Overview

overview

10

Static

static

3

44f2b176d4...18.exe

windows7-x64

10

44f2b176d4...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-10-2024 00:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    44f2b176d49109d497dd2adbee8376bb_JaffaCakes118.exe

  • Size

    252KB

  • MD5

    44f2b176d49109d497dd2adbee8376bb

  • SHA1

    e288dcf13a6faf8a02876340f8a4277fb6031256

  • SHA256

    b6c180579747a886eabea186cf0dc2924a94fcaacba5fc2938e4099a9368cf6b

  • SHA512

    f2a0bea897dc2fcab309a21d9ce2caff8da39fc9c21a2942cc98ad707a3320d4b64f7e670844b3a178fa2ebe6d4adcb203be4713531850c347b88a4eb3db4d87

  • SSDEEP

    1536:YIgtZkCGTDGyG5ThFH/oGP+tfwQomF2uP:/zCGPGyihZ/oftYzmtP

Score
10/10
xtremeratdiscoverypersistenceratspyware

Malware Config

Extracted

Family

xtremerat

C2

service-update1.zapto.org

Signatures

  • Detect XtremeRAT payload 23 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 58 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 54 IoCs
  • Adds Run key to start application 2 TTPs 58 IoCs
    persistence
  • Suspicious use of SetThreadContext 28 IoCs
  • Drops file in Program Files directory 57 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious use of SetWindowsHookEx 28 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\44f2b176d49109d497dd2adbee8376bb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\44f2b176d49109d497dd2adbee8376bb_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4800
    • C:\Users\Admin\AppData\Local\Temp\44f2b176d49109d497dd2adbee8376bb_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\44f2b176d49109d497dd2adbee8376bb_JaffaCakes118.exe
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:1260
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:464
        • C:\Program Files (x86)\Java 7.0\Java 7.exe
          "C:\Program Files (x86)\Java 7.0\Java 7.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3336
          • C:\Program Files (x86)\Java 7.0\Java 7.exe
            "C:\Program Files (x86)\Java 7.0\Java 7.exe"
            5⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Program Files directory
            • Suspicious use of WriteProcessMemory
            PID:3600
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              6⤵
                PID:4352
          • C:\Program Files (x86)\Java 7.0\Java 7.exe
            "C:\Program Files (x86)\Java 7.0\Java 7.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3444
            • C:\Program Files (x86)\Java 7.0\Java 7.exe
              "C:\Program Files (x86)\Java 7.0\Java 7.exe"
              5⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:940
              • C:\Windows\SysWOW64\svchost.exe
                svchost.exe
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2824
          • C:\Program Files (x86)\Java 7.0\Java 7.exe
            "C:\Program Files (x86)\Java 7.0\Java 7.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:1784
            • C:\Program Files (x86)\Java 7.0\Java 7.exe
              "C:\Program Files (x86)\Java 7.0\Java 7.exe"
              5⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              PID:2680
              • C:\Windows\SysWOW64\svchost.exe
                svchost.exe
                6⤵
                • System Location Discovery: System Language Discovery
                PID:3456
          • C:\Program Files (x86)\Java 7.0\Java 7.exe
            "C:\Program Files (x86)\Java 7.0\Java 7.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2820
            • C:\Program Files (x86)\Java 7.0\Java 7.exe
              "C:\Program Files (x86)\Java 7.0\Java 7.exe"
              5⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              PID:1456
              • C:\Windows\SysWOW64\svchost.exe
                svchost.exe
                6⤵
                • System Location Discovery: System Language Discovery
                PID:5108
          • C:\Program Files (x86)\Java 7.0\Java 7.exe
            "C:\Program Files (x86)\Java 7.0\Java 7.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:4852
            • C:\Program Files (x86)\Java 7.0\Java 7.exe
              "C:\Program Files (x86)\Java 7.0\Java 7.exe"
              5⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in Program Files directory
              PID:2836
              • C:\Windows\SysWOW64\svchost.exe
                svchost.exe
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1020
          • C:\Program Files (x86)\Java 7.0\Java 7.exe
            "C:\Program Files (x86)\Java 7.0\Java 7.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of SetWindowsHookEx
            PID:1804
            • C:\Program Files (x86)\Java 7.0\Java 7.exe
              "C:\Program Files (x86)\Java 7.0\Java 7.exe"
              5⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              PID:4600
              • C:\Windows\SysWOW64\svchost.exe
                svchost.exe
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4648
          • C:\Program Files (x86)\Java 7.0\Java 7.exe
            "C:\Program Files (x86)\Java 7.0\Java 7.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of SetWindowsHookEx
            PID:3032
            • C:\Program Files (x86)\Java 7.0\Java 7.exe
              "C:\Program Files (x86)\Java 7.0\Java 7.exe"
              5⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              PID:4508
              • C:\Windows\SysWOW64\svchost.exe
                svchost.exe
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2784
          • C:\Program Files (x86)\Java 7.0\Java 7.exe
            "C:\Program Files (x86)\Java 7.0\Java 7.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of SetWindowsHookEx
            PID:224
            • C:\Program Files (x86)\Java 7.0\Java 7.exe
              "C:\Program Files (x86)\Java 7.0\Java 7.exe"
              5⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              PID:2764
              • C:\Windows\SysWOW64\svchost.exe
                svchost.exe
                6⤵
                • System Location Discovery: System Language Discovery
                PID:3464
