cf880ad15b38faf97af44063945da6b8eca4f78624b799b595e73d653ca829e3

Analysis

max time kernel
140s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-10-2024 18:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

532f798fe6c66eab33258b0f0451826e_JaffaCakes118.exe
Size

96KB
MD5

532f798fe6c66eab33258b0f0451826e
SHA1

9aa0f8b76649583343a307a4ccbdae26ab6e0d13
SHA256

cf880ad15b38faf97af44063945da6b8eca4f78624b799b595e73d653ca829e3
SHA512

a866589c1a188151fa11fd2a3c39e05a1951ce984e80589fa5d44e30d50c0bd852ba37fc523915d2ce1e0cd611776a0b26333fafaa870dc675f9c20c40930c86
SSDEEP

1536:W9JGlcQQ/mw4syoqCM8UB6dHGO8+3tjgHJ2+y+s+rRJWicMgwqQB+L:W9glcfmw4syGpUsdHGOh3tsH4ms6JWi8

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run	532f798fe6c66eab33258b0f0451826e_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wmi32 = "C:\\ProgramData\\Application Data\\winmgmt.exe"	532f798fe6c66eab33258b0f0451826e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	532f798fe6c66eab33258b0f0451826e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wmi32 = "C:\\ProgramData\\Application Data\\winmgmt.exe"	532f798fe6c66eab33258b0f0451826e_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
380	winmgmt.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	winmgmt.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3232	ARP.EXE

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
3064	tasklist.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 46 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	532f798fe6c66eab33258b0f0451826e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ARP.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winmgmt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ROUTE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
1644	NETSTAT.EXE

