Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-10-2024 07:12
Static task
static1
Behavioral task
behavioral1
Sample
5b7184b825866b331b646b976e52165d_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5b7184b825866b331b646b976e52165d_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
5b7184b825866b331b646b976e52165d_JaffaCakes118.exe
-
Size
1.8MB
-
MD5
5b7184b825866b331b646b976e52165d
-
SHA1
e88407cfb398a23e65113fdaa763e924f0da3819
-
SHA256
312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b
-
SHA512
521f667d961b6a703a5230fe52165eb3866527f4542e75b81756fb003a309e60929983e24707e3b7a52ad8ff24edbb5414199d53ca48b59145da4e5b80155f29
-
SSDEEP
49152:4gjblslEu5zl4Yb9jUefS89Zg1aOGIC+kM:4g3i15VVUMZg1aOan
Malware Config
Signatures
-
Luminosity 2 IoCs
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
description ioc pid Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5b7184b825866b331b646b976e52165d_JaffaCakes118.exe 4880 schtasks.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 5b7184b825866b331b646b976e52165d_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
pid Process 2372 tsmgr.exe 1812 notepad.exe -
Adds Run key to start application 2 TTPs 21 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\"" REG.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini 5b7184b825866b331b646b976e52165d_JaffaCakes118.exe File opened for modification C:\Windows\assembly\Desktop.ini 5b7184b825866b331b646b976e52165d_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1556 set thread context of 1812 1556 5b7184b825866b331b646b976e52165d_JaffaCakes118.exe 103 -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly 5b7184b825866b331b646b976e52165d_JaffaCakes118.exe File created C:\Windows\assembly\Desktop.ini 5b7184b825866b331b646b976e52165d_JaffaCakes118.exe File opened for modification C:\Windows\assembly\Desktop.ini 5b7184b825866b331b646b976e52165d_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 27 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5b7184b825866b331b646b976e52165d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tsmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4880 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1556 5b7184b825866b331b646b976e52165d_JaffaCakes118.exe 1556 5b7184b825866b331b646b976e52165d_JaffaCakes118.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe 2372 tsmgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1556 5b7184b825866b331b646b976e52165d_JaffaCakes118.exe Token: SeDebugPrivilege 2372 tsmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2372 tsmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1556 wrote to memory of 2372 1556 5b7184b825866b331b646b976e52165d_JaffaCakes118.exe 97 PID 1556 wrote to memory of 2372 1556 5b7184b825866b331b646b976e52165d_JaffaCakes118.exe 97 PID 1556 wrote to memory of 2372 1556 5b7184b825866b331b646b976e52165d_JaffaCakes118.exe 97 PID 1556 wrote to memory of 2540 1556 5b7184b825866b331b646b976e52165d_JaffaCakes118.exe 100 PID 1556 wrote to memory of 2540 1556 5b7184b825866b331b646b976e52165d_JaffaCakes118.exe 100 PID 1556 wrote to memory of 2540 1556 5b7184b825866b331b646b976e52165d_JaffaCakes118.exe 100 PID 2540 wrote to memory of 3020 2540 cmd.exe 102 PID 2540 wrote to memory of 3020 2540 cmd.exe 102 PID 2540 wrote to memory of 3020 2540 cmd.exe 102 PID 1556 wrote to memory of 1812 1556 5b7184b825866b331b646b976e52165d_JaffaCakes118.exe 103 PID 1556 wrote to memory of 1812 1556 5b7184b825866b331b646b976e52165d_JaffaCakes118.exe 103 PID 1556 wrote to memory of 1812 1556 5b7184b825866b331b646b976e52165d_JaffaCakes118.exe 103 PID 1556 wrote to memory of 1812 1556 5b7184b825866b331b646b976e52165d_JaffaCakes118.exe 103 PID 1556 wrote to memory of 1812 1556 5b7184b825866b331b646b976e52165d_JaffaCakes118.exe 103 PID 1556 wrote to memory of 1812 1556 5b7184b825866b331b646b976e52165d_JaffaCakes118.exe 103 PID 1556 wrote to memory of 1812 1556 5b7184b825866b331b646b976e52165d_JaffaCakes118.exe 103 PID 1556 wrote to memory of 1812 1556 5b7184b825866b331b646b976e52165d_JaffaCakes118.exe 103 PID 2372 wrote to memory of 3380 2372 tsmgr.exe 104 PID 2372 wrote to memory of 3380 2372 tsmgr.exe 104 PID 2372 wrote to memory of 3380 2372 tsmgr.exe 104 PID 2372 wrote to memory of 4880 2372 tsmgr.exe 110 PID 2372 wrote to memory of 4880 2372 tsmgr.exe 110 PID 2372 wrote to memory of 4880 2372 tsmgr.exe 110 PID 2372 wrote to memory of 1896 2372 tsmgr.exe 112 PID 2372 wrote to memory of 1896 2372 tsmgr.exe 112 PID 2372 wrote to memory of 1896 2372 tsmgr.exe 112 PID 2372 wrote to memory of 2244 2372 tsmgr.exe 114 PID 2372 wrote to memory of 2244 2372 tsmgr.exe 114 PID 2372 wrote to memory of 2244 2372 tsmgr.exe 114 PID 2372 wrote to memory of 2692 2372 tsmgr.exe 116 PID 2372 wrote to