          • C:\Program Files (x86)\Java 7.0\Java 7.exe
            "C:\Program Files (x86)\Java 7.0\Java 7.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2508
            • C:\Program Files (x86)\Java 7.0\Java 7.exe
              "C:\Program Files (x86)\Java 7.0\Java 7.exe"
              5⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              PID:4444
              • C:\Windows\SysWOW64\svchost.exe
                svchost.exe
                6⤵
                  PID:3612
            • C:\Program Files (x86)\Java 7.0\Java 7.exe
              "C:\Program Files (x86)\Java 7.0\Java 7.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of SetWindowsHookEx
              PID:3484
              • C:\Program Files (x86)\Java 7.0\Java 7.exe
                "C:\Program Files (x86)\Java 7.0\Java 7.exe"
                5⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in Program Files directory
                PID:8
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:2176
            • C:\Program Files (x86)\Java 7.0\Java 7.exe
              "C:\Program Files (x86)\Java 7.0\Java 7.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:444
              • C:\Program Files (x86)\Java 7.0\Java 7.exe
                "C:\Program Files (x86)\Java 7.0\Java 7.exe"
                5⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in Program Files directory
                PID:4772
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:4840
            • C:\Program Files (x86)\Java 7.0\Java 7.exe
              "C:\Program Files (x86)\Java 7.0\Java 7.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:2776
              • C:\Program Files (x86)\Java 7.0\Java 7.exe
                "C:\Program Files (x86)\Java 7.0\Java 7.exe"
                5⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in Program Files directory
                • System Location Discovery: System Language Discovery
                PID:4856
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:436
            • C:\Program Files (x86)\Java 7.0\Java 7.exe
              "C:\Program Files (x86)\Java 7.0\Java 7.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of SetWindowsHookEx
              PID:3252
              • C:\Program Files (x86)\Java 7.0\Java 7.exe
                "C:\Program Files (x86)\Java 7.0\Java 7.exe"
                5⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in Program Files directory
                • System Location Discovery: System Language Discovery
                PID:4416
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:3728
            • C:\Program Files (x86)\Java 7.0\Java 7.exe
              "C:\Program Files (x86)\Java 7.0\Java 7.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:5048
              • C:\Program Files (x86)\Java 7.0\Java 7.exe
                "C:\Program Files (x86)\Java 7.0\Java 7.exe"
                5⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in Program Files directory
                • System Location Discovery: System Language Discovery
                PID:2328
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:876
            • C:\Program Files (x86)\Java 7.0\Java 7.exe
              "C:\Program Files (x86)\Java 7.0\Java 7.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:2256
              • C:\Program Files (x86)\Java 7.0\Java 7.exe
                "C:\Program Files (x86)\Java 7.0\Java 7.exe"
                5⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in Program Files directory
                • System Location Discovery: System Language Discovery
                PID:852
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:5072
            • C:\Program Files (x86)\Java 7.0\Java 7.exe
              "C:\Program Files (x86)\Java 7.0\Java 7.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:640
              • C:\Program Files (x86)\Java 7.0\Java 7.exe
                "C:\Program Files (x86)\Java 7.0\Java 7.exe"
                5⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in Program Files directory
                • System Location Discovery: System Language Discovery
                PID:4808
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:4160
            • C:\Program Files (x86)\Java 7.0\Java 7.exe
              "C:\Program Files (x86)\Java 7.0\Java 7.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:5112
              • C:\Program Files (x86)\Java 7.0\Java 7.exe
                "C:\Program Files (x86)\Java 7.0\Java 7.exe"
                5⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in Program Files directory
                • System Location Discovery: System Language Discovery
                PID:768
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  6⤵
                    PID:4412
              • C:\Program Files (x86)\Java 7.0\Java 7.exe
                "C:\Program Files (x86)\Java 7.0\Java 7.exe"
                4⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2032
                • C:\Program Files (x86)\Java 7.0\Java 7.exe
                  "C:\Program Files (x86)\Java 7.0\Java 7.exe"
                  5⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Drops file in Program Files directory
                  • System Location Discovery: System Language Discovery
                  PID:2512
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:3844
              • C:\Program Files (x86)\Java 7.0\Java 7.exe
                "C:\Program Files (x86)\Java 7.0\Java 7.exe"
                4⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2344
                • C:\Program Files (x86)\Java 7.0\Java 7.exe
                  "C:\Program Files (x86)\Java 7.0\Java 7.exe"
                  5⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Drops file in Program Files directory
                  PID:2044
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe
                    6⤵
                      PID:3252
                • C:\Program Files (x86)\Java 7.0\Java 7.exe
                  "C:\Program Files (x86)\Java 7.0\Java 7.exe"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4848
                  • C:\Program Files (x86)\Java 7.0\Java 7.exe
                    "C:\Program Files (x86)\Java 7.0\Java 7.exe"
                    5⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Drops file in Program Files directory
                    PID:2024
                    • C:\Windows\SysWOW64\svchost.exe
                      svchost.exe
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:4796
                • C:\Program Files (x86)\Java 7.0\Java 7.exe
                  "C:\Program Files (x86)\Java 7.0\Java 7.exe"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4432
                  • C:\Program Files (x86)\Java 7.0\Java 7.exe
                    "C:\Program Files (x86)\Java 7.0\Java 7.exe"
                    5⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Drops file in Program Files directory
                    • System Location Discovery: System Language Discovery
                    PID:4120
                    • C:\Windows\SysWOW64\svchost.exe
                      svchost.exe
                      6⤵
                        PID:3536
                  • C:\Program Files (x86)\Java 7.0\Java 7.exe
                    "C:\Program Files (x86)\Java 7.0\Java 7.exe"
                    4⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of SetWindowsHookEx
                    PID:708
                    • C:\Program Files (x86)\Java 7.0\Java 7.exe
                      "C:\Program Files (x86)\Java 7.0\Java 7.exe"
                      5⤵
                      • Boot or Logon Autostart Execution: Active Setup
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Drops file in Program Files directory
                      • System Location Discovery: System Language Discovery
                      PID:1344
                      • C:\Windows\SysWOW64\svchost.exe
                        svchost.exe
                        6⤵
                          PID:5072
                    • C:\Program Files (x86)\Java 7.0\Java 7.exe
                      "C:\Program Files (x86)\Java 7.0\Java 7.exe"
                      4⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:1956
                      • C:\Program Files (x86)\Java 7.0\Java 7.exe
                        "C:\Program Files (x86)\Java 7.0\Java 7.exe"
                        5⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Drops file in Program Files directory
                        • System Location Discovery: System Language Discovery
                        PID:1492
                        • C:\Windows\SysWOW64\svchost.exe
                          svchost.exe
                          6⤵
                          • System Location Discovery: System Language Discovery
                          PID:264
                    • C:\Program Files (x86)\Java 7.0\Java 7.exe
                      "C:\Program Files (x86)\Java 7.0\Java 7.exe"
                      4⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:2784
                      • C:\Program Files (x86)\Java 7.0\Java 7.exe
                        "C:\Program Files (x86)\Java 7.0\Java 7.exe"
                        5⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Drops file in Program Files directory
                        • System Location Discovery: System Language Discovery
                        PID:1700
                        • C:\Windows\SysWOW64\svchost.exe
                          svchost.exe
                          6⤵
                          • System Location Discovery: System Language Discovery
                          PID:960
                    • C:\Program Files (x86)\Java 7.0\Java 7.exe
                      "C:\Program Files (x86)\Java 7.0\Java 7.exe"
                      4⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious use of SetWindowsHookEx
                      PID:2764
                      • C:\Program Files (x86)\Java 7.0\Java 7.exe
                        "C:\Program Files (x86)\Java 7.0\Java 7.exe"
                        5⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Drops file in Program Files directory
                        • System Location Discovery: System Language Discovery
                        PID:2592
                        • C:\Windows\SysWOW64\svchost.exe
                          svchost.exe
                          6⤵
                            PID:4368
                      • C:\Program Files (x86)\Java 7.0\Java 7.exe
                        "C:\Program Files (x86)\Java 7.0\Java 7.exe"
                        4⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:4912
                        • C:\Program Files (x86)\Java 7.0\Java 7.exe
                          "C:\Program Files (x86)\Java 7.0\Java 7.exe"
                          5⤵
                          • Boot or Logon Autostart Execution: Active Setup
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Drops file in Program Files directory
                          • System Location Discovery: System Language Discovery
                          PID:4788
                          • C:\Windows\SysWOW64\svchost.exe
                            svchost.exe
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:2568
                      • C:\Program Files (x86)\Java 7.0\Java 7.exe
                        "C:\Program Files (x86)\Java 7.0\Java 7.exe"
                        4⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:2776
                        • C:\Program Files (x86)\Java 7.0\Java 7.exe
                          "C:\Program Files (x86)\Java 7.0\Java 7.exe"
                          5⤵
                          • Boot or Logon Autostart Execution: Active Setup
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Drops file in Program Files directory
                          • System Location Discovery: System Language Discovery
                          PID:1384
                          • C:\Windows\SysWOW64\svchost.exe
                            svchost.exe
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:4536
                    • C:\Windows\SysWOW64\svchost.exe
                      svchost.exe
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:2376

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Program Files (x86)\Java 7.0\Java 7.exe
                  Filesize

                  252KB

                  MD5

                  44f2b176d49109d497dd2adbee8376bb

                  SHA1

                  e288dcf13a6faf8a02876340f8a4277fb6031256

                  SHA256

                  b6c180579747a886eabea186cf0dc2924a94fcaacba5fc2938e4099a9368cf6b

                  SHA512

                  f2a0bea897dc2fcab309a21d9ce2caff8da39fc9c21a2942cc98ad707a3320d4b64f7e670844b3a178fa2ebe6d4adcb203be4713531850c347b88a4eb3db4d87

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\S5PrnK+.cfg
                  Filesize

                  1KB

                  MD5

                  eb5df50513080ea0cd05ff39be310391

                  SHA1

                  d4bfa2e8ddb6c360f350c74c30f6f1ee13998ca0

                  SHA256

                  bd581febac93fe4e12a5633a9c702c34688f20241db05cd3853985c1ab6c2af7

                  SHA512

                  46b2af2ab7f386cae2a4bb1fc9ec138ae7c706805fd323fc8bd5e0954b31245165ef0fa85c0632a3adc32f63dabf32dba08cfa3c378eb348a6c2815d7a78f493

                  Download Submit

                • memory/436-145-0x0000000013140000-0x000000001315C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/464-10-0x0000000013140000-0x000000001315C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/876-167-0x0000000013140000-0x000000001315C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/940-31-0x0000000013140000-0x000000001315C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/1020-68-0x0000000013140000-0x000000001315C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/1260-5-0x0000000013140000-0x000000001315C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/1260-13-0x0000000013140000-0x000000001315C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/1260-4-0x0000000013140000-0x000000001315C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/1260-2-0x0000000013140000-0x000000001315C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/1260-3-0x0000000013140000-0x000000001315C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/2176-123-0x0000000013140000-0x000000001315C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/2376-12-0x0000000013140000-0x000000001315C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/2784-90-0x0000000013140000-0x000000001315C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/2824-35-0x0000000013140000-0x000000001315C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/3456-46-0x0000000013140000-0x000000001315C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/3464-101-0x0000000013140000-0x000000001315C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/3600-20-0x0000000013140000-0x000000001315C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/3612-112-0x0000000013140000-0x000000001315C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/3728-156-0x0000000013140000-0x000000001315C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/4352-24-0x0000000013140000-0x000000001315C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/4648-79-0x0000000013140000-0x000000001315C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/4840-134-0x0000000013140000-0x000000001315C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/5108-57-0x0000000013140000-0x000000001315C000-memory.dmp

                  Filesize

                  112KB

                  Download