gozi | b4259c0ecf8b473142db1e4425a05528446b07973c706607cb9c37b03c0ff870

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-12-2024 00:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
Size

368KB
MD5

e8fae2f950bb7a79457c05d957006392
SHA1

0d4a08392699c268dfcd9bafa1ca8f9e5055feac
SHA256

b4259c0ecf8b473142db1e4425a05528446b07973c706607cb9c37b03c0ff870
SHA512

8949430a3cddee9f67d67aceefe3dadda728e95ce4322ad9baa9ca3b323e32d7476fdfa49c5811f7fe4055c0b8a30ba837f7a914aa91037259bb22e06b98b87e
SSDEEP

6144:k9u3dsbuTWxXJtDBFP9IXBc3/EGrs5O3zdqTLxMS:P3dsbtlYRyXrsizd0LSS

Score

10^/10

gozi neshta banker discovery persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Detect Neshta payload 5 IoCs

resource	yara_rule
behavioral1/files/0x0001000000010314-13.dat	family_neshta
behavioral1/memory/2540-93-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/files/0x0008000000016dd2-98.dat	family_neshta
behavioral1/memory/2244-115-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2244-147-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Gozi family
gozi
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta
Event Triggered Execution: AppCert DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes.
persistence privilege_escalation

AppCert DLLs
T1546.009

Executes dropped EXE 2 IoCs

pid	Process
1732	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
2244	svchost.com

Loads dropped DLL 3 IoCs

pid	Process
2540	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
2540	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
2540	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1732 set thread context of 2696	1732	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe	35
PID 2696 set thread context of 1100	2696	cmd.exe	38

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\Windows\getmskey.dll	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\Windows\getmskey64.dll	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1732	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1732	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
1732	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
2244	svchost.com
2244	svchost.com
2696	cmd.exe
2696	cmd.exe
1244	rundll32.exe
1244	rundll32.exe
2716	rundll32.exe
2716	rundll32.exe
1100	attrib.exe
1100	attrib.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 1732	2540	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe	30
PID 2540 wrote to memory of 1732	2540	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe	30
PID 2540 wrote to memory of 1732	2540	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe	30
PID 2540 wrote to memory of 1732	2540	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe	30
PID 1732 wrote to memory of 2244	1732	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe	32
PID 1732 wrote to memory of 2244	1732	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe	32
PID 1732 wrote to memory of 2244	1732	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe	32
PID 1732 wrote to memory of 2244	1732	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe	32
PID 1732 wrote to memory of 2696	1732	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe	35
PID 1732 wrote to memory of 2696	1732	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe	35
PID 1732 wrote to memory of 2696	1732	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe	35
PID 1732 wrote to memory of 2696	1732	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe	35
PID 1732 wrote to memory of 2696	1732	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe	35
PID 1732 wrote to memory of 2696	1732	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe	35
PID 1732 wrote to memory of 2696	1732	e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe	35
PID 2244 wrote to memory of 1244	2244	svchost.com	34
PID 2244 wrote to memory of 1244	2244	svchost.com	34
PID 2244 wrote to memory of 1244	2244	svchost.com	34
PID 2244 wrote to memory of 1244	2244	svchost.com	34
PID 2244 wrote to memory of 1244	2244	svchost.com	34
PID 2244 wrote to memory of 1244	2244	svchost.com	34
PID 2244 wrote to memory of 1244	2244	svchost.com	34
PID 2696 wrote to memory of 1100	2696	cmd.exe	38
PID 2696 wrote to memory of 1100	2696	cmd.exe	38
PID 2696 wrote to memory of 1100	2696	cmd.exe	38
PID 2696 wrote to memory of 1100	2696	cmd.exe	38
PID 2696 wrote to memory of 1100	2696	cmd.exe	38
PID 2696 wrote to memory of 1100	2696	cmd.exe	38
PID 2696 wrote to memory of 1100	2696	cmd.exe	38
PID 1244 wrote to memory of 2716	1244	rundll32.exe	37
PID 1244 wrote to memory of 2716	1244	rundll32.exe	37
PID 1244 wrote to memory of 2716	1244	rundll32.exe	37
PID 1244 wrote to memory of 2716	1244	rundll32.exe	37
PID 2716 wrote to memory of 1208	2716	rundll32.exe	21
PID 2716 wrote to memory of 1208	2716	rundll32.exe	21

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1100	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Users\Admin\AppData\Local\Temp\e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Modifies system executable filetype association
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Users\Admin\AppData\Local\Temp\3582-490\e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3582-490\e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\rundll32.exe" "C:\Windows\getmskey64.dll",CreateProcessNotify
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2244
    - - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\System32\rundll32.exe "C:\Windows\getmskey64.dll",CreateProcessNotify
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1244
      - C:\Windows\system32\rundll32.exe
        
        C:\Windows\System32\rundll32.exe "C:\Windows\getmskey64.dll",CreateProcessNotify
        6⤵
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2716
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\3582-490\259448164.bat" "C:\Users\Admin\AppData\Local\Temp\3582-490\e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe""
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2696
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\3582-490\e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Views/modifies file attributes
        
        PID:1100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppCert DLLs

T1546.009

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

AppCert DLLs

T1546.009

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

Filesize
547KB

MD5
cf6c595d3e5e9667667af096762fd9c4

SHA1
9bb44da8d7f6457099cb56e4f7d1026963dce7ce

SHA256
593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

SHA512
ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\259448164.bat

Filesize
76B

MD5
76e38574bf3083c9358f759ecdf187c4

SHA1
c831cee5a753ebae70e0a6a3fa1146a4da7ffe43

SHA256
cc51245065ff62609b870b9b5b88bb3a1650f4abeb7bd4370b7b603fdcb4e1ff

SHA512
7a703249855e0720546c306de36997bc9e1ec0c8678e72264415916dde3c22e059bb6b237862e904b2c6a2414dc38489593d032dc3228aab3192b23c600bc14d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5023.tmp

Filesize
8B

MD5
4fcb79f7d2814a96fd7e26ddfd78f530

SHA1
f05c1e503eade82e70b3c779470e4650f6c6d231

SHA256
f0c72eb2f568ef509e8b07132911d593f543c8ec4bcf40a06fb5fc026cb5e622

SHA512
1325f19e33d19da5d60c7faac15420472f801594c8138b9455d84932ac6c2a3cec6aa6bddf91339f9256420e7d5ab021ae9662b6054b385f692ce736de877871

Download Submit
C:\Windows\getmskey.dll

Filesize
120KB

MD5
2588fe250ea4c3e4628cf17ffbcef10f

SHA1
cffbf87e0d352068c10f25905c0a339a6ad04134

SHA256
481131fde1cc2c4d0f7a766dd40956de4aa14622c1cab8887cf89e3f6ced2751

SHA512
c17efb076aa3f25ee6fa2a2dab03b5b5e225df42d081b86175d7a94eda226d4eec6885b203f197188a290b98a444d5c58e9587855fdf34f088f6e1d3a99d9959

Download Submit
C:\Windows\getmskey64.dll

Filesize
115KB

MD5
f51634df3e4ffc24e147d8d7f1d4b538

SHA1
a978cbda3712d631f505de35cb79b38ddb38b954

SHA256
0e51d0f026fccdb3a4c9dcbf7a7ec88c11439187fad53796edd33a99238140f5

SHA512
3f0c7b7097cf3d1c1d3c09545fea3c4adb5bcb43e90fffb667ba687f741d43ae78ca63d4826864ec1696474480f65ee9d0dbf900df8de169edf2b42d7ac2824b

Download Submit
C:\Windows\svchost.com

Filesize
40KB

MD5
36fd5e09c417c767a952b4609d73a54b

SHA1
299399c5a2403080a5bf67fb46faec210025b36d

SHA256
980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2

SHA512
1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\e8fae2f950bb7a79457c05d957006392_JaffaCakes118.exe

Filesize
328KB

MD5
ff0392c16d04c2dabf51839648859cff

SHA1
bc232ecc6a858f2b8bd7ef63ec463674e0340af8

SHA256
c61a824c8e30061b87616559a903974d30309f470c3e788fafa9b8e0cea191e8

SHA512
6541d8597fe0a0018cc33dde656d2d7773cfd136682b6fe52d26ffec43dda8666520f8c82787cfbcdd904ac9c7359e45d7c84ba13f350e5a8a6934cc095a0085

Download Submit
memory/1100-146-0x0000000073C40000-0x0000000073C5F000-memory.dmp

Filesize
124KB

Download
memory/1100-125-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1208-140-0x0000000074A00000-0x0000000074A2A000-memory.dmp

Filesize
168KB

Download
memory/1208-135-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

Filesize
4KB

Download
memory/1208-151-0x0000000074A00000-0x0000000074A2A000-memory.dmp

Filesize
168KB

Download
memory/1244-145-0x0000000073C40000-0x0000000073C5F000-memory.dmp

Filesize
124KB

Download
memory/1244-126-0x0000000073C40000-0x0000000073C5F000-memory.dmp

Filesize
124KB

Download
memory/1732-118-0x0000000073C40000-0x0000000073C5F000-memory.dmp

Filesize
124KB

Download
memory/1732-16-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1732-117-0x0000000001000000-0x0000000001053000-memory.dmp

Filesize
332KB

Download
memory/1732-14-0x0000000001000000-0x0000000001053000-memory.dmp

Filesize
332KB

Download
memory/1732-96-0x0000000073C40000-0x0000000073C5F000-memory.dmp

Filesize
124KB

Download
memory/1732-95-0x0000000073C40000-0x0000000073C5F000-memory.dmp

Filesize
124KB

Download
memory/1732-94-0x0000000001000000-0x0000000001053000-memory.dmp

Filesize
332KB

Download
memory/2244-116-0x0000000073C40000-0x0000000073C5F000-memory.dmp

Filesize
124KB

Download
memory/2244-115-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2244-148-0x0000000073C40000-0x0000000073C5F000-memory.dmp

Filesize
124KB

Download
memory/2244-129-0x0000000073C40000-0x0000000073C5F000-memory.dmp

Filesize
124KB

Download
memory/2244-147-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2540-93-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2696-112-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2696-127-0x0000000073C40000-0x0000000073C5F000-memory.dmp

Filesize
124KB

Download
memory/2696-149-0x0000000073C40000-0x0000000073C5F000-memory.dmp

Filesize
124KB

Download
memory/2696-114-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2716-131-0x0000000074A00000-0x0000000074A2A000-memory.dmp

Filesize
168KB

Download