Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02-11-2024 19:51
Static task
static1
Behavioral task
behavioral1
Sample
8765c39cc6647adc171220b11942422b_JaffaCakes118.exe
Resource
win7-20241010-en
General
-
Target
8765c39cc6647adc171220b11942422b_JaffaCakes118.exe
-
Size
3.3MB
-
MD5
8765c39cc6647adc171220b11942422b
-
SHA1
5a45fd626dcf26b1f933e5a18db138fe1df64444
-
SHA256
f52e34603c58c806081a09fc4ba38eabe1e3f12b7a57a75353ecf593177fa7ef
-
SHA512
8c5bf35e5d6dc7aab1bff4836ef00e44d7e158d4b8d3f9bcf9ebb39a02b21078c5879f061ac926aa52b9a0f9a83752f322db1d98c1a2908a9ec5eed60919fa65
-
SSDEEP
98304:xpeKfE9KlGB9z8qTsF5iOew3qrCvLUBsKxp:x8/9HHoGDQLUCKxp
Malware Config
Extracted
nullmixer
http://znegs.xyz/
Signatures
-
Nullmixer family
-
Vidar family
-
Vidar Stealer 2 IoCs
resource yara_rule behavioral2/memory/5052-162-0x0000000000400000-0x0000000002CC2000-memory.dmp family_vidar behavioral2/memory/5052-215-0x0000000000400000-0x0000000002CC2000-memory.dmp family_vidar -
resource yara_rule behavioral2/files/0x0007000000023cbf-32.dat aspack_v212_v242 behavioral2/files/0x0007000000023cbb-39.dat aspack_v212_v242 behavioral2/files/0x0007000000023cbd-47.dat aspack_v212_v242 behavioral2/files/0x0007000000023cba-42.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation 8765c39cc6647adc171220b11942422b_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation zaiqa_1.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation zaiqa_4.exe -
Executes dropped EXE 14 IoCs
pid Process 2308 setup_install.exe 572 zaiqa_1.exe 780 zaiqa_2.exe 5052 zaiqa_3.exe 4820 zaiqa_4.exe 1484 zaiqa_5.exe 2684 zaiqa_6.exe 4524 zaiqa_7.exe 2240 zaiqa_9.exe 5088 zaiqa_8.exe 4728 zaiqa_1.exe 4716 chrome2.exe 4664 setup.exe 2332 winnetdriv.exe -
Loads dropped DLL 5 IoCs
pid Process 2308 setup_install.exe 2308 setup_install.exe 2308 setup_install.exe 2308 setup_install.exe 2308 setup_install.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 25 iplogger.org 26 iplogger.org 27 iplogger.org -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 17 api.db-ip.com 9 ipinfo.io 11 ipinfo.io 16 api.db-ip.com -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\winnetdriv.exe setup.exe File opened for modification C:\Windows\winnetdriv.exe setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
pid pid_target Process procid_target 2316 2308 WerFault.exe 87 2680 780 WerFault.exe 100 1728 5052 WerFault.exe 101 2488 5052 WerFault.exe 101 -
System Location Discovery: System Language Discovery 1 TTPs 18 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zaiqa_3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zaiqa_1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zaiqa_2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zaiqa_4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zaiqa_7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8765c39cc6647adc171220b11942422b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zaiqa_1.exe -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI zaiqa_2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI zaiqa_2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI zaiqa_2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 zaiqa_3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString zaiqa_3.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe -
Modifies data under HKEY_USERS 19 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5052 zaiqa_3.exe 5052 zaiqa_3.exe 5052 zaiqa_3.exe 5052 zaiqa_3.exe 5052 zaiqa_3.exe 5052 zaiqa_3.exe 5052 zaiqa_3.exe 5052 zaiqa_3.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 5088 zaiqa_8.exe Token: SeDebugPrivilege 2684 zaiqa_6.exe Token: SeCreateGlobalPrivilege 2528 dwm.exe Token: SeChangeNotifyPrivilege 2528 dwm.exe Token: 33 2528 dwm.exe Token: SeIncBasePriorityPrivilege 2528 dwm.exe Token: SeCreateGlobalPrivilege 3160 dwm.exe Token: SeChangeNotifyPrivilege 3160 dwm.exe Token: 33 3160 dwm.exe Token: SeIncBasePriorityPrivilege 3160 dwm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1268 wrote to memory of 2308 1268 8765c39cc6647adc171220b11942422b_JaffaCakes118.exe 87 PID 1268 wrote to memory of 2308 1268 8765c39cc6647adc171220b11942422b_JaffaCakes118.exe 87 PID 1268 wrote to memory of 2308 1268 8765c39cc6647adc171220b11942422b_JaffaCakes118.exe 87 PID 2308 wrote to memory of 3940 2308 setup_install.exe 122 PID 2308 wrote to memory of 3940 2308 setup_install.exe 122 PID 2308 wrote to memory of 3940 2308 setup_install.exe 122 PID 2308 wrote to memory of 4292 2308 setup_install.exe 91 PID 2308 wrote to memory of 4292 2308 setup_install.exe 91 PID 2308 wrote to memory of 4292 2308 setup_install.exe 91 PID 2308 wrote to memory of 4632 2308 setup_install.exe 92 PID 2308 wrote to memory of 4632 2308 setup_install.exe 92 PID 2308 wrote to memory of 4632 2308 setup_install.exe 92 PID 2308 wrote to memory of 8 2308 setup_install.exe 93 PID 2308 wrote to memory of 8 2308 setup_install.exe 93 PID 2308 wrote to memory of 8 2308 setup_install.exe 93 PID 2308 wrote to memory of 5096 2308 setup_install.exe 94 PID 2308 wrote to memory of 5096 2308 setup_install.exe 94 PID 2308 wrote to memory of 5096 2308 setup_install.exe 94 PID 2308 wrote to memory of 3236 2308 setup_install.exe 95 PID 2308 wrote to memory of 3236 2308 setup_install.exe 95 PID 2308 wrote to memory of 3236 2308 setup_install.exe 95 PID 2308 wrote to memory of 3588 2308 setup_install.exe 96 PID 2308 wrote to memory of 3588 2308 setup_install.exe 96 PID 2308 wrote to memory of 3588 2308 setup_install.exe 96 PID 2308 wrote to memory of 3560 2308 setup_install.exe 97 PID 2308 wrote to memory of 3560 2308 setup_install.exe 97 PID 2308 wrote to memory of 3560 2308 setup_install.exe 97 PID 2308 wrote to memory of 4868 2308 setup_install.exe 98 PID 2308 wrote to memory of 4868 2308 setup_install.exe 98 PID 2308 wrote to memory of 4868 2308 setup_install.exe 98 PID 3940 wrote to memory of 572 3940 cmd.exe 99 PID 3940 wrote to memory of 572 3940 cmd.exe 99 PID 3940 wrote to memory of 572 3940 cmd.exe 99 PID 4292 wrote to memory of 780 4292 cmd.exe 100 PID 4292 wrote to memory of 780 4292 cmd.exe 100 PID 4292 wrote to memory of 780 4292 cmd.exe 100 PID 4632 wrote to memory of 5052 4632 cmd.exe 101 PID 4632 wrote to memory of 5052 4632 cmd.exe 101 PID 4632 wrote to memory of 5052 4632 cmd.exe 101 PID 8 wrote to memory of 4820 8 cmd.exe 102 PID 8 wrote to memory of 4820 8 cmd.exe 102 PID 8 wrote to memory of 4820 8 cmd.exe 102 PID 5096 wrote to memory of 1484 5096 cmd.exe 103 PID 5096 wrote to memory of 1484 5096 cmd.exe 103 PID 3236 wrote to memory of 2684 3236 cmd.exe 104 PID 3236 wrote to memory of 2684 3236 cmd.exe 104 PID 3560 wrote to memory of 5088 3560 cmd.exe 106 PID 3560 wrote to memory of 5088 3560 cmd.exe 106 PID 3588 wrote to memory of 4524 3588 cmd.exe 107 PID 3588 wrote to memory of 4524 3588 cmd.exe 107 PID 3588 wrote to memory of 4524 3588 cmd.exe 107 PID 4868 wrote to memory of 2240 4868 cmd.exe 109 PID 4868 wrote to memory of 2240 4868 cmd.exe 109 PID 572 wrote to memory of 4728 572 zaiqa_1.exe 111 PID 572 wrote to memory of 4728 572 zaiqa_1.exe 111 PID 572 wrote to memory of 4728 572 zaiqa_1.exe 111 PID 4820 wrote to memory of 4716 4820 zaiqa_4.exe 113 PID 4820 wrote to memory of 4716 4820 zaiqa_4.exe 113 PID 4820 wrote to memory of 4664 4820 zaiqa_4.exe 114 PID 4820 wrote to memory of 4664 4820 zaiqa_4.exe 114 PID 4820 wrote to memory of 4664 4820 zaiqa_4.exe 114 PID 4664 wrote to memory of 2332 4664 setup.exe 115 PID 4664 wrote to memory of 2332 4664 setup.exe 115 PID 4664 wrote to memory of 2332 4664 setup.