metasploit | ce235b6f27ae7d148396fea5843c2c6cf1826569f510e96f3e3bf06e8b96d19b

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
03-11-2024 20:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe
Size

671KB
MD5

8d436371b39ffd40b038e447c41dd57d
SHA1

54108717243c21cbf324ece692a8a48f2a1c2a69
SHA256

ce235b6f27ae7d148396fea5843c2c6cf1826569f510e96f3e3bf06e8b96d19b
SHA512

86e25157e52f6f6f6fcbc843c4b19eed5232bd292483fa2806514ab9055aab343bde34de8bfd146f66f290a3af91023239812a55da1946a41d83dc969105c3ea
SSDEEP

12288:QgD8NVmCYCr4l6rf+4dsGmTkrdtAYU5coIz+7BIbaDHYnppO9ReK5dt:QVNsecl6rBbNzfw9BpeX2f

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Executes dropped EXE 20 IoCs

Processes:

avelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exe

pid	Process
2912	avelta.exe
2736	avelta.exe
1852	avelta.exe
2608	avelta.exe
2560	avelta.exe
2100	avelta.exe
2264	avelta.exe
2236	avelta.exe
2292	avelta.exe
760	avelta.exe
1728	avelta.exe
2576	avelta.exe
2916	avelta.exe
2944	avelta.exe
768	avelta.exe
2712	avelta.exe
1700	avelta.exe
2532	avelta.exe
2988	avelta.exe
1676	avelta.exe

Loads dropped DLL 21 IoCs

Processes:

8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exe

pid	Process
2920	8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe
2920	8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe
2912	avelta.exe
2736	avelta.exe
2736	avelta.exe
2608	avelta.exe
2608	avelta.exe
2100	avelta.exe
2100	avelta.exe
2236	avelta.exe
2236	avelta.exe
760	avelta.exe
760	avelta.exe
2576	avelta.exe
2576	avelta.exe
2944	avelta.exe
2944	avelta.exe
2712	avelta.exe
2712	avelta.exe
2532	avelta.exe
2532	avelta.exe

Drops file in System32 directory 32 IoCs

Processes:

avelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exe8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exe

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File created	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File created	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File opened for modification	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File created	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File opened for modification	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File opened for modification	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File opened for modification	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File created	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File opened for modification	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File created	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File opened for modification	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File opened for modification	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File created	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File opened for modification	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File opened for modification	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File opened for modification	C:\Windows\SysWOW64\avelta.exe	8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File opened for modification	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File opened for modification	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File opened for modification	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File opened for modification	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File created	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File created	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File created	C:\Windows\SysWOW64\avelta.exe	8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File opened for modification	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File opened for modification	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File opened for modification	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File opened for modification	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File created	C:\Windows\SysWOW64\avelta.exe	avelta.exe
File opened for modification	C:\Windows\SysWOW64\avelta.exe	avelta.exe

Suspicious use of SetThreadContext 11 IoCs

Processes:

8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exe

description	pid	Process	procid_target
PID 2884 set thread context of 2920	2884	8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe	30
PID 2912 set thread context of 2736	2912	avelta.exe	32
PID 1852 set thread context of 2608	1852	avelta.exe	34
PID 2560 set thread context of 2100	2560	avelta.exe	37
PID 2264 set thread context of 2236	2264	avelta.exe	39
PID 2292 set thread context of 760	2292	avelta.exe	41
PID 1728 set thread context of 2576	1728	avelta.exe	43
PID 2916 set thread context of 2944	2916	avelta.exe	45
PID 768 set thread context of 2712	768	avelta.exe	47
PID 1700 set thread context of 2532	1700	avelta.exe	49
PID 2988 set thread context of 1676	2988	avelta.exe	51

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

avelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exe8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exe8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exeavelta.exeavelta.exeavelta.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avelta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avelta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avelta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avelta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avelta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avelta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avelta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avelta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avelta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avelta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avelta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avelta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avelta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avelta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avelta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avelta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avelta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avelta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avelta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avelta.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exe

pid	Process
2884	8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe
2912	avelta.exe
1852	avelta.exe
2560	avelta.exe
2264	avelta.exe
2292	avelta.exe
1728	avelta.exe
2916	avelta.exe
768	avelta.exe
1700	avelta.exe
2988	avelta.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exeavelta.exeavelta.exeavelta.exeavelta.exeavelta.exe