Discovers systems in the same network 1 TTPs 1 IoCs

discovery

Remote System Discovery

T1018

pid	Process
4728	net.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1620	ipconfig.exe
1644	NETSTAT.EXE
2496	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
216	systeminfo.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3064	tasklist.exe
Token: SeDebugPrivilege	1644	NETSTAT.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 380	3856	532f798fe6c66eab33258b0f0451826e_JaffaCakes118.exe	84
PID 3856 wrote to memory of 380	3856	532f798fe6c66eab33258b0f0451826e_JaffaCakes118.exe	84
PID 3856 wrote to memory of 380	3856	532f798fe6c66eab33258b0f0451826e_JaffaCakes118.exe	84
PID 380 wrote to memory of 4036	380	winmgmt.exe	93
PID 380 wrote to memory of 4036	380	winmgmt.exe	93
PID 380 wrote to memory of 4036	380	winmgmt.exe	93
PID 4036 wrote to memory of 5060	4036	cmd.exe	95
PID 4036 wrote to memory of 5060	4036	cmd.exe	95
PID 4036 wrote to memory of 5060	4036	cmd.exe	95
PID 4036 wrote to memory of 2760	4036	cmd.exe	96
PID 4036 wrote to memory of 2760	4036	cmd.exe	96
PID 4036 wrote to memory of 2760	4036	cmd.exe	96
PID 4036 wrote to memory of 4704	4036	cmd.exe	97
PID 4036 wrote to memory of 4704	4036	cmd.exe	97
PID 4036 wrote to memory of 4704	4036	cmd.exe	97
PID 4704 wrote to memory of 1344	4704	net.exe	98
PID 4704 wrote to memory of 1344	4704	net.exe	98
PID 4704 wrote to memory of 1344	4704	net.exe	98
PID 4036 wrote to memory of 3060	4036	cmd.exe	99
PID 4036 wrote to memory of 3060	4036	cmd.exe	99
PID 4036 wrote to memory of 3060	4036	cmd.exe	99
PID 3060 wrote to memory of 4460	3060	net.exe	100
PID 3060 wrote to memory of 4460	3060	net.exe	100
PID 3060 wrote to memory of 4460	3060	net.exe	100
PID 4036 wrote to memory of 3064	4036	cmd.exe	101
PID 4036 wrote to memory of 3064	4036	cmd.exe	101
PID 4036 wrote to memory of 3064	4036	cmd.exe	101
PID 4036 wrote to memory of 216	4036	cmd.exe	103
PID 4036 wrote to memory of 216	4036	cmd.exe	103
PID 4036 wrote to memory of 216	4036	cmd.exe	103
PID 4036 wrote to memory of 4516	4036	cmd.exe	106
PID 4036 wrote to memory of 4516	4036	cmd.exe	106
PID 4036 wrote to memory of 4516	4036	cmd.exe	106
PID 4036 wrote to memory of 1852	4036	cmd.exe	107
PID 4036 wrote to memory of 1852	4036	cmd.exe	107
PID 4036 wrote to memory of 1852	4036	cmd.exe	107
PID 4036 wrote to memory of 3004	4036	cmd.exe	109
PID 4036 wrote to memory of 3004	4036	cmd.exe	109
PID 4036 wrote to memory of 3004	4036	cmd.exe	109
PID 4036 wrote to memory of 4084	4036	cmd.exe	110
PID 4036 wrote to memory of 4084	4036	cmd.exe	110
PID 4036 wrote to memory of 4084	4036	cmd.exe	110
PID 4036 wrote to memory of 4552	4036	cmd.exe	111
PID 4036 wrote to memory of 4552	4036	cmd.exe	111
PID 4036 wrote to memory of 4552	4036	cmd.exe	111
PID 4036 wrote to memory of 1828	4036	cmd.exe	112
PID 4036 wrote to memory of 1828	4036	cmd.exe	112
PID 4036 wrote to memory of 1828	4036	cmd.exe	112
PID 4036 wrote to memory of 4616	4036	cmd.exe	113
PID 4036 wrote to memory of 4616	4036	cmd.exe	113
PID 4036 wrote to memory of 4616	4036	cmd.exe	113
PID 4036 wrote to memory of 60	4036	cmd.exe	114
PID 4036 wrote to memory of 60	4036	cmd.exe	114
PID 4036 wrote to memory of 60	4036	cmd.exe	114
PID 4036 wrote to memory of 628	4036	cmd.exe	115
PID 4036 wrote to memory of 628	4036	cmd.exe	115
PID 4036 wrote to memory of 628	4036	cmd.exe	115
PID 4036 wrote to memory of 1620	4036	cmd.exe	116
PID 4036 wrote to memory of 1620	4036	cmd.exe	116
PID 4036 wrote to memory of 1620	4036	cmd.exe	116
PID 4036 wrote to memory of 1644	4036	cmd.exe	117
PID 4036 wrote to memory of 1644	4036	cmd.exe	117
PID 4036 wrote to memory of 1644	4036	cmd.exe	117
PID 4036 wrote to memory of 3232	4036	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\532f798fe6c66eab33258b0f0451826e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\532f798fe6c66eab33258b0f0451826e_JaffaCakes118.exe"
1⤵
- Adds policy Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3856
- C:\ProgramData\Application Data\winmgmt.exe
  "C:\ProgramData\Application Data\winmgmt.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:380
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ghi.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4036
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /s "YM.CGP_" "C:\Users\Admin"\..\*.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:5060
  - - C:\Windows\SysWOW64\chcp.com
      chcp
      4⤵
      System Location Discovery: System Language Discovery
      PID:2760
  - - C:\Windows\SysWOW64\net.exe
      net user
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4704
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1344
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3060
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4460
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3064
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:216
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4516
  - - C:\Windows\SysWOW64\find.exe
      find "REG_"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1852
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office
      4⤵
      System Location Discovery: System Language Discovery
      PID:3004
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Common\UserInfo
      4⤵
      System Location Discovery: System Language Discovery
      PID:4084
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Common\UserInfo
      4⤵
      System Location Discovery: System Language Discovery
      PID:4552
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Common\UserInfo
      4⤵
      System Location Discovery: System Language Discovery
      PID:1828
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Common\UserInfo
      4⤵
      System Location Discovery: System Language Discovery
      PID:4616
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\UserInfo
      4⤵
      System Location Discovery: System Language Discovery
      PID:60
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Common\UserInfo
      4⤵
      System Location Discovery: System Language Discovery
      PID:628
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /all
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      PID:1620
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      netstat -ano
      4⤵
      System Location Discovery: System Language Discovery
      System Network Connections Discovery
      Gathers network information
      Suspicious use of AdjustPrivilegeToken
      PID:1644
  - - C:\Windows\SysWOW64\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      System Location Discovery: System Language Discovery
      PID:3232
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      netstat -r
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      PID:2496
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:964
      - C:\Windows\SysWOW64\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4352
  - - C:\Windows\SysWOW64\net.exe
      net start
      4⤵
      System Location Discovery: System Language Discovery
      PID:4544
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1800
  - - C:\Windows\SysWOW64\net.exe
      net use
      4⤵
      System Location Discovery: System Language Discovery
      PID:3924
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo n"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2520
  - - C:\Windows\SysWOW64\net.exe
      net share
      4⤵
      System Location Discovery: System Language Discovery
      PID:4480
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 share
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4676
  - - C:\Windows\SysWOW64\net.exe
      net view /domain
      4⤵
      System Location Discovery: System Language Discovery
      Discovers systems in the same network
      PID:4728
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "
      4⤵
      System Location Discovery: System Language Discovery
      PID:3856
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "------"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4556
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "
      4⤵
      System Location Discovery: System Language Discovery
      PID:1056
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "domain"
      4⤵
      System Location Discovery: System Language Discovery
      PID:460
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "
      4⤵
      System Location Discovery: System Language Discovery
      PID:1120
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "¬A╛╣"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2740
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "
      4⤵
      System Location Discovery: System Language Discovery
      PID:4832
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "░⌡ªµª¿"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4044
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "
      4⤵
      System Location Discovery: System Language Discovery
      PID:2332
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "├ⁿ┴ε"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4292
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "
      4⤵
      System Location Discovery: System Language Discovery
      PID:4932
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "completed successfully"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4572
  - - C:\Windows\SysWOW64\cscript.exe
      cscript //nologo C:\Users\Admin\AppData\Local\Temp\driver.vbs
      4⤵
      System Location Discovery: System Language Discovery
      PID:3576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\winmgmt.exe