memory of 2692 2372 tsmgr.exe 116 PID 2372 wrote to memory of 2692 2372 tsmgr.exe 116 PID 2372 wrote to memory of 1656 2372 tsmgr.exe 118 PID 2372 wrote to memory of 1656 2372 tsmgr.exe 118 PID 2372 wrote to memory of 1656 2372 tsmgr.exe 118 PID 2372 wrote to memory of 2200 2372 tsmgr.exe 121 PID 2372 wrote to memory of 2200 2372 tsmgr.exe 121 PID 2372 wrote to memory of 2200 2372 tsmgr.exe 121 PID 2372 wrote to memory of 3456 2372 tsmgr.exe 123 PID 2372 wrote to memory of 3456 2372 tsmgr.exe 123 PID 2372 wrote to memory of 3456 2372 tsmgr.exe 123 PID 2372 wrote to memory of 2400 2372 tsmgr.exe 125 PID 2372 wrote to memory of 2400 2372 tsmgr.exe 125 PID 2372 wrote to memory of 2400 2372 tsmgr.exe 125 PID 2372 wrote to memory of 3312 2372 tsmgr.exe 127 PID 2372 wrote to memory of 3312 2372 tsmgr.exe 127 PID 2372 wrote to memory of 3312 2372 tsmgr.exe 127 PID 2372 wrote to memory of 2948 2372 tsmgr.exe 129 PID 2372 wrote to memory of 2948 2372 tsmgr.exe 129 PID 2372 wrote to memory of 2948 2372 tsmgr.exe 129 PID 2372 wrote to memory of 2536 2372 tsmgr.exe 131 PID 2372 wrote to memory of 2536 2372 tsmgr.exe 131 PID 2372 wrote to memory of 2536 2372 tsmgr.exe 131 PID 2372 wrote to memory of 3872 2372 tsmgr.exe 138 PID 2372 wrote to memory of 3872 2372 tsmgr.exe 138 PID 2372 wrote to memory of 3872 2372 tsmgr.exe 138 PID 2372 wrote to memory of 4004 2372 tsmgr.exe 144 PID 2372 wrote to memory of 4004 2372 tsmgr.exe 144 PID 2372 wrote to memory of 4004 2372 tsmgr.exe 144 PID 2372 wrote to memory of 4520 2372 tsmgr.exe 146 PID 2372 wrote to memory of 4520 2372 tsmgr.exe 146 PID 2372 wrote to memory of 4520 2372 tsmgr.exe 146 PID 2372 wrote to memory of 5060 2372 tsmgr.exe 148 PID 2372 wrote to memory of 5060 2372 tsmgr.exe 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b7184b825866b331b646b976e52165d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5b7184b825866b331b646b976e52165d_JaffaCakes118.exe"1⤵
- Luminosity
- Checks computer location settings
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\tsmgr.exe"C:\Users\Admin\AppData\Local\Temp\tsmgr.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3380
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /NP /sc onlogon /tn "Client Monitor" /rl highest /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f3⤵
- Luminosity
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4880
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1896
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2244
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2692
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1656
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2200
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3456
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2400
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3312
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2948
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2536
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3872
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4004
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4520
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5060
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1556
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3096
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1500
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2420
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:428
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:643⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3888
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\tsmgr.exe.lnk " /f3⤵
- System Location Discovery: System Language Discovery
PID:3020
-
-
-
C:\Users\Admin\AppData\Local\Temp\notepad.exe"C:\Users\Admin\AppData\Local\Temp\notepad.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1812
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD55b7184b825866b331b646b976e52165d
SHA1e88407cfb398a23e65113fdaa763e924f0da3819
SHA256312e16e72dcedac92740dfff0b3b2a6e33640b2568acd2be827cec18e483710b
SHA512521f667d961b6a703a5230fe52165eb3866527f4542e75b81756fb003a309e60929983e24707e3b7a52ad8ff24edbb5414199d53ca48b59145da4e5b80155f29
-
Filesize
52KB
MD5a64daca3cfbcd039df3ec29d3eddd001
SHA1eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3
SHA256403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36
SHA512b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479
-
Filesize
857KB
MD5bc6529f2a93dd5eb328963e0b41a855a
SHA10d3fe448baa8a886fd33541f17e893a8a550640f
SHA256b98c711a375f39574672d49fdb798e70dab73b56c5a605c2cfd55a82d8d1b528
SHA5124b50bc0de71bdbdbe76622d498d70b940e11a5c34b6d58b43765eacb2447d3106da3ac80f3a20e7eed67598bf9875cda9646694724b8fae6d91a7ed97b0bad73