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\8765c39cc6647adc171220b11942422b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8765c39cc6647adc171220b11942422b_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c zaiqa_1.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_1.exezaiqa_1.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_1.exe"C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_1.exe" -a5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4728
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c zaiqa_2.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_2.exezaiqa_2.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:780 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 3605⤵
- Program crash
PID:2680
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c zaiqa_3.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_3.exezaiqa_3.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:5052 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 19925⤵
- Program crash
PID:1728
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 19845⤵
- Program crash
PID:2488
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c zaiqa_4.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_4.exezaiqa_4.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\chrome2.exe"C:\Users\Admin\AppData\Local\Temp\chrome2.exe"5⤵
- Executes dropped EXE
PID:4716
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\winnetdriv.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe" 1730578621 06⤵
- Executes dropped EXE
PID:2332
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c zaiqa_5.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_5.exezaiqa_5.exe4⤵
- Executes dropped EXE
PID:1484
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c zaiqa_6.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_6.exezaiqa_6.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c zaiqa_7.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_7.exezaiqa_7.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4524
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c zaiqa_8.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_8.exezaiqa_8.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5088
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c zaiqa_9.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\7zS4F4CEBC7\zaiqa_9.exezaiqa_9.exe4⤵
- Executes dropped EXE
PID:2240
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 5603⤵
- Program crash
PID:2316
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2308 -ip 23081⤵PID:4972
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 780 -ip 7801⤵PID:1728
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2528
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3160
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:3940
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5052 -ip 50521⤵PID:2368
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5052 -ip 50521⤵PID:3896
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
275B
MD5a378c450e6ad9f1e0356ed46da190990
SHA1d457a2c162391d2ea30ec2dc62c8fb3b973f6a66
SHA256b745b0c0db87a89de5e542e9ae0a06f585793ac3f4240bff3524e7dbdba79978
SHA512e6cdc8f570af97e48b1d8968730db0afc46f9dd6ad7366a936a5518801debb61c86cc61526e5e26e7ad3b3daeb76a19b32d7c0da33140597f6d19163683c12b5
-
Filesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
Filesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
Filesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
Filesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
Filesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
Filesize
287KB
MD5a52a590e1f8f93cd1d4108293415975c
SHA149db2a15b6f32c6189f24a8ae6e4bb33d0485f05
SHA25612d2f007dcc8cb316493fe0f61fd330fdec70f872ae81693e12f9fcc47590149
SHA51247893f8117466821b89b29836e638bc76d2ee93e57179ba49d2242eb066fa01ff4e0033f194099065e29278b4d4ba653cca00e270f85ccd6cb91b7d3285d6161
-
Filesize
56KB
MD53263859df4866bf393d46f06f331a08f
SHA15b4665de13c9727a502f4d11afb800b075929d6c
SHA2569dcacda3913e30cafd92c909648b5bffde14b8e39e6adbfb15628006c0d4d3c2
SHA51258205110a017f5d73dd131fefb1e3bbbcc670ed0c645aeefebe5281579c7b1dceffa56671cd7b186554bdb81710e21018ed0d7088a27517dfc5e48d6d3578cf6
-
Filesize
188KB
MD544dc205a5701b53f391a3a750c2c4712
SHA114e82b1f6bb987d8f2783db2ab5f82dd9ab8eacc
SHA256508c41442ba856a3266b3e58a31fe8c4b0ad7491e04dfead265daaa028efd768
SHA51202890434c81867499e0911e8062797bf7fc184e05b6de2ab14ffa6f95c48f88e07250b4e5a7ff565bbf45d66d8d7cb5c1009b85085ee3a6bbdac218f356c5749
-
Filesize
555KB
MD58595f5515fac09b73ff463056cb07a15
SHA180f39da9a52cffb70edaa4d7de82f543ba4d417e
SHA2568223619e305ec5063e9e2c1490fa25f6e924c317b08fd5eed938bb5de2e57de1
SHA51226f0a15484a8780fedcea91f9d90ab4b81a91598fad4cad54f45fd18eccf73914215851909bf8acadeafc7b89c656c98ec988a46aa43e17a364b39b5d8ac477a
-
Filesize
923KB
MD513a289feeb15827860a55bbc5e5d498f
SHA1e1f0a544fcc5b3bc0ab6a788343185ad1ad077ad
SHA256c5483b2acbb352dc5c9a811d9616c4519f0e07c13905552be5ec869613ada775
SHA51200c225fb1d88920c5df7bb853d32213a91254fb8c57169c58c8b0ffab4501486e24d87e3d8f5665b16e366362cb81deec535d833ed42434fdc31f0400ee7ffa7
-
Filesize
900KB
MD58cad9c4c58553ec0ca5fd50aec791b8a
SHA1a2a4385cb2df58455764eb879b5d6aaf5e3585ac
SHA256f092024f873461b61234b97fcb07c8589dcc9a801cf8a0a6e302dbd746bab294
SHA5121eeac808dd992a7b99448d8a1c5470a2964b14705b4e987d9cb2e227a8142122faa17bf8a9acba6db4e80a42b50b58536e748a3231736b9b705d630f941159a3
-
Filesize
186KB
MD528e40b1adae683f70b178d025ea7bf64
SHA124851934bbb9a67c6d07e48503e6296c91fff502
SHA2561cde227af526781ff9553ffef5d3eb52bc5e78240150d8bddd20644f4bf80af5
SHA512f02b499b6e10411affba70caf96694f6297f6b754c00b6a179421f5aa21a21bb8f8863d87fea358a280979dfede22a06188abc695e5be4ed578bb60d73aada57
-
Filesize
1.7MB
MD5fdaa4ceadfc95047aa93dbd903669f25
SHA197549c52142d192383e8f2018141901a1a0ec112
SHA25622af1522526444b485228e2021f039523e03003bd1ab68b6da275b69c96b018b
SHA512598e77c39f5e443228a7f1926540ad3ffa6eaf8bb9b7f10be9e24fd49f96446511166f0750deebe708a7dbb2d8bb98adcdd330132a24fd932f75068f6524c696
-
Filesize
8KB
MD5c85639691074f9d98ec530901c153d2b
SHA1cac948e5b1f9d7417e7c5ead543fda1108f0e9ed
SHA25655701c6e51fb6a9820d8f9d2ae9db412b60f51c80d288e8baf0ea50e2d03cce4
SHA5124911ce27e56bac29b247840e6c9de78e875210fd0588d11d9e3a3eae39764bfdd14b56de5de4cf535674a2ba0810c9d823f42b339f650dedb7af42f8b3fd4c6d
-
Filesize
900KB
MD55c2e28dedae0e088fc1f9b50d7d28c12
SHA1f521d9d8ae7381e3953ae5cf33b4b1b37f67a193
SHA2562261a3d740572f9d0ee42faad5b0d405df16506e104bd912e7c7b24d7fddcc5f
SHA512f6f100508acb77af5b3442673c9d01a6a16cc39521b618eebccd482bf9f50b3991109f82b97e48e8c3cc0221f0be9e164867ba79ac2f2bc4e25cbdb5f7daa15f
-
Filesize
43KB
MD5ad0aca1934f02768fd5fedaf4d9762a3
SHA10e5b8372015d81200c4eff22823e854d0030f305
SHA256dc10f50f9761f6fbafe665e75a331b2048a285b1857ad95e0611ace825cba388
SHA5122fba342010ba85440784190245f74ea9e7c70974df12c241ccb6b72a6e1006a72bd1fa2e657f434d7479758f9508edb315398f6e95d167a78b788cea732be3b7
-
Filesize
869KB
MD501ad10e59fa396af2d5443c5a14c1b21
SHA1f209a4f0bb2a96e3ee6a55689e7f00e79c04f722
SHA256bef1cffaba8186ce62265e0b322ca9fd9326a8929591df569a4953456c752137
SHA5121e067ade999ff933a644fde66c6ab9abb8a960ce1c8064368adcde4c09d924bd22d1b43c68b7c968e982fc75937969a2876e9e2a024f72e693f9ba397d449e02