description	pid	Process	procid_target
PID 2884 wrote to memory of 2920	2884	8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe	30
PID 2884 wrote to memory of 2920	2884	8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe	30
PID 2884 wrote to memory of 2920	2884	8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe	30
PID 2884 wrote to memory of 2920	2884	8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe	30
PID 2884 wrote to memory of 2920	2884	8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe	30
PID 2884 wrote to memory of 2920	2884	8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe	30
PID 2884 wrote to memory of 2920	2884	8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe	30
PID 2884 wrote to memory of 2920	2884	8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe	30
PID 2884 wrote to memory of 2920	2884	8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe	30
PID 2884 wrote to memory of 2920	2884	8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe	30
PID 2884 wrote to memory of 2920	2884	8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe	30
PID 2884 wrote to memory of 2920	2884	8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe	30
PID 2884 wrote to memory of 2920	2884	8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe	30
PID 2920 wrote to memory of 2912	2920	8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe	31
PID 2920 wrote to memory of 2912	2920	8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe	31
PID 2920 wrote to memory of 2912	2920	8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe	31
PID 2920 wrote to memory of 2912	2920	8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe	31
PID 2912 wrote to memory of 2736	2912	avelta.exe	32
PID 2912 wrote to memory of 2736	2912	avelta.exe	32
PID 2912 wrote to memory of 2736	2912	avelta.exe	32
PID 2912 wrote to memory of 2736	2912	avelta.exe	32
PID 2912 wrote to memory of 2736	2912	avelta.exe	32
PID 2912 wrote to memory of 2736	2912	avelta.exe	32
PID 2912 wrote to memory of 2736	2912	avelta.exe	32
PID 2912 wrote to memory of 2736	2912	avelta.exe	32
PID 2912 wrote to memory of 2736	2912	avelta.exe	32
PID 2912 wrote to memory of 2736	2912	avelta.exe	32
PID 2912 wrote to memory of 2736	2912	avelta.exe	32
PID 2912 wrote to memory of 2736	2912	avelta.exe	32
PID 2912 wrote to memory of 2736	2912	avelta.exe	32
PID 2736 wrote to memory of 1852	2736	avelta.exe	33
PID 2736 wrote to memory of 1852	2736	avelta.exe	33
PID 2736 wrote to memory of 1852	2736	avelta.exe	33
PID 2736 wrote to memory of 1852	2736	avelta.exe	33
PID 1852 wrote to memory of 2608	1852	avelta.exe	34
PID 1852 wrote to memory of 2608	1852	avelta.exe	34
PID 1852 wrote to memory of 2608	1852	avelta.exe	34
PID 1852 wrote to memory of 2608	1852	avelta.exe	34
PID 1852 wrote to memory of 2608	1852	avelta.exe	34
PID 1852 wrote to memory of 2608	1852	avelta.exe	34
PID 1852 wrote to memory of 2608	1852	avelta.exe	34
PID 1852 wrote to memory of 2608	1852	avelta.exe	34
PID 1852 wrote to memory of 2608	1852	avelta.exe	34
PID 1852 wrote to memory of 2608	1852	avelta.exe	34
PID 1852 wrote to memory of 2608	1852	avelta.exe	34
PID 1852 wrote to memory of 2608	1852	avelta.exe	34
PID 1852 wrote to memory of 2608	1852	avelta.exe	34
PID 2608 wrote to memory of 2560	2608	avelta.exe	36
PID 2608 wrote to memory of 2560	2608	avelta.exe	36
PID 2608 wrote to memory of 2560	2608	avelta.exe	36
PID 2608 wrote to memory of 2560	2608	avelta.exe	36
PID 2560 wrote to memory of 2100	2560	avelta.exe	37
PID 2560 wrote to memory of 2100	2560	avelta.exe	37
PID 2560 wrote to memory of 2100	2560	avelta.exe	37
PID 2560 wrote to memory of 2100	2560	avelta.exe	37
PID 2560 wrote to memory of 2100	2560	avelta.exe	37
PID 2560 wrote to memory of 2100	2560	avelta.exe	37
PID 2560 wrote to memory of 2100	2560	avelta.exe	37
PID 2560 wrote to memory of 2100	2560	avelta.exe	37
PID 2560 wrote to memory of 2100	2560	avelta.exe	37
PID 2560 wrote to memory of 2100	2560	avelta.exe	37
PID 2560 wrote to memory of 2100	2560	avelta.exe	37
PID 2560 wrote to memory of 2100	2560	avelta.exe	37
PID 2560 wrote to memory of 2100	2560	avelta.exe	37