Filesize
96KB

MD5
532f798fe6c66eab33258b0f0451826e

SHA1
9aa0f8b76649583343a307a4ccbdae26ab6e0d13

SHA256
cf880ad15b38faf97af44063945da6b8eca4f78624b799b595e73d653ca829e3

SHA512
a866589c1a188151fa11fd2a3c39e05a1951ce984e80589fa5d44e30d50c0bd852ba37fc523915d2ce1e0cd611776a0b26333fafaa870dc675f9c20c40930c86

Download Submit
C:\Users\Admin\AppData\Local\Temp\INFO.TXT

Filesize
27B

MD5
86debc1710d97538f07a41acb10fa45d

SHA1
d472172201a1a9e747fb895f71c4ec80aebc5640

SHA256
8b5051f4cff692b4d6725aa153b7ed5ae8377d24094ff676a46724ecbbd2a73a

SHA512
8ab60ff8f1f577fab6eea45a0e860af765c2b0309c2f1ada9ec54104a7a468ee4e0a0dfd1ab07d753e6bdbcae3c42d9656dc2b222d400e9eff20b692ec04bf5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\INFO.TXT

Filesize
12KB

MD5
325328aec79dd8e9fd5f4c827dee35e7

SHA1
0cac9a2ded01033983c50f6d55aba1888feffcd7

SHA256
c91600ded331f318d1d2ce57b20c6d1ab11a6a5ad74304e0e1ba02fb4ad6f87f

SHA512
1d78c0c7b2f4a4b45109436ccb3b0d2774a249c58455165962798564428c2a09ca8d5f481ea8538765f8933509b23c564b9a66a16661d906eccd00b9794be41a

Download Submit
C:\Users\Admin\AppData\Local\Temp\INFO.TXT

Filesize
37.8MB

MD5
d1abc71c669b09d5ae7b8904430e40b8

SHA1
09bf719542c0d11aba7453e5425d7c4e15026b3c

SHA256
b6ed2f7d401ceeb747cb4d882759328787f46d25a9f23ad640142b65e62c6f2d

SHA512
aed8d06ab158de79937a430c4f351c96f52e4d7413bcd5d65a98a19262ebdc5e4e8f9ce932ef949ef054847db86cc13327aae04f41d5e96943b5ce98a75f15cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\driver.vbs

Filesize
144B

MD5
63c6ef2e82ca74d5ca64af80399aaa14

SHA1
5f367533efb1b5a0c0537ae88be1a26e2525d2bd

SHA256
7b5b3e108d7fcde0ec1c3c158d1b6f686ff16ddb32efb8dee6276286fad9786a

SHA512
5e0afce466c9715a1bb1fb00dd73e18d35612ecd52ecf31c9625b0aa3e207bcd158af39a9267b26499bf9fccd5d35d8edd02e1f19feada2a648740e14317fb66

Download Submit
C:\Users\Admin\AppData\Local\Temp\ghi.bat

Filesize
2KB

MD5
f5771c60cb37a775b052bc018282c633

SHA1
8c9176b503d60b2e01fecf955b1d58e0ab020347

SHA256
8384d709b30e48e6d4d5065eea6e9e9f7950adeee06ef454f95acfcf03d1b14a

SHA512
eed1bf75de140cf548b9d147a230533573b8a76f2a10ddbd9c810fd4f1e6d14900361c4c48fc18432d03a626981dff160fb31a6d5d19f6702d31221e802a8455

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads