defddc989f53a376db000179627b8a6d13f2351628cd860a2e3f5575b1595c3d75a1018de818d835b
SSDEEP

98304:clDZSQwZp6+f76Jk406XuHZw5rcSGvHYobwzMVCBjOdAP:cltEHeq6XQMcS4jajOdAP

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2696	CFÍâ¹Ò.exe

Loads dropped DLL 9 IoCs

pid	Process
788	cmd.exe
2696	CFÍâ¹Ò.exe
2848	WerFault.exe
2848	WerFault.exe
2848	WerFault.exe
2848	WerFault.exe
2848	WerFault.exe
2848	WerFault.exe
2848	WerFault.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000193f7-10.dat	upx
behavioral1/memory/2696-30-0x0000000001000000-0x000000000135E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2848	2696	WerFault.exe	33

System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3a807c2d16ec69437d4da710a7754159_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CFÍâ¹Ò.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 844	2524	3a807c2d16ec69437d4da710a7754159_JaffaCakes118.exe	29
PID 2524 wrote to memory of 844	2524	3a807c2d16ec69437d4da710a7754159_JaffaCakes118.exe	29
PID 2524 wrote to memory of 844	2524	3a807c2d16ec69437d4da710a7754159_JaffaCakes118.exe	29
PID 2524 wrote to memory of 844	2524	3a807c2d16ec69437d4da710a7754159_JaffaCakes118.exe	29
PID 2524 wrote to memory of 788	2524	3a807c2d16ec69437d4da710a7754159_JaffaCakes118.exe	31
PID 2524 wrote to memory of 788	2524	3a807c2d16ec69437d4da710a7754159_JaffaCakes118.exe	31
PID 2524 wrote to memory of 788	2524	3a807c2d16ec69437d4da710a7754159_JaffaCakes118.exe	31
PID 2524 wrote to memory of 788	2524	3a807c2d16ec69437d4da710a7754159_JaffaCakes118.exe	31
PID 788 wrote to memory of 2696	788	cmd.exe	33
PID 788 wrote to memory of 2696	788	cmd.exe	33
PID 788 wrote to memory of 2696	788	cmd.exe	33
PID 788 wrote to memory of 2696	788	cmd.exe	33
PID 788 wrote to memory of 2696	788	cmd.exe	33
PID 788 wrote to memory of 2696	788	cmd.exe	33
PID 788 wrote to memory of 2696	788	cmd.exe	33
PID 2696 wrote to memory of 2848	2696	CFÍâ¹Ò.exe	34
PID 2696 wrote to memory of 2848	2696	CFÍâ¹Ò.exe	34
PID 2696 wrote to memory of 2848	2696	CFÍâ¹Ò.exe	34
PID 2696 wrote to memory of 2848	2696	CFÍâ¹Ò.exe	34
PID 2696 wrote to memory of 2848	2696	CFÍâ¹Ò.exe	34
PID 2696 wrote to memory of 2848	2696	CFÍâ¹Ò.exe	34
PID 2696 wrote to memory of 2848	2696	CFÍâ¹Ò.exe	34
PID 844 wrote to memory of 2832	844	cmd.exe	35
PID 844 wrote to memory of 2832	844	cmd.exe	35
PID 844 wrote to memory of 2832	844	cmd.exe	35
PID 844 wrote to memory of 2832	844	cmd.exe	35
PID 844 wrote to memory of 2832	844	cmd.exe	35
PID 844 wrote to memory of 2832	844	cmd.exe	35
PID 844 wrote to memory of 2832	844	cmd.exe	35
PID 2832 wrote to memory of 3052	2832	rundll32.exe	36
PID 2832 wrote to memory of 3052	2832	rundll32.exe	36
PID 2832 wrote to memory of 3052	2832	rundll32.exe	36
PID 2832 wrote to memory of 3052	2832	rundll32.exe	36
PID 2832 wrote to memory of 3052	2832	rundll32.exe	36
PID 2832 wrote to memory of 3052	2832	rundll32.exe	36
PID 2832 wrote to memory of 3052	2832	rundll32.exe	36
PID 3052 wrote to memory of 1064	3052	rundll32.exe	37
PID 3052 wrote to memory of 1064	3052	rundll32.exe	37
PID 3052 wrote to memory of 1064	3052	rundll32.exe	37
PID 3052 wrote to memory of 1064	3052	rundll32.exe	37
PID 3052 wrote to memory of 1064	3052	rundll32.exe	37
PID 3052 wrote to memory of 1064	3052	rundll32.exe	37
PID 3052 wrote to memory of 1064	3052	rundll32.exe	37
PID 1064 wrote to memory of 1648	1064	rundll32.exe	38
PID 1064 wrote to memory of 1648	1064	rundll32.exe	38
PID 1064 wrote to memory of 1648	1064	rundll32.exe	38
PID 1064 wrote to memory of 1648	1064	rundll32.exe	38
PID 1064 wrote to memory of 1648	1064	rundll32.exe	38
PID 1064 wrote to memory of 1648	1064	rundll32.exe	38
PID 1064 wrote to memory of 1648	1064	rundll32.exe	38
PID 1648 wrote to memory of 880	1648	rundll32.exe	39
PID 1648 wrote to memory of 880	1648	rundll32.exe	39
PID 1648 wrote to memory of 880	1648	rundll32.exe	39
PID 1648 wrote to memory of 880	1648	rundll32.exe	39
PID 1648 wrote to memory of 880	1648	rundll32.exe	39
PID 1648 wrote to memory of 880	1648	rundll32.exe	39
PID 1648 wrote to memory of 880	1648	rundll32.exe	39
PID 880 wrote to memory of 3032	880	rundll32.exe	40
PID 880 wrote to memory of 3032	880	rundll32.exe	40
PID 880 wrote to memory of 3032	880	rundll32.exe	40
PID 880 wrote to memory of 3032	880	rundll32.exe	40
PID 880 wrote to memory of 3032	880	rundll32.exe	40
PID 880 wrote to memory of 3032	880	rundll32.exe	40
PID 880 wrote to memory of 3032	880	rundll32.exe	40