C:\Users\Admin\AppData\Local\Temp\8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Users\Admin\AppData\Local\Temp\8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Windows\SysWOW64\avelta.exe
    C:\Windows\system32\avelta.exe 476 "C:\Users\Admin\AppData\Local\Temp\8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Windows\SysWOW64\avelta.exe
      476 "C:\Users\Admin\AppData\Local\Temp\8d436371b39ffd40b038e447c41dd57d_JaffaCakes118.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2736
    - - C:\Windows\SysWOW64\avelta.exe
        
        C:\Windows\system32\avelta.exe 524 "C:\Windows\SysWOW64\avelta.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1852
      - C:\Windows\SysWOW64\avelta.exe
        
        524 "C:\Windows\SysWOW64\avelta.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2608
        
        C:\Windows\SysWOW64\avelta.exe
        
        C:\Windows\system32\avelta.exe 524 "C:\Windows\SysWOW64\avelta.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2560
        
        C:\Windows\SysWOW64\avelta.exe
        
        524 "C:\Windows\SysWOW64\avelta.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2100
        
        C:\Windows\SysWOW64\avelta.exe
        
        C:\Windows\system32\avelta.exe 524 "C:\Windows\SysWOW64\avelta.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2264
        
        C:\Windows\SysWOW64\avelta.exe
        
        524 "C:\Windows\SysWOW64\avelta.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2236
        
        C:\Windows\SysWOW64\avelta.exe
        
        C:\Windows\system32\avelta.exe 524 "C:\Windows\SysWOW64\avelta.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2292
        
        C:\Windows\SysWOW64\avelta.exe
        
        524 "C:\Windows\SysWOW64\avelta.exe"
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:760
        
        C:\Windows\SysWOW64\avelta.exe
        
        C:\Windows\system32\avelta.exe 524 "C:\Windows\SysWOW64\avelta.exe"
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1728
        
        C:\Windows\SysWOW64\avelta.exe
        
        524 "C:\Windows\SysWOW64\avelta.exe"
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2576
        
        C:\Windows\SysWOW64\avelta.exe
        
        C:\Windows\system32\avelta.exe 524 "C:\Windows\SysWOW64\avelta.exe"
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2916
        
        C:\Windows\SysWOW64\avelta.exe
        
        524 "C:\Windows\SysWOW64\avelta.exe"
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2944
        
        C:\Windows\SysWOW64\avelta.exe
        
        C:\Windows\system32\avelta.exe 524 "C:\Windows\SysWOW64\avelta.exe"
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:768
        
        C:\Windows\SysWOW64\avelta.exe
        
        524 "C:\Windows\SysWOW64\avelta.exe"
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2712
        
        C:\Windows\SysWOW64\avelta.exe
        
        C:\Windows\system32\avelta.exe 524 "C:\Windows\SysWOW64\avelta.exe"
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1700
        
        C:\Windows\SysWOW64\avelta.exe
        
        524 "C:\Windows\SysWOW64\avelta.exe"
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2532
        
        C:\Windows\SysWOW64\avelta.exe
        
        C:\Windows\system32\avelta.exe 536 "C:\Windows\SysWOW64\avelta.exe"
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2988
        
        C:\Windows\SysWOW64\avelta.exe
        
        536 "C:\Windows\SysWOW64\avelta.exe"
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lrlAD6F.tmp

Filesize
172KB

MD5
0c4dcdf7a59ecc1850b05b4c16024c50

SHA1
52e541923b5de5dc98f3989eb80497268604dca7

SHA256
38f50699ab166f68c78231b6e3c93b7468f1b3f4666054947e1eb7dc35668d2a

SHA512
aa788d0e93c8c58443aec7d4faf76ad69dbd446c8cadce9303a71d3d1f864f7b505bdde2d0f565a18c08f047f703189d6b80c216b6646f2ed66bfd7bf473465f

Download Submit
C:\Windows\SysWOW64\avelta.exe

Filesize
671KB

MD5
8d436371b39ffd40b038e447c41dd57d

SHA1
54108717243c21cbf324ece692a8a48f2a1c2a69

SHA256
ce235b6f27ae7d148396fea5843c2c6cf1826569f510e96f3e3bf06e8b96d19b

SHA512
86e25157e52f6f6f6fcbc843c4b19eed5232bd292483fa2806514ab9055aab343bde34de8bfd146f66f290a3af91023239812a55da1946a41d83dc969105c3ea

Download Submit
memory/760-188-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/760-185-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2100-124-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2100-121-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2236-156-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2236-153-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2532-312-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2576-219-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2608-91-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2712-281-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2736-62-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2736-59-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2920-11-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2920-10-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2920-42-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2920-4-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2920-15-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2920-6-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2920-8-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2920-38-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2920-2-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2920-13-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2920-19-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2920-24-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2920-25-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2920-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2920-21-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/2944-250-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download