cf880ad15b38faf97af44063945da6b8eca4f78624b799b595e73d653ca829e3

Analysis

max time kernel
124s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 18:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

532f798fe6c66eab33258b0f0451826e_JaffaCakes118.exe
Size

96KB
MD5

532f798fe6c66eab33258b0f0451826e
SHA1

9aa0f8b76649583343a307a4ccbdae26ab6e0d13
SHA256

cf880ad15b38faf97af44063945da6b8eca4f78624b799b595e73d653ca829e3
SHA512

a866589c1a188151fa11fd2a3c39e05a1951ce984e80589fa5d44e30d50c0bd852ba37fc523915d2ce1e0cd611776a0b26333fafaa870dc675f9c20c40930c86
SSDEEP

1536:W9JGlcQQ/mw4syoqCM8UB6dHGO8+3tjgHJ2+y+s+rRJWicMgwqQB+L:W9glcfmw4syGpUsdHGOh3tsH4ms6JWi8

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run	532f798fe6c66eab33258b0f0451826e_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wmi32 = "C:\\ProgramData\\Application Data\\winmgmt.exe"	532f798fe6c66eab33258b0f0451826e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	532f798fe6c66eab33258b0f0451826e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wmi32 = "C:\\ProgramData\\Application Data\\winmgmt.exe"	532f798fe6c66eab33258b0f0451826e_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2992	winmgmt.exe

Loads dropped DLL 2 IoCs

pid	Process
2320	532f798fe6c66eab33258b0f0451826e_JaffaCakes118.exe
2320	532f798fe6c66eab33258b0f0451826e_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	winmgmt.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
1484	ARP.EXE

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2684	tasklist.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 47 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ROUTE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winmgmt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ARP.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	532f798fe6c66eab33258b0f0451826e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
1448	NETSTAT.EXE

