isrstealer | f2acdba3b1e8794ceb3923de7ca8d192f68894e49b37f84fa6723aeb97366d88

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-01-2025 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
Size

657KB
MD5

6a578b50b62fa21da49e9368b1de3fa0
SHA1

dbbf4a09afb8fd6effe5791b4fd1774f31135768
SHA256

f2acdba3b1e8794ceb3923de7ca8d192f68894e49b37f84fa6723aeb97366d88
SHA512

7cd8a9ef4f346be5d7564863299c43ba1e5abf74ac0547c8e94b98d7ea2ee9996e32c62db3acd1e3d800599089484ea2b65efa547d4c31b0fb26eb0ef8aba803
SSDEEP

12288:d4huhKnDCVjOBi4LGqk2YugOpgxA2jkswofn1aKHjl:dguoDoOInL2Vgogh/ww1

Score

10^/10

isrstealer collection discovery persistence stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 9 IoCs

resource	yara_rule
behavioral2/memory/3728-5-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/3728-7-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/3728-20-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/4528-25-0x0000000006F20000-0x0000000007020000-memory.dmp	family_isrstealer
behavioral2/memory/4528-26-0x0000000006F20000-0x0000000007020000-memory.dmp	family_isrstealer
behavioral2/memory/704-41-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/3728-54-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/3728-56-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/704-68-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer

Isrstealer family
isrstealer

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/4168-47-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4168-47-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView

Accesses Microsoft Outlook accounts 1 TTPs 26 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AppLaunch.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\IE Per-User Initialization utility = "C:\\Users\\Admin\\AppData\\Local\\JavaUpdater.exe"	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 4528 set thread context of 3728	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	83
PID 3728 set thread context of 3068	3728	AppLaunch.exe	84
PID 4528 set thread context of 704	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	85
PID 704 set thread context of 4492	704	AppLaunch.exe	86
PID 3728 set thread context of 4168	3728	AppLaunch.exe	90
PID 704 set thread context of 4108	704	AppLaunch.exe	97
PID 4528 set thread context of 3208	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	100
PID 3208 set thread context of 3196	3208	AppLaunch.exe	101
PID 4528 set thread context of 3820	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	102
PID 3820 set thread context of 2480	3820	AppLaunch.exe	103
PID 3208 set thread context of 4316	3208	AppLaunch.exe	109
PID 3820 set thread context of 1868	3820	AppLaunch.exe	111
PID 4528 set thread context of 1940	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	112
PID 1940 set thread context of 2916	1940	AppLaunch.exe	113
PID 4528 set thread context of 1820	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	114
PID 1820 set thread context of 2284	1820	AppLaunch.exe	115
PID 1940 set thread context of 2144	1940	AppLaunch.exe	118
PID 1820 set thread context of 2364	1820	AppLaunch.exe	121
PID 4528 set thread context of 1936	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	123
PID 1936 set thread context of 1412	1936	AppLaunch.exe	124
PID 4528 set thread context of 1104	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	125
PID 1104 set thread context of 404	1104	AppLaunch.exe	126
PID 1936 set thread context of 3164	1936	AppLaunch.exe	128
PID 1104 set thread context of 2688	1104	AppLaunch.exe	130
PID 4528 set thread context of 4356	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	131
PID 4356 set thread context of 4232	4356	AppLaunch.exe	132
PID 4528 set thread context of 4048	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	133
PID 4048 set thread context of 2684	4048	AppLaunch.exe	134
PID 4356 set thread context of 4708	4356	AppLaunch.exe	136
PID 4048 set thread context of 1708	4048	AppLaunch.exe	138
PID 4528 set thread context of 1356	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	139
PID 1356 set thread context of 4300	1356	AppLaunch.exe	140
PID 4528 set thread context of 760	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	141
PID 760 set thread context of 3756	760	AppLaunch.exe	142
PID 1356 set thread context of 2508	1356	AppLaunch.exe	144
PID 760 set thread context of 4044	760	AppLaunch.exe	146
PID 4528 set thread context of 2052	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	147
PID 2052 set thread context of 2720	2052	AppLaunch.exe	148
PID 4528 set thread context of 2300	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	149
PID 2300 set thread context of 948	2300	AppLaunch.exe	150
PID 2052 set thread context of 3824	2052	AppLaunch.exe	152
PID 2300 set thread context of 4952	2300	AppLaunch.exe	154
PID 4528 set thread context of 2064	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	155
PID 2064 set thread context of 5024	2064	AppLaunch.exe	156
PID 4528 set thread context of 5056	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	157
PID 5056 set thread context of 4916	5056	AppLaunch.exe	158
PID 2064 set thread context of 1080	2064	AppLaunch.exe	160
PID 5056 set thread context of 1480	5056	AppLaunch.exe	162
PID 4528 set thread context of 348	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	163
PID 348 set thread context of 404	348	AppLaunch.exe	164
PID 4528 set thread context of 4312	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	165
PID 4312 set thread context of 1120	4312	AppLaunch.exe	166
PID 348 set thread context of 5048	348	AppLaunch.exe	168
PID 4312 set thread context of 4964	4312	AppLaunch.exe	170
PID 4528 set thread context of 1144	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	171
PID 1144 set thread context of 4068	1144	AppLaunch.exe	172
PID 4528 set thread context of 4704	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	173
PID 4704 set thread context of 860	4704	AppLaunch.exe	174
PID 1144 set thread context of 1048	1144	AppLaunch.exe	176
PID 4704 set thread context of 2508	4704	AppLaunch.exe	178
PID 4528 set thread context of 3916	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	179
PID 3916 set thread context of 4328	3916	AppLaunch.exe	180
PID 4528 set thread context of 3032	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	181
PID 3032 set thread context of 3768	3032	AppLaunch.exe	182

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3068-12-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/3068-14-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/3068-15-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/3068-18-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/4492-39-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/4168-45-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4168-46-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4168-47-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/3196-62-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/3196-63-0x0000000000400000-0x0000000000453000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe

Suspicious use of SetWindowsHookEx 27 IoCs

pid	Process
3728	AppLaunch.exe
704	AppLaunch.exe
3208	AppLaunch.exe
3820	AppLaunch.exe
1940	AppLaunch.exe
1820	AppLaunch.exe
1936	AppLaunch.exe
1104	AppLaunch.exe
4356	AppLaunch.exe
4048	AppLaunch.exe
1356	AppLaunch.exe
760	AppLaunch.exe
2052	AppLaunch.exe
2300	AppLaunch.exe
2064	AppLaunch.exe
5056	AppLaunch.exe
348