Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/10/2024, 22:07
Static task
static1
Behavioral task
behavioral1
Sample
4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe
-
Size
600KB
-
MD5
4f4895f86b7a1c708892711e46132e3d
-
SHA1
62a7e6ffd1478d7363105923ef6b99d9a65a5c66
-
SHA256
c5e685dd65228c0237e01b5467333f08b7de33ee15b320b6b21f687b6c8c564a
-
SHA512
55f70b90ebc72df90007c8db3c8033f484a6ff5842be4d3ba2973ffbaddce33fc1d22adb965d424a0887fe257cac7cdec4279f28a757f208b47c711ad714941f
-
SSDEEP
12288:k7l4s3shTJBJbI3HfaiDX29J5FB9i727cgWjaGJkAuR7VUSFNu:kGs3qTZbIXiiX2H5XS27c7ZkvBFNu
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts aaad.exe -
Executes dropped EXE 3 IoCs
pid Process 2280 aaad.exe 5116 aaad.exe 1536 aaad.exe -
Loads dropped DLL 33 IoCs
pid Process 1876 regsvr32.exe 1536 aaad.exe 4304 rundll32.exe 1040 rundll32.exe 1536 aaad.exe 1536 aaad.exe 1536 aaad.exe 1536 aaad.exe 1536 aaad.exe 1536 aaad.exe 1536 aaad.exe 1536 aaad.exe 1536 aaad.exe 1536 aaad.exe 1536 aaad.exe 1536 aaad.exe 1536 aaad.exe 1536 aaad.exe 1536 aaad.exe 1536 aaad.exe 1536 aaad.exe 1536 aaad.exe 1536 aaad.exe 1536 aaad.exe 1536 aaad.exe 1536 aaad.exe 1536 aaad.exe 1536 aaad.exe 1536 aaad.exe 1536 aaad.exe 1536 aaad.exe 1536 aaad.exe 1536 aaad.exe -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\ = "Microsoft User" regsvr32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification \??\PhysicalDrive0 aaad.exe File opened for modification \??\PhysicalDrive0 rundll32.exe -
Drops file in System32 directory 18 IoCs
description ioc Process File created C:\Windows\SysWOW64\1957 rundll32.exe File opened for modification C:\Windows\SysWOW64\30e6.dll 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\70l8.dlltmp 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\0aa3.dll 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\da3r.dll 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\da3r.dlltmp 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\70l8.dll 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\03ca.dlltmp 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\03as.dll 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\0ddd.exe 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\8ado.dll 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\8ado.dlltmp 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\0dr0.exe 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\03ca.dll 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\33u6.exe 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\830e.dll 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\aaad.exe 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File created C:\Windows\SysWOW64\-1332-10549 rundll32.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\4acu.bmp 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\d06d.flv 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\64au.bmp 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File created C:\Windows\Tasks\ms.job 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\aa0d.bmp 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\0d06.exe 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\64a.bmp 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\686.flv 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\686d.flv 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\733a.flv 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\864.exe 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\686d.exe 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe File opened for modification C:\Windows\864d.exe 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aaad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aaad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 47 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\ = "BHO 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer\CLSID\ = "{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer\CurVer\ = "BHO.FunPlayer.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\ProgID\ = "BHO.FunPlayer.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\InprocServer32\ThreadingModel = "apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\TypeLib\ = "{797AD939-E96C-43E1-ACBD-778DFFD8748C}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\VersionIndependentProgID\ = "BHO.FunPlayer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\TypeLib\ = "{797AD939-E96C-43E1-ACBD-778DFFD8748C}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\InprocServer32\ = "C:\\Windows\\SysWow64\\8ado.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\TypeLib\ = "{797AD939-E96C-43E1-ACBD-778DFFD8748C}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\AppID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\8ado.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\ = "IFunPlayer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer.1\ = "CFunPlayer Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\ = "IFunPlayer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CC0BADE-4049-4B84-B998-D1AD4D7B9C44}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer.1\CLSID\ = "{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FunPlayer\ = "CFunPlayer Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\ = "CFunPlayer Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED493CC4-E87B-4D8C-AC59-2A87A14237A0}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{797AD939-E96C-43E1-ACBD-778DFFD8748C} regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1536 aaad.exe 1536 aaad.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 4436 wrote to memory of 1180 4436 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 84 PID 4436 wrote to memory of 1180 4436 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 84 PID 4436 wrote to memory of 1180 4436 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 84 PID 4436 wrote to memory of 3224 4436 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 85 PID 4436 wrote to memory of 3224 4436 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 85 PID 4436 wrote to memory of 3224 4436 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 85 PID 4436 wrote to memory of 1908 4436 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 86 PID 4436 wrote to memory of 1908 4436 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 86 PID 4436 wrote to memory of 1908 4436 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 86 PID 4436 wrote to memory of 2696 4436 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 87 PID 4436 wrote to memory of 2696 4436 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 87 PID 4436 wrote to memory of 2696 4436 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 87 PID 4436 wrote to memory of 1876 4436 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 88 PID 4436 wrote to memory of 1876 4436 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 88 PID 4436 wrote to memory of 1876 4436 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 88 PID 4436 wrote to memory of 2280 4436 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 90 PID 4436 wrote to memory of 2280 4436 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 90 PID 4436 wrote to memory of 2280 4436 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 90 PID 4436 wrote to memory of 5116 4436 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 95 PID 4436 wrote to memory of 5116 4436 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 95 PID 4436 wrote to memory of 5116 4436 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 95 PID 4436 wrote to memory of 4304 4436 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 98 PID 4436 wrote to memory of 4304 4436 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 98 PID 4436 wrote to memory of 4304 4436 4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe 98 PID 1536 wrote to memory of 1040 1536 aaad.exe 99 PID 1536 wrote to memory of 1040 1536 aaad.exe 99 PID 1536 wrote to memory of 1040 1536 aaad.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4f4895f86b7a1c708892711e46132e3d_JaffaCakes118.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\70l8.dll"2⤵
- System Location Discovery: System Language Discovery
PID:1180
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\03ca.dll"2⤵
- System Location Discovery: System Language Discovery
PID:3224
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\da3r.dll"2⤵
- System Location Discovery: System Language Discovery
PID:1908
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32\8ado.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2696
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /s "C:\Windows\system32\8ado.dll"2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1876
-
-
C:\Windows\SysWOW64\aaad.exeC:\Windows\system32\aaad.exe -i2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2280
-
-
C:\Windows\SysWOW64\aaad.exeC:\Windows\system32\aaad.exe -s2⤵
- Executes dropped EXE
PID:5116
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32 C:\Windows\system32\830e.dll, Always2⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4304
-
-
C:\Windows\SysWOW64\aaad.exeC:\Windows\SysWOW64\aaad.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32 C:\Windows\system32\830e.dll,Always2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1040
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208KB
MD5326c38b450d4e8e00968e0b1f6470401
SHA156ffac17a189af0302346b829797f72d5d4658fc
SHA2567163befb152d3924597568f5a010d855e1ced00d26b7eed3d367bd55bd3459f0
SHA512462ec813832c05ba78d345ea09397e27f8630739d0e5f81f7ea5adf345c4eabcc59e4d0dc3d504cd7beb670bfac7ea863c5449e04fb1f50c559df0710ebe98fe
-
Filesize
376KB
MD560845b09acf8516709e44fe3a05ef6a5
SHA11b837b76a6fa7a9c05fb9cf0150ff1d27c3a46aa
SHA25682a4598ca45690f241bcd0282675f4bd5bd3dc89e8c360c74452ec1c039d72f7
SHA5125a34e4c18e36614c29029757e48b30452978c6620664605c878c15acebc6fa75ada9bae89bf6e860ea8e62a4ceb15d8583fe33bafc1312b74549fa4a35ef5d9e
-
Filesize
116KB
MD5d8933fe3737dc8279462b9f16a6cb8b7
SHA13c961e43b52b3fee3f1b471cad2faa6a450e7a62
SHA256e571256bdf9d2ed71fc8aebb1b37af1256b6dbe9790034a9af95e3aa2a023004
SHA51266feb528794ef0416951a460ab5c934d1398fcc78a513d3ad6f0aa9de56403c5231855d3c23cef238f1b85f9370fe0d726e385aa0da449f66b1a665fefc4f1be