Discovers systems in the same network 1 TTPs 2 IoCs

discovery

Remote System Discovery

T1018

pid	Process
1744	net.exe
1604	net.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
336	NETSTAT.EXE
1452	ipconfig.exe
1448	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2904	systeminfo.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2684	tasklist.exe
Token: SeDebugPrivilege	1448	NETSTAT.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2992	2320	532f798fe6c66eab33258b0f0451826e_JaffaCakes118.exe	31
PID 2320 wrote to memory of 2992	2320	532f798fe6c66eab33258b0f0451826e_JaffaCakes118.exe	31
PID 2320 wrote to memory of 2992	2320	532f798fe6c66eab33258b0f0451826e_JaffaCakes118.exe	31
PID 2320 wrote to memory of 2992	2320	532f798fe6c66eab33258b0f0451826e_JaffaCakes118.exe	31
PID 2992 wrote to memory of 2364	2992	winmgmt.exe	32
PID 2992 wrote to memory of 2364	2992	winmgmt.exe	32
PID 2992 wrote to memory of 2364	2992	winmgmt.exe	32
PID 2992 wrote to memory of 2364	2992	winmgmt.exe	32
PID 2364 wrote to memory of 2692	2364	cmd.exe	34
PID 2364 wrote to memory of 2692	2364	cmd.exe	34
PID 2364 wrote to memory of 2692	2364	cmd.exe	34
PID 2364 wrote to memory of 2692	2364	cmd.exe	34
PID 2364 wrote to memory of 2708	2364	cmd.exe	35
PID 2364 wrote to memory of 2708	2364	cmd.exe	35
PID 2364 wrote to memory of 2708	2364	cmd.exe	35
PID 2364 wrote to memory of 2708	2364	cmd.exe	35
PID 2364 wrote to memory of 2752	2364	cmd.exe	36
PID 2364 wrote to memory of 2752	2364	cmd.exe	36
PID 2364 wrote to memory of 2752	2364	cmd.exe	36
PID 2364 wrote to memory of 2752	2364	cmd.exe	36
PID 2752 wrote to memory of 2760	2752	net.exe	37
PID 2752 wrote to memory of 2760	2752	net.exe	37
PID 2752 wrote to memory of 2760	2752	net.exe	37
PID 2752 wrote to memory of 2760	2752	net.exe	37
PID 2364 wrote to memory of 2824	2364	cmd.exe	38
PID 2364 wrote to memory of 2824	2364	cmd.exe	38
PID 2364 wrote to memory of 2824	2364	cmd.exe	38
PID 2364 wrote to memory of 2824	2364	cmd.exe	38
PID 2824 wrote to memory of 3016	2824	net.exe	39
PID 2824 wrote to memory of 3016	2824	net.exe	39
PID 2824 wrote to memory of 3016	2824	net.exe	39
PID 2824 wrote to memory of 3016	2824	net.exe	39
PID 2364 wrote to memory of 2684	2364	cmd.exe	40
PID 2364 wrote to memory of 2684	2364	cmd.exe	40
PID 2364 wrote to memory of 2684	2364	cmd.exe	40
PID 2364 wrote to memory of 2684	2364	cmd.exe	40
PID 2364 wrote to memory of 2904	2364	cmd.exe	42
PID 2364 wrote to memory of 2904	2364	cmd.exe	42
PID 2364 wrote to memory of 2904	2364	cmd.exe	42
PID 2364 wrote to memory of 2904	2364	cmd.exe	42
PID 2364 wrote to memory of 2220	2364	cmd.exe	44
PID 2364 wrote to memory of 2220	2364	cmd.exe	44
PID 2364 wrote to memory of 2220	2364	cmd.exe	44
PID 2364 wrote to memory of 2220	2364	cmd.exe	44
PID 2364 wrote to memory of 788	2364	cmd.exe	45
PID 2364 wrote to memory of 788	2364	cmd.exe	45
PID 2364 wrote to memory of 788	2364	cmd.exe	45
PID 2364 wrote to memory of 788	2364	cmd.exe	45
PID 2364 wrote to memory of 836	2364	cmd.exe	46
PID 2364 wrote to memory of 836	2364	cmd.exe	46
PID 2364 wrote to memory of 836	2364	cmd.exe	46
PID 2364 wrote to memory of 836	2364	cmd.exe	46
PID 2364 wrote to memory of 1460	2364	cmd.exe	47
PID 2364 wrote to memory of 1460	2364	cmd.exe	47
PID 2364 wrote to memory of 1460	2364	cmd.exe	47
PID 2364 wrote to memory of 1460	2364	cmd.exe	47
PID 2364 wrote to memory of 2860	2364	cmd.exe	48
PID 2364 wrote to memory of 2860	2364	cmd.exe	48
PID 2364 wrote to memory of 2860	2364	cmd.exe	48
PID 2364 wrote to memory of 2860	2364	cmd.exe	48
PID 2364 wrote to memory of 2068	2364	cmd.exe	49
PID 2364 wrote to memory of 2068	2364	cmd.exe	49
PID 2364 wrote to memory of 2068	2364	cmd.exe	49
PID 2364 wrote to memory of 2068	2364	cmd.exe	49

C:\Users\Admin\AppData\Local\Temp\532f798fe6c66eab33258b0f0451826e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\532f798fe6c66eab33258b0f0451826e_JaffaCakes118.exe"
1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2320
- C:\ProgramData\Application Data\winmgmt.exe
  "C:\ProgramData\Application Data\winmgmt.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ghi.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /s "YM.CGP_" "C:\Users\Admin"\..\*.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:2692
  - - C:\Windows\SysWOW64\chcp.com
      chcp
      4⤵
      System Location Discovery: System Language Discovery
      PID:2708
  - - C:\Windows\SysWOW64\net.exe
      net user
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2752
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2760
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2824
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3016
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2684
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:2904
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2220
  - - C:\Windows\SysWOW64\find.exe
      find "REG_"
      4⤵
      System Location Discovery: System Language Discovery
      PID:788
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office
      4⤵
      System Location Discovery: System Language Discovery
      PID:836
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Common\UserInfo
      4⤵
      System Location Discovery: System Language Discovery
      PID:1460
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Common\UserInfo
      4⤵
      System Location Discovery: System Language Discovery
      PID:2860
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Common\UserInfo
      4⤵
      System Location Discovery: System Language Discovery
      PID:2068
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Common\UserInfo
      4⤵
      System Location Discovery: System Language Discovery
      PID:2952
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\UserInfo
      4⤵
      System Location Discovery: System Language Discovery
      PID:1932
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Common\UserInfo
      4⤵
      System Location Discovery: System Language Discovery
      PID:236
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /all
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      PID:1452
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      netstat -ano
      4⤵
      System Location Discovery: System Language Discovery
      System Network Connections Discovery
      Gathers network information
      Suspicious use of AdjustPrivilegeToken
      PID:1448
  - - C:\Windows\SysWOW64\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      System Location Discovery: System Language Discovery
      PID:1484
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      netstat -r
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      PID:336
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2792
      - C:\Windows\SysWOW64\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2812
  - - C:\Windows\SysWOW64\net.exe
      net start
      4⤵
      System Location Discovery: System Language Discovery
      PID:2848
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2808
  - - C:\Windows\SysWOW64\net.exe
      net use
      4⤵
      System Location Discovery: System Language Discovery
      PID:2896
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo n"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2288
  - - C:\Windows\SysWOW64\net.exe
      net share
      4⤵
      System Location Discovery: System Language Discovery
      PID:1588
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 share
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1496
  - - C:\Windows\SysWOW64\net.exe
      net view /domain
      4⤵
      System Location Discovery: System Language Discovery
      Discovers systems in the same network
      PID:1744
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "
      4⤵
      System Location Discovery: System Language Discovery
      PID:2948
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "------"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2964
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "
      4⤵
      System Location Discovery: System Language Discovery
      PID:2908
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "domain"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2360
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "
      4⤵
      System Location Discovery: System Language Discovery
      PID:1208
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "¬A╛╣"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1708
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "
      4⤵
      System Location Discovery: System Language Discovery
      PID:2148
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "░⌡ªµª¿"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2508
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "
      4⤵
      System Location Discovery: System Language Discovery
      PID:2176
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "├ⁿ┴ε"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1952
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "
      4⤵
      System Location Discovery: System Language Discovery
      PID:2192
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "completed successfully"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2232
  - - C:\Windows\SysWOW64\net.exe
      net view /domain:WORKGROUP
      4⤵
      System Location Discovery: System Language Discovery
      Discovers systems in the same network
      PID:1604
  - - C:\Windows\SysWOW64\cscript.exe
      cscript //nologo C:\Users\Admin\AppData\Local\Temp\driver.vbs
      4⤵
      System Location Discovery: System Language Discovery
      PID:620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\INFO.TXT

Filesize
27B

MD5
86debc1710d97538f07a41acb10fa45d

SHA1
d472172201a1a9e747fb895f71c4ec80aebc5640

SHA256
8b5051f4cff692b4d6725aa153b7ed5ae8377d24094ff676a46724ecbbd2a73a

SHA512
8ab60ff8f1f577fab6eea45a0e860af765c2b0309c2f1ada9ec54104a7a468ee4e0a0dfd1ab07d753e6bdbcae3c42d9656dc2b222d400e9eff20b692ec04bf5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\INFO.TXT

Filesize
7KB

MD5
e8137beb65a381786676358d8204c5ba

SHA1
8b9b6c9b3c697182e816bdd55f9dd76f2d3b992c

SHA256
c0af8bea8727d5d1eded16651aec68662ff2b75933bbb9a175d9a7fbed3e0a38

SHA512
6c9bb75ade1e7f5b8a62e7687e37bc037c158c7bac7985c1db465b8e46b0ff7ff32c93757babbc82985256af9d91976bc38c6f19618146cccb24dcd6c4150b10