C:\Users\Admin\AppData\Local\Temp\3a807c2d16ec69437d4da710a7754159_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3a807c2d16ec69437d4da710a7754159_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\\huigeziVersion2.0.rar"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\huigeziVersion2.0.rar
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\huigeziVersion2.0.rar
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3052
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\huigeziVersion2.0.rar
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1064
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\huigeziVersion2.0.rar
        6⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1648
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\huigeziVersion2.0.rar
        7⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:880
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\huigeziVersion2.0.rar
        8⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3032
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\huigeziVersion2.0.rar
        9⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2904
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\huigeziVersion2.0.rar
        10⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1764
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\huigeziVersion2.0.rar
        11⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2056
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\huigeziVersion2.0.rar
        12⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2968
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\huigeziVersion2.0.rar
        13⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2180
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\huigeziVersion2.0.rar
        14⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1244
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\huigeziVersion2.0.rar
        15⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2200
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\huigeziVersion2.0.rar
        16⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:888
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\huigeziVersion2.0.rar
        17⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1804
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\huigeziVersion2.0.rar
        18⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2004
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\huigeziVersion2.0.rar
        19⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1232
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\huigeziVersion2.0.rar
        20⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:376
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\huigeziVersion2.0.rar
        21⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:840
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\huigeziVersion2.0.rar
        22⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1580
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\huigeziVersion2.0.rar
        23⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2812
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\huigeziVersion2.0.rar
        24⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2612
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\huigeziVersion2.0.rar
        25⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2788
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\huigeziVersion2.0.rar
        26⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2944
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\\CFÍâ¹Ò.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:788
- - C:\Users\Admin\AppData\Local\Temp\CFÍâ¹Ò.exe
    C:\Users\Admin\AppData\Local\Temp\\CFÍâ¹Ò.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2696
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 268
      4⤵
      Loads dropped DLL
      Program crash
      PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CFÍâ¹Ò.exe

Filesize
2.5MB

MD5
e75e6f248f75270bbe6d681f6255755b

SHA1
109ad4f2123d00888503491d0edbaa8e8318ff04

SHA256
f17ce96c3b846a0630ce0fcb005d719290e4e48ccc624de44395503d1276b48d

SHA512
b81a4718e3c4040d65d2353121857e943db3720811cec5158ba1582d6f21ad9d3a00ee593a573d31044a4502f039e87ef24ac5e62452777b93893cbabc97975d

Download Submit
memory/788-18-0x0000000002290000-0x00000000025EE000-memory.dmp

Filesize
3.4MB

Download
memory/2524-2-0x0000000000400000-0x000000000084B000-memory.dmp

Filesize
4.3MB

Download
memory/2696-30-0x0000000001000000-0x000000000135E000-memory.dmp

Filesize
3.4MB

Download
memory/2696-32-0x0000000000960000-0x0000000000CBE000-memory.dmp

Filesize
3.4MB

Download
memory/2696-31-0x00000000010D3000-0x00000000010D4000-memory.dmp

Filesize
4KB

Download
memory/2696-44-0x0000000000960000-0x0000000000CBE000-memory.dmp

Filesize
3.4MB

Download