gh0strat | ab83767dc9e2c6f2568eec28413a11659b7fd516e3de1cfabc90858e317bc4d9

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2024 18:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe
Size

871KB
MD5

b98668b0d88e8801c177f2fdecdba603
SHA1

612a4fefc2b05b75b9bb933433be02fa04b9ebed
SHA256

ab83767dc9e2c6f2568eec28413a11659b7fd516e3de1cfabc90858e317bc4d9
SHA512

6b3e3df876aa7c595d7cbb83741615b3ab38ab07b746280087483a4af880af381d56f14a0977aceb1fe4c60fe047e722fc6aecad98ad333d4e520041331d6111
SSDEEP

24576:K/uc//////ahbQkHZoFhdgTZP3Jk4CDS7ZXw:rc//////ahRHZoFATZP3Jk3SFXw

Score

10^/10

gh0strat modiloader discovery rat trojan

Malware Config

Signatures

Gh0st RAT payload 13 IoCs

resource	yara_rule
behavioral2/files/0x000b000000023b79-18.dat	family_gh0strat
behavioral2/files/0x000d000000023b79-23.dat	family_gh0strat
behavioral2/files/0x000b000000023b8f-29.dat	family_gh0strat
behavioral2/files/0x000d000000023b8f-51.dat	family_gh0strat
behavioral2/files/0x000f000000023b8f-57.dat	family_gh0strat
behavioral2/files/0x000500000001e5b0-73.dat	family_gh0strat
behavioral2/files/0x000700000001e5b0-79.dat	family_gh0strat
behavioral2/files/0x0004000000000705-86.dat	family_gh0strat
behavioral2/files/0x0006000000000705-91.dat	family_gh0strat
behavioral2/files/0x0008000000000705-97.dat	family_gh0strat
behavioral2/files/0x000a000000000705-103.dat	family_gh0strat
behavioral2/files/0x000c000000000705-109.dat	family_gh0strat
behavioral2/files/0x000c000000000705-110.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/2376-5-0x0000000000400000-0x00000000004BC000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
4104	setup.exe
4420	install18709125.exe

Loads dropped DLL 34 IoCs

pid	Process
3716	svchost.exe
2280	svchost.exe
2668	svchost.exe
2292	svchost.exe
3052	svchost.exe
4344	svchost.exe
224	svchost.exe
892	svchost.exe
3680	svchost.exe
1240	svchost.exe
4756	svchost.exe
4324	svchost.exe
404	svchost.exe
1048	svchost.exe
1384	svchost.exe
3804	svchost.exe
3624	svchost.exe
4576	svchost.exe
1448	svchost.exe
3112	svchost.exe
3992	svchost.exe
4416	svchost.exe
2380	svchost.exe
440	svchost.exe
3688	svchost.exe
4528	svchost.exe
4640	svchost.exe
1200	svchost.exe
4748	svchost.exe
1592	svchost.exe
1012	svchost.exe
4968	svchost.exe
4468	svchost.exe
1616	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\srkex.cc3	install18709125.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3356 set thread context of 5012	3356	b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe	83
PID 5012 set thread context of 2376	5012	b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe	86
PID 2376 set thread context of 2092	2376	b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 33 IoCs

pid	pid_target	Process	procid_target
4484	3716	WerFault.exe	94
4740	2280	WerFault.exe	99
428	2668	WerFault.exe	102
4692	2292	WerFault.exe	111
1032	3052	WerFault.exe	116
1988	4344	WerFault.exe	119
2024	224	WerFault.exe	128
3556	892	WerFault.exe	132
3824	3680	WerFault.exe	135
4704	1240	WerFault.exe	139
4880	4756	WerFault.exe	142
1216	4324	WerFault.exe	145
1440	404	WerFault.exe	148
4340	1048	WerFault.exe	151
4980	1384	WerFault.exe	154
224	3804	WerFault.exe	158
960	3624	WerFault.exe	161
4952	4576	WerFault.exe	164
2448	1448	WerFault.exe	167
2892	3112	WerFault.exe	170
2584	3992	WerFault.exe	173
4756	4416	WerFault.exe	176
3608	2380	WerFault.exe	179
2720	440	WerFault.exe	182
4248	3688	WerFault.exe	185
4532	4528	WerFault.exe	188
2348	4640	WerFault.exe	191
3484	1200	WerFault.exe	194
1464	4748	WerFault.exe	197
4924	1592	WerFault.exe	200
2000	1012	WerFault.exe	203
3960	4968	WerFault.exe	206
4816	4468	WerFault.exe	209

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install18709125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral2/files/0x000d000000023b0d-4.dat	nsis_installer_2

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6D1AAAA3-B0D9-11EF-91C3-EE6C25FCE24B} = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31147238"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31147238"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31147238"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1140589691"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1140589691"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1143089620"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1143089620"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "439928310"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31147238"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4420	install18709125.exe
4420	install18709125.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeRestorePrivilege	4420	install18709125.exe
Token: SeBackupPrivilege	4420	install18709125.exe
Token: SeBackupPrivilege	4420	install18709125.exe
Token: SeRestorePrivilege	4420	install18709125.exe
Token: SeRestorePrivilege	4420	install18709125.exe
Token: SeBackupPrivilege	4420	install18709125.exe
Token: SeBackupPrivilege	4420	install18709125.exe
Token: SeRestorePrivilege	4420	install18709125.exe
Token: SeRestorePrivilege	4420	install18709125.exe
Token: SeBackupPrivilege	4420	install18709125.exe
Token: SeBackupPrivilege	4420	install18709125.exe
Token: SeRestorePrivilege	4420	install18709125.exe
Token: SeRestorePrivilege	4420	install18709125.exe
Token: SeBackupPrivilege	4420	install18709125.exe
Token: SeBackupPrivilege	4420	install18709125.exe
Token: SeRestorePrivilege	4420	install18709125.exe
Token: SeRestorePrivilege	4420	install18709125.exe
Token: SeBackupPrivilege	4420	install18709125.exe
Token: SeBackupPrivilege	4420	install18709125.exe
Token: SeRestorePrivilege	4420	install18709125.exe
Token: SeRestorePrivilege	4420	install18709125.exe
Token: SeBackupPrivilege	4420	install18709125.exe
Token: SeBackupPrivilege	4420	install18709125.exe
Token: SeRestorePrivilege	4420	install18709125.exe
Token: SeRestorePrivilege	4420	install18709125.exe
Token: SeBackupPrivilege	4420	install18709125.exe
Token: SeBackupPrivilege	4420	install18709125.exe
Token: SeRestorePrivilege	4420	install18709125.exe
Token: SeRestorePrivilege	4420	install18709125.exe
Token: SeBackupPrivilege	4420	install18709125.exe
Token: SeBackupPrivilege	4420	install18709125.exe
Token: SeRestorePrivilege	4420	install18709125.exe
Token: SeRestorePrivilege	4420	install18709125.exe
Token: SeBackupPrivilege	4420	install18709125.exe
Token: SeBackupPrivilege	4420	install18709125.exe
Token: SeRestorePrivilege	4420	install18709125.exe
Token: SeRestorePrivilege	4420	install18709125.exe
Token: SeBackupPrivilege	4420	install18709125.exe
Token: SeBackupPrivilege	4420	install18709125.exe
Token: SeRestorePrivilege	4420	install18709125.exe
Token: SeRestorePrivilege	4420	install18709125.exe
Token: SeBackupPrivilege	4420	install18709125.exe
Token: SeBackupPrivilege	4420	install18709125.exe
Token: SeRestorePrivilege	4420	install18709125.exe
Token: SeRestorePrivilege	4420	install18709125.exe
Token: SeBackupPrivilege	4420	install18709125.exe
Token: SeBackupPrivilege	4420	install18709125.exe
Token: SeRestorePrivilege	4420	install18709125.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2092	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
3648	IEXPLORE.EXE
3648	IEXPLORE.EXE
1928	cmd.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 5012	3356	b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe	83
PID 3356 wrote to memory of 5012	3356	b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe	83
PID 3356 wrote to memory of 5012	3356	b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe	83
PID 3356 wrote to memory of 5012	3356	b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe	83
PID 3356 wrote to memory of 5012	3356	b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe	83
PID 3356 wrote to memory of 4768	3356	b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe	84
PID 3356 wrote to memory of 4768	3356	b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe	84
PID 3356 wrote to memory of 4768	3356	b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe	84
PID 5012 wrote to memory of 2376	5012	b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe	86
PID 5012 wrote to memory of 2376	5012	b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe	86
PID 5012 wrote to memory of 2376	5012	b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe	86
PID 5012 wrote to memory of 2376	5012	b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe	86
PID 5012 wrote to memory of 2376	5012	b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe	86
PID 2376 wrote to memory of 2092	2376	b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe	88
PID 2376 wrote to memory of 2092	2376	b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe	88
PID 2376 wrote to memory of 2092	2376	b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe	88
PID 4768 wrote to memory of 4104	4768	cmd.exe	87
PID 4768 wrote to memory of 4104	4768	cmd.exe	87
PID 4768 wrote to memory of 4104	4768	cmd.exe	87
PID 2092 wrote to memory of 3648	2092	IEXPLORE.EXE	89
PID 2092 wrote to memory of 3648	2092	IEXPLORE.EXE	89
PID 2092 wrote to memory of 3648	2092	IEXPLORE.EXE	89
PID 4104 wrote to memory of 4420	4104	setup.exe	90
PID 4104 wrote to memory of 4420	4104	setup.exe	90
PID 4104 wrote to memory of 4420	4104	setup.exe	90
PID 3356 wrote to memory of 1928	3356	b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe	91
PID 3356 wrote to memory of 1928	3356	b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe	91
PID 3356 wrote to memory of 1928	3356	b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Users\Admin\AppData\Local\Temp\b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Users\Admin\AppData\Local\Temp\b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\b98668b0d88e8801c177f2fdecdba603_JaffaCakes118.exe
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\program files\internet explorer\IEXPLORE.EXE
      "C:\program files\internet explorer\IEXPLORE.EXE"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2092
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:17410 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3648
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "c:\setup.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4768
- - \??\c:\setup.exe
    c:\setup.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\Users\Admin\AppData\Roaming\install18709125.exe
      C:\Users\Admin\AppData\Roaming\install18709125.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4420
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "c:\DS1.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1928

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 592
  2⤵
  - Program crash
  PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3716 -ip 3716
1⤵
PID:4924

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 592
  2⤵
  - Program crash
  PID:4740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2280 -ip 2280
1⤵
PID:2404

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 592
  2⤵
  - Program crash
  PID:428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2668 -ip 2668
1⤵
PID:1892

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ias
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 592
  2⤵
  - Program crash
  PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2292 -ip 2292
1⤵
PID:2752

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ias
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 592
  2⤵
  - Program crash
  PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3052 -ip 3052
1⤵
PID:4268

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ias
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 592
  2⤵
  - Program crash
  PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4344 -ip 4344
1⤵
PID:4328

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s irmon
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 592
  2⤵
  - Program crash
  PID:2024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 224 -ip 224
1⤵
PID:3232

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s irmon
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 892 -s 592
  2⤵
  - Program crash
  PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 892 -ip 892
1⤵
PID:384

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s irmon
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 576
  2⤵
  - Program crash
  PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3680 -ip 3680
1⤵
PID:4576

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nla
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 592
  2⤵
  - Program crash
  PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1240 -ip 1240
1⤵
PID:4588

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nla
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 592
  2⤵
  - Program crash
  PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4756 -ip 4756
1⤵
PID:3120

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nla
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 592
  2⤵
  - Program crash
  PID:1216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4324 -ip 4324
1⤵
PID:2752

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ntmssvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 592
  2⤵
  - Program crash
  PID:1440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 404 -ip 404
1⤵
PID:4516

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ntmssvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 592
  2⤵
  - Program crash
  PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1048 -ip 1048
1⤵
PID:4396

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ntmssvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 592
  2⤵
  - Program crash
  PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1384 -ip 1384
1⤵
PID:4928

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nwcworkstation
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 592
  2⤵
  - Program crash
  PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3804 -ip 3804
1⤵
PID:2024

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nwcworkstation
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 592
  2⤵
  - Program crash
  PID:960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3624 -ip 3624
1⤵
PID:3864

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nwcworkstation
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 592
  2⤵
  - Program crash
  PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4576 -ip 4576
1⤵
PID:3412

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s srservice
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 592
  2⤵
  - Program crash
  PID:2448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1448 -ip 1448
1⤵
PID:3292

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s srservice
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 592
  2⤵
  - Program crash
  PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3112 -ip 3112
1⤵
PID:4788

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s srservice
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 592
  2⤵
  - Program crash
  PID:2584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3992 -ip 3992
1⤵
PID:4816

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmi
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 592
  2⤵
  - Program crash
  PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4416 -ip 4416
1⤵
PID:4856

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmi
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 592
  2⤵
  - Program crash
  PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2380 -ip 2380
1⤵
PID:4432

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmi
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 592
  2⤵
  - Program crash
  PID:2720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 440 -ip 440
1⤵
PID:3004

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmdmpmsp
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 592
  2⤵
  - Program crash
  PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3688 -ip 3688
1⤵
PID:4364

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmdmpmsp
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 592
  2⤵
  - Program crash
  PID:4532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4528 -ip 4528
1⤵
PID:4928

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmdmpmsp
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 592
  2⤵
  - Program crash
  PID:2348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4640 -ip 4640
1⤵
PID:3852

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s logonhours
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 592
  2⤵
  - Program crash
  PID:3484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1200 -ip 1200
1⤵
PID:1016

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s logonhours
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 592
  2⤵
  - Program crash
  PID:1464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4748 -ip 4748
1⤵
PID:832

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s logonhours
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 592
  2⤵
  - Program crash
  PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1592 -ip 1592
1⤵
PID:4552

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s pcaudit
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 592
  2⤵
  - Program crash
  PID:2000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1012 -ip 1012
1⤵
PID:4168

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s pcaudit
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 592
  2⤵
  - Program crash
  PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4968 -ip 4968
1⤵
PID:324

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s pcaudit
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 592
  2⤵
  - Program crash
  PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4468 -ip 4468
1⤵
PID:3112

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
618549979a1bbc1ddf18d9b671262efe

SHA1
072603d19ddbf0262127dbbb3bcebb9310fd8b73

SHA256
38736f2d9d0e5770a9a1d2d64d4c439c6ae4da612f4a310d1995c829fc75caa1

SHA512
161e8cea07d6aef015411fd6b95307f0491bb6b0ba67dd07ad079044207dd26d0ef056dfe5c62a524b7f40f44e3f38793dd8c0cd0d8d5f6bbf738bd16064a071

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
97b74da7c0dd2d8071815f160e872623

SHA1
5b41646ba70e03ef04e0b7834b05f1bd08a717d4

SHA256
3f6af40dcf62aea71bc83036539e37d4cfb465a10f586ad401e665bd656d29a7

SHA512
3a169256e88b6bfac1ee242552d2eae6bf71d552d897e428e264887a3d161c0900ee60f4c7d717ea8136deb7d44b9f3181760b5688ba6ec03e494407d3e84f9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver12C8.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XH3Z2ZON\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Roaming\install18709125.exe

Filesize
192KB

MD5
8e0cb2efb3d7491cfccf88862a032d4b

SHA1
e8b42147091c82fd73ae12cabae4c9ddb2c2d51a

SHA256
7d69a9cf389a5952d0d612880d431c9cac733b22918d769e64f756ee02b0e2e7

SHA512
a37fa080d43600477ae83daf569bcff1ce598c5353b5157d36586686c3ca75c12e0ff78b5f176921ccd84e84a3b39a64fa733ffe20cb16fc87191eb2fceb9a51

Download Submit
C:\Windows\SysWOW64\srkex.cc3

Filesize
21.1MB

MD5
220a4f7888039238221612abaa3432c4

SHA1
7d89bb36ce30955eb3bacb9b724237d783b5c164

SHA256
14c09eaff4e095af1d96d865ef661329c98f5db9c6f324f9b805328c5bbc94a3

SHA512
a9f389eed5392655595a52f34010d74c78002dcdc297ce0ed178f5664441891759f57f26d4ef634279a5ae40ea7fe5e0425fb29488e039577372a247def00b66

Download Submit
C:\Windows\SysWOW64\srkex.cc3

Filesize
23.0MB

MD5
5bd0a116da1be9d8a8311d0131c41c3c

SHA1
37cde038d46b99a3fe37f8604c6acc3c11548647

SHA256
17edf67b0d21d90f1ce3170f8e9c02d626570e8c57295127fc852c3e21995559

SHA512
e8739639caa8d1d0e17b4aeeb902b35775c8a8980176bdff3201c098c90d57a52fbd0bef1e9b7b7cbf1dacf11f3c7c1f74677e42ce6ca03f10c2e708f078e015

Download Submit
C:\Windows\SysWOW64\srkex.cc3

Filesize
21.3MB

MD5
de7eec607eb74d9addc89042b1d840f5

SHA1
ee985d97417e41d693ff642fc3ba9e14a9399a34

SHA256
f8218f4a7d8fbd81b2932687aa13a2a99a54a675aeef9af364edf8829f644bf0

SHA512
672650902d3b1229de842bc1f98817217a5216bd1ebfcfe19fe54782b730ef9cd7bf093a91f7857e9386b3e66614429ea6a02eb8917c391b986b982859096fc2

Download Submit
C:\Windows\SysWOW64\srkex.cc3

Filesize
20.1MB

MD5
95a37184e49b460b00bd389d933bb2f8

SHA1
e3fab3e0c36ff4fa9eb0f0ccb62297ef749b794b

SHA256
25d8f338acb799d70e3478384e19f36070898a1d09f0f9dfe083fbbe0397940d

SHA512
3145542e72e7aa0278ef6157ab6ade2c2b29378adf6cb7c660081ed27c1dfb9cd0cf1afcbc0027f45b36a7ed63e5dee667c3e968126bc19256ea5856756f4d5d

Download Submit
C:\setup.exe

Filesize
117KB

MD5
71b8cd2a83ab6909f6521c25ccb2af4a

SHA1
0c6f6a4aeed1309addc997f6ef531aab50a9721e

SHA256
17ca171d429cc9985a9ca79acbf612fadda3ee592935d77e8c64082ce1adabd9

SHA512
6b13c105b477fcf19e8153d88a52e5007aedc1cc4cdd92c3d72b2ac938240880731f466063cd9bebfc0e567aaf3acb3160b850360f1956c0c1606b8ec34b6bed

Download Submit
\??\c:\windows\SysWOW64\srkex.cc3

Filesize
20.0MB

MD5
4e958faccc4acf95b18d7c65c0fd0242

SHA1
54c117ad1f4af8e8103526bdf522d330acb72995

SHA256
c5e819b951c1b6755326afc191616a1f89e8fc04e5672841aee83e6890560938

SHA512
7d496ec7ce925ce0674b2c1aefdf809e91b57c7907afb97d6f92ac29bb71dcc239d237583a3da785c4d3b76a707e1d6478559f8eca21a019e14aff1ba66c2bf5

Download Submit
\??\c:\windows\SysWOW64\srkex.cc3

Filesize
19.1MB

MD5
bbc5d7cd98bdc814017725c6ddc429b9

SHA1
7858c67c8e1f2f83ec4b25b960396f7485067379

SHA256
78a44225a5c64525baecab95f2d1d4c4086c9ddb91364918e760d24f2430f9a7

SHA512
5a999f8463996b4c49fa504a26e52f7f58799aec43eb432d2fa4c737ad1bc8e3cccb3f8d6d45e78769ca1d81b5f0e43233e14e4f9c851f251cc1b3ef8062ff1f

Download Submit
\??\c:\windows\SysWOW64\srkex.cc3

Filesize
21.1MB

MD5
e300304607fb9fcf099a8e21ea87d69a

SHA1
c8d10f19f6acee7a99b2fe03142d19c34f53b36e

SHA256
537d63bdfb498398d40f0e014059d61c1e6a9951073177efcd1b10b77fe73539

SHA512
e1df6f4878b0ca2a13494b97439fbe1cd469b41cf0c5e9d9d9258d6f6b04829831c9dade428ef4484ca958327e74a725209e15fac9acf54e02cece82ef4069c9

Download Submit
\??\c:\windows\SysWOW64\srkex.cc3

Filesize
24.0MB

MD5
99e6c007986858200bd471d6ffd1de2e

SHA1
50a004a89b18b2f892d9bceea28fe339bb42632a

SHA256
453efb6eb8cfaee254abbc641fed9f2a1d09035abb1c78a3f997ff764addbdf8

SHA512
b339b9a423a672085ff344327d077116d64c59b74beb6d38c22e0bfe38e704224133efdb2b4d48674920ce7f2fdf8fbc0e0a22e300011cf9c511ad6655630b00

Download Submit
\??\c:\windows\SysWOW64\srkex.cc3

Filesize
22.1MB

MD5
9fc9e8c8fdb96ce6075befebd74add02

SHA1
dafc4bb634511212160ec7a6d52ea1bb266964b1

SHA256
6cc58e4f83d087e7a74ae7450008a7783ec11c36dd7eded2935ef73bde3eb3e5

SHA512
6d0ddf875cd66270e3e65a234943fd595eab4b575aeab0dbf73c8746f9f1644efb5387c4d08630ab3da84f4a35fd1886d97ab0f2869e7fef7ea391d82bc36262

Download Submit
\??\c:\windows\SysWOW64\srkex.cc3

Filesize
19.1MB

MD5
987b449d4b17086f044fd4620bf2dabf

SHA1
9ea1b51ce3c349c030c51d4fc5e1895f110f529b

SHA256
b86c8c4b9e79efddfa8769498363c2490bd7c1f240b937832564b4b231f0780d

SHA512
e4d7f79f9a7028d66f1a268fc242594b7f63e0eaaeafa631a1f9cb98948b06e8eb338d8d2f32ad448224de41e358a9f9341dcd4d1a53e7709cabcf7d1e92564e

Download Submit
\??\c:\windows\SysWOW64\srkex.cc3

Filesize
24.1MB

MD5
418057edbfc5f58ac2578ab03f8f5d9d

SHA1
243a104da57898dd177981cd7d02c7a2051c78fd

SHA256
233a97f4a67b8a10ec1745e8dca5ac26b0175697c10ddf3836da0ea20d3e010f

SHA512
d0e8bfd3270bb1b1b5ce1acf510bbb9fd594f1fc098fc642a7de58df7af77ec134e9e8383f147c45c48fe651e9cf1c5b7a23fe07fa217ae91a70f2f708f463fb

Download Submit
\??\c:\windows\SysWOW64\srkex.cc3

Filesize
24.1MB

MD5
4ade8844c0a9040324eefe5ce06adfa4

SHA1
71220693992eed7d48b9780bceb18053361972a8

SHA256
a1de445a25fe4e16f878c753f2b555694289e30f2fbbc0ca2d3386def9b1ff48

SHA512
e5c8a342decd25181ebaba2821edc10ccb364ac3909b8ababe8191dd4898812da2aeccfdad3aa5b3c5523e0833c4c39c318cd189547a34ae90d8d174594bf3ef

Download Submit
\??\c:\windows\SysWOW64\srkex.cc3

Filesize
22.0MB

MD5
1d9028d7c033b6ad8a0244c8a85c4df4

SHA1
4ea4286f0c6541a606e04a09ce2c1146843435f1

SHA256
24e58753874f5e7a5dc0e5621976c38489af772404f1a23c7be8005e68ed7e11

SHA512
3aaeae6decdd9efb201cf8a18710e940e0df2cb63978da125e0bd33672447fd65c90e70ac1b717b5ee86bcc48b1e85c60257174d7d51dbd764cc5f41ffdc7b32

Download Submit
memory/2092-2-0x0000000000B30000-0x0000000000C0F000-memory.dmp

Filesize
892KB

Download
memory/2376-5-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/3356-12-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/5012-1-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download