Download Submit
C:\Users\Admin\AppData\Local\Temp\INFO.TXT

Filesize
24.9MB

MD5
e0da1684736a1674e3a8ef0c0d90585d

SHA1
83db1d1f7d0536d47280b35ee0ccf12c2cdc0350

SHA256
3a7d3c91b5325b8f024076e04bd103a9ba7ce5e094af414257f50e98b8ffe21a

SHA512
d5aa553f8be9638e8c6b0fc529fd5e6af039b086f96301c7cbc792a6e721207fa202a0b5c7bdaaecb2b5129f1affc18539ba7a648ffdc13331c86a6200d18d30

Download Submit
C:\Users\Admin\AppData\Local\Temp\driver.vbs

Filesize
144B

MD5
63c6ef2e82ca74d5ca64af80399aaa14

SHA1
5f367533efb1b5a0c0537ae88be1a26e2525d2bd

SHA256
7b5b3e108d7fcde0ec1c3c158d1b6f686ff16ddb32efb8dee6276286fad9786a

SHA512
5e0afce466c9715a1bb1fb00dd73e18d35612ecd52ecf31c9625b0aa3e207bcd158af39a9267b26499bf9fccd5d35d8edd02e1f19feada2a648740e14317fb66

Download Submit
C:\Users\Admin\AppData\Local\Temp\ghi.bat

Filesize
2KB

MD5
f5771c60cb37a775b052bc018282c633

SHA1
8c9176b503d60b2e01fecf955b1d58e0ab020347

SHA256
8384d709b30e48e6d4d5065eea6e9e9f7950adeee06ef454f95acfcf03d1b14a

SHA512
eed1bf75de140cf548b9d147a230533573b8a76f2a10ddbd9c810fd4f1e6d14900361c4c48fc18432d03a626981dff160fb31a6d5d19f6702d31221e802a8455

Download Submit
C:\Users\Admin\AppData\Local\Temp\s.log

Filesize
153B

MD5
b256c8a481b065860c2812e742f50250

SHA1
51ddf02764fb12d88822450e8a27f9deac85fe54

SHA256
b167a692a2ff54cc5625797ddc367ba8736797130b93961d68b9150aef2f0e12

SHA512
f425ae70449d16bdb05fcc7913744fb0a81ab81278735d77ce316007b8298ad3c3991a29af67b336420f7dca94702271e59186174b5b78b5cdab1f8ce0163360

Download Submit
C:\Users\Admin\AppData\Local\Temp\s.log

Filesize
64B

MD5
e29f80bf6f6a756e0bc6d7f5189a9bb2

SHA1
acdd1032b7dc189f8e68b390fe6fd964618acd72

SHA256
8bfe9f81e5c82cbfe69203c993009c22f940f20727fa8cb43773958bf0eba7c7

SHA512
f390fc82bdeb43721aa08f3666a4ed7d9ad4a5c1ff91be6967336417a5a5b7968b945773f68effcbe961072b801c3681455cf98b956cd802eba24190bd54268e

Download Submit
C:\Users\Admin\AppData\Local\Temp\t.log

Filesize
72B

MD5
59f2768506355d8bc50979f6d64ded26

SHA1
b2d315b3857bec8335c526a08d08d6a1b5f5c151

SHA256
7f9f3cbab32b3a5022bed245092835cb12502fa2e79d85c8c45d478918ee6569

SHA512
e9aa231d19cb5f93711cd3ffee4a6bd8764b21249ed7eb06ff34bcb457cd075384a0858ea35a99280bff16c01875a4ed79598a6503fcf5262da6f0849b5b1028

Download Submit
\ProgramData\winmgmt.exe

Filesize
96KB

MD5
532f798fe6c66eab33258b0f0451826e

SHA1
9aa0f8b76649583343a307a4ccbdae26ab6e0d13

SHA256
cf880ad15b38faf97af44063945da6b8eca4f78624b799b595e73d653ca829e3

SHA512
a866589c1a188151fa11fd2a3c39e05a1951ce984e80589fa5d44e30d50c0bd852ba37fc523915d2ce1e0cd611776a0b26333fafaa870dc675f9c20c40930c86

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads