isrstealer | 7be45f5f89a98f22c8cd858540497c5da3dba7cbec0fc49b4ec6eff435ee317f

Analysis

max time kernel
150s
max time network
134s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03/12/2024, 01:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb266dc5dede36e0d96e4f55b76f016e_JaffaCakes118.exe
Size

1.5MB
MD5

bb266dc5dede36e0d96e4f55b76f016e
SHA1

4d17702da9f5548e4673081f84b13298c0949fc0
SHA256

7be45f5f89a98f22c8cd858540497c5da3dba7cbec0fc49b4ec6eff435ee317f
SHA512

f139ce61dfcbb51a7d3a947976d5e2600b2875faafd2c7fdcf6791db45546b46b34f9634bba406e1380343d288e707251921ea350d97079522662ac4a01bbf98
SSDEEP

24576:PKnGctxx3lwkjQ7h3l1PVXUi9VF0tb5xQbn1wcJCRcsawHLkH7XgRbeZ:PK3v3a77xVLjF8Fx2n1wpRcsjHLkrz

Score

10^/10

isrstealer collection discovery persistence stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 3 IoCs

resource	yara_rule
behavioral1/memory/2712-36-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral1/memory/2712-51-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral1/memory/2712-52-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer

Isrstealer family
isrstealer

Detected Nirsoft tools 2 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/236-50-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral1/memory/1332-69-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/236-50-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView
behavioral1/memory/1332-69-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView

Executes dropped EXE 2 IoCs

pid	Process
2640	ZIGPLW~1.EXE
2760	NZFN.exe

Loads dropped DLL 4 IoCs

pid	Process
2196	bb266dc5dede36e0d96e4f55b76f016e_JaffaCakes118.exe
2640	ZIGPLW~1.EXE
2640	ZIGPLW~1.EXE
2760	NZFN.exe

Accesses Microsoft Outlook accounts 1 TTPs 13 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	bb266dc5dede36e0d96e4f55b76f016e_JaffaCakes118.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x00090000000164b1-2.dat	autoit_exe

Suspicious use of SetThreadContext 44 IoCs

description	pid	Process	procid_target
PID 2760 set thread context of 2712	2760	NZFN.exe	32
PID 2712 set thread context of 2996	2712	RegSvcs.exe	33
PID 2712 set thread context of 236	2712	RegSvcs.exe	34
PID 2760 set thread context of 820	2760	NZFN.exe	36
PID 820 set thread context of 1456	820	RegSvcs.exe	37
PID 820 set thread context of 1332	820	RegSvcs.exe	38
PID 2760 set thread context of 992	2760	NZFN.exe	41
PID 992 set thread context of 1704	992	RegSvcs.exe	42
PID 992 set thread context of 1256	992	RegSvcs.exe	43
PID 2760 set thread context of 2156	2760	NZFN.exe	45
PID 2156 set thread context of 1524	2156	RegSvcs.exe	46
PID 2156 set thread context of 2320	2156	RegSvcs.exe	47
PID 2760 set thread context of 908	2760	NZFN.exe	49
PID 908 set thread context of 1760	908	RegSvcs.exe	50
PID 908 set thread context of 3012	908	RegSvcs.exe	51
PID 2760 set thread context of 2984	2760	NZFN.exe	53
PID 2984 set thread context of 2212	2984	RegSvcs.exe	54
PID 2984 set thread context of 876	2984	RegSvcs.exe	55
PID 2760 set thread context of 1592	2760	NZFN.exe	57
PID 1592 set thread context of 2636	1592	RegSvcs.exe	58
PID 1592 set thread context of 2692	1592	RegSvcs.exe	59
PID 2760 set thread context of 2536	2760	NZFN.exe	61
PID 2536 set thread context of 2528	2536	RegSvcs.exe	62
PID 2536 set thread context of 2476	2536	RegSvcs.exe	63
PID 2760 set thread context of 944	2760	NZFN.exe	65
PID 944 set thread context of 2084	944	RegSvcs.exe	66
PID 944 set thread context of 820	944	RegSvcs.exe	67
PID 2760 set thread context of 1136	2760	NZFN.exe	70
PID 1136 set thread context of 1628	1136	RegSvcs.exe	71
PID 1136 set thread context of 2208	1136	RegSvcs.exe	72
PID 2760 set thread context of 2116	2760	NZFN.exe	74
PID 2116 set thread context of 1604	2116	RegSvcs.exe	75
PID 2116 set thread context of 960	2116	RegSvcs.exe	76
PID 2760 set thread context of 2072	2760	NZFN.exe	78
PID 2072 set thread context of 1364	2072	RegSvcs.exe	79
PID 2072 set thread context of 956	2072	RegSvcs.exe	80
PID 2760 set thread context of 1504	2760	NZFN.exe	82
PID 1504 set thread context of 1908	1504	RegSvcs.exe	83
PID 1504 set thread context of 2268	1504	RegSvcs.exe	84
PID 2760 set thread context of 2784	2760	NZFN.exe	86
PID 2784 set thread context of 1800	2784	RegSvcs.exe	87
PID 2784 set thread context of 2816	2784	RegSvcs.exe	88
PID 2760 set thread context of 2812	2760	NZFN.exe	89
PID 2812 set thread context of 2588	2812	RegSvcs.exe	90

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2996-41-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2996-42-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2996-43-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2996-44-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/236-47-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/236-48-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/236-49-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/236-50-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1456-61-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1456-62-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1456-63-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1332-67-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1332-68-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1332-69-0x0000000000400000-0x000000000041F000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 44 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bb266dc5dede36e0d96e4f55b76f016e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZIGPLW~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NZFN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2640	ZIGPLW~1.EXE
2640	ZIGPLW~1.EXE
2640	ZIGPLW~1.EXE
2640	ZIGPLW~1.EXE
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe
2760	NZFN.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
2712	RegSvcs.exe
820	RegSvcs.exe
992	RegSvcs.exe
2156	RegSvcs.exe
908	RegSvcs.exe
2984	RegSvcs.exe
1592	RegSvcs.exe
2536	RegSvcs.exe
944	RegSvcs.exe
1136	RegSvcs.exe
2116	RegSvcs.exe
2072	RegSvcs.exe
1504	RegSvcs.exe
2784	RegSvcs.exe
2812	RegSvcs.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2640	2196	bb266dc5dede36e0d96e4f55b76f016e_JaffaCakes118.exe	30
PID 2196 wrote to memory of 2640	2196	bb266dc5dede36e0d96e4f55b76f016e_JaffaCakes118.exe	30
PID 2196 wrote to memory of 2640	2196	bb266dc5dede36e0d96e4f55b76f016e_JaffaCakes118.exe	30
PID 2196 wrote to memory of 2640	2196	bb266dc5dede36e0d96e4f55b76f016e_JaffaCakes118.exe	30
PID 2196 wrote to memory of 2640	2196	bb266dc5dede36e0d96e4f55b76f016e_JaffaCakes118.exe	30
PID 2196 wrote to memory of 2640	2196	bb266dc5dede36e0d96e4f55b76f016e_JaffaCakes118.exe	30
PID 2196 wrote to memory of 2640	2196	bb266dc5dede36e0d96e4f55b76f016e_JaffaCakes118.exe	30
PID 2640 wrote to memory of 2760	2640	ZIGPLW~1.EXE	31
PID 2640 wrote to memory of 2760	2640	ZIGPLW~1.EXE	31
PID 2640 wrote to memory of 2760	2640	ZIGPLW~1.EXE	31
PID 2640 wrote to memory of 2760	2640	ZIGPLW~1.EXE	31
PID 2640 wrote to memory of 2760	2640	ZIGPLW~1.EXE	31
PID 2640 wrote to memory of 2760	2640	ZIGPLW~1.EXE	31
PID 2640 wrote to memory of 2760	2640	ZIGPLW~1.EXE	31
PID 2760 wrote to memory of 2712	2760	NZFN.exe	32
PID 2760 wrote to memory of 2712	2760	NZFN.exe	32
PID 2760 wrote to memory of 2712	2760	NZFN.exe	32
PID 2760 wrote to memory of 2712	2760	NZFN.exe	32
PID 2760 wrote to memory of 2712	2760	NZFN.exe	32
PID 2760 wrote to memory of 2712	2760	NZFN.exe	32
PID 2760 wrote to memory of 2712	2760	NZFN.exe	32
PID 2760 wrote to memory of 2712	2760	NZFN.exe	32
PID 2760 wrote to memory of 2712	2760	NZFN.exe	32
PID 2712 wrote to memory of 2996	2712	RegSvcs.exe	33
PID 2712 wrote to memory of 2996	2712	RegSvcs.exe	33
PID 2712 wrote to memory of 2996	2712	RegSvcs.exe	33
PID 2712 wrote to memory of 2996	2712	RegSvcs.exe	33
PID 2712 wrote to memory of 2996	2712	RegSvcs.exe	33
PID 2712 wrote to memory of 2996	2712	RegSvcs.exe	33
PID 2712 wrote to memory of 2996	2712	RegSvcs.exe	33
PID 2712 wrote to memory of 2996	2712	RegSvcs.exe	33
PID 2712 wrote to memory of 2996	2712	RegSvcs.exe	33
PID 2712 wrote to memory of 2996	2712	RegSvcs.exe	33
PID 2712 wrote to memory of 2996	2712	RegSvcs.exe	33
PID 2712 wrote to memory of 2996	2712	RegSvcs.exe	33
PID 2712 wrote to memory of 236	2712	RegSvcs.exe	34
PID 2712 wrote to memory of 236	2712	RegSvcs.exe	34
PID 2712 wrote to memory of 236	2712	RegSvcs.exe	34
PID 2712 wrote to memory of 236	2712	RegSvcs.exe	34
PID 2712 wrote to memory of 236	2712	RegSvcs.exe	34
PID 2712 wrote to memory of 236	2712	RegSvcs.exe	34
PID 2712 wrote to memory of 236	2712	RegSvcs.exe	34
PID 2712 wrote to memory of 236	2712	RegSvcs.exe	34
PID 2712 wrote to memory of 236	2712	RegSvcs.exe	34
PID 2712 wrote to memory of 236	2712	RegSvcs.exe	34
PID 2712 wrote to memory of 236	2712	RegSvcs.exe	34
PID 2712 wrote to memory of 236	2712	RegSvcs.exe	34
PID 2760 wrote to memory of 820	2760	NZFN.exe	36
PID 2760 wrote to memory of 820	2760	NZFN.exe	36
PID 2760 wrote to memory of 820	2760	NZFN.exe	36
PID 2760 wrote to memory of 820	2760	NZFN.exe	36
PID 2760 wrote to memory of 820	2760	NZFN.exe	36
PID 2760 wrote to memory of 820	2760	NZFN.exe	36
PID 2760 wrote to memory of 820	2760	NZFN.exe	36
PID 2760 wrote to memory of 820	2760	NZFN.exe	36
PID 2760 wrote to memory of 820	2760	NZFN.exe	36
PID 820 wrote to memory of 1456	820	RegSvcs.exe	37
PID 820 wrote to memory of 1456	820	RegSvcs.exe	37
PID 820 wrote to memory of 1456	820	RegSvcs.exe	37
PID 820 wrote to memory of 1456	820	RegSvcs.exe	37
PID 820 wrote to memory of 1456	820	RegSvcs.exe	37
PID 820 wrote to memory of 1456	820	RegSvcs.exe	37
PID 820 wrote to memory of 1456	820	RegSvcs.exe	37
PID 820 wrote to memory of 1456	820	RegSvcs.exe	37

C:\Users\Admin\AppData\Local\Temp\bb266dc5dede36e0d96e4f55b76f016e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bb266dc5dede36e0d96e4f55b76f016e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ZIGPLW~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ZIGPLW~1.EXE
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Users\Admin\AppData\Roaming\NZFN.exe
    "C:\Users\Admin\AppData\Roaming\NZFN.exe" "C:\Users\Admin\AppData\Roaming\aOLbK"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2712
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\nO44e7JPpJ.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2996
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\5JhJK6zjQx.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:236
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:820
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\gyjwamzQXu.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1456
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\zncNdd1gLu.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:1332
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:1496
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:992
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\9xY74Ettgr.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1704
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\mbaIPnBIHo.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:1256
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2156
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\D9m77zu0sh.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1524
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\GaRO7XDLe5.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:2320
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:908
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\i0DlJyEFWa.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1760
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\XXANgO0sIS.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:3012
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2984
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\Wshzd4ouG8.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2212
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\epWenAQTzw.ini"
        5⤵
        
        PID:876
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1592
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\AlgBYsj5zG.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2636
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\vHG5T9IIFy.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:2692
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2536
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\TnbHeKCHax.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2528
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\V2YZyuLG0i.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:2476
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:944
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\IYiobv2qdW.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2084
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\uWzbt5x01p.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:820
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:1808
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1136
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\NnWhpSiu65.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1628
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\efM14BiVG0.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:2208
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2116
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\ytWrskekcR.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1604
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\lGrgcy9qHq.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:960
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2072
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\GzHRXSJOt8.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1364
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\OkGxFh1zXx.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:956
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1504
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\2zOmXV0kXz.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1908
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\AjNIFliLBp.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:2268
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2784
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\8atR5IR5Yq.ini"
        5⤵
        
        PID:1800
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\VvDbqSGlju.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:2816
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2812
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\LgVvdagwHq.ini"
        5⤵
        
        PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\NZFN1

Filesize
915KB

MD5
4744edba858885bfe4d513e5ba6030ac

SHA1
7706ebc3097465571daf5bc0c26721a79e8b50c2

SHA256
b71c08e936ab72a27a822e2984a60e798591d2b71b352875f6aede464245724b

SHA512
14cf08f1227f320e36ed9b50de68fffea72393f59b921e81ad987f8cd19d9b3766f601063df474b99b6b948a8431232c900577ab633a3d8f13de0b2f69a36685

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aOLbK

Filesize
492KB

MD5
76896ab4efb7ebe843ab20b057417a94

SHA1
b2840a927224f8720ef5679ac1b33ffcbe97786a

SHA256
7bb7658d3556514c30c7d429ca98c4c484d318e1c338a371278f8deb5bb58fc5

SHA512
62c11f5775168c6ee9f5e2dd07efa31f801220ff494e537fd7f167b4a5115b9838ca7d159912f75d5d0ea4796b0716892e0d3787685399ad2841622d45b88a52

Download Submit
C:\Users\Admin\AppData\Local\Temp\nO44e7JPpJ.ini

Filesize
5B

MD5
d1ea279fb5559c020a1b4137dc4de237

SHA1
db6f8988af46b56216a6f0daf95ab8c9bdb57400

SHA256
fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba

SHA512
720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3

Download Submit
C:\Users\Admin\AppData\Roaming\aOLbK

Filesize
369KB

MD5
f5c1b2bce1a97ddb44b1db99bc912d3f

SHA1
750b5f15a4aad076ab884383ee9b6c9401b2dd46

SHA256
c862d73341d3ab363f21e978a320d4230576d555ccb3ba9e572a724bc4227092

SHA512
aafefc4a2e4615a31a0d76609ea465f19c0cf0241d849206bf49c9e9cebcfc3d770c299d5c31f8b519703b2823f95a61d5976b6f30f21db79e50479a0d24a2b4

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\ZIGPLW~1.EXE

Filesize
1.8MB

MD5
91c3a3144ffc7eb4e31dcc26e1301dcd

SHA1
900cb5d4062f121a393a9f5e1ad0cae44a7f401f

SHA256
7f4ac188d059db1001070cf83635b00bfbdcb5c85fde88752dca479ffdefbd3c

SHA512
762d02d3de6dfef495fb44d51b2145ac48416a4123754c021fccfabf80f7b808e57129e5bacb78c5919ad4fa88b11ef555a3fb379c8a8d5f62ee94140b4584e7

Download Submit
\Users\Admin\AppData\Roaming\NZFN.exe

Filesize
915KB

MD5
b06e67f9767e5023892d9698703ad098

SHA1
acc07666f4c1d4461d3e1c263cf6a194a8dd1544

SHA256
8498900e57a490404e7ec4d8159bee29aed5852ae88bd484141780eaadb727bb

SHA512
7972c78acebdd86c57d879c12cb407120155a24a52fda23ddb7d9e181dd59dac1eb74f327817adbc364d37c8dc704f8236f3539b4d3ee5a022814924a1616943

Download Submit
memory/236-49-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/236-50-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/236-47-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/236-48-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/820-55-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/992-72-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1332-69-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1332-68-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1332-67-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1456-62-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1456-61-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1456-63-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2156-89-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2712-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2712-52-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2712-34-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2712-36-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2712-51-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2984-123-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2996-43-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2996-42-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2996-41-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2996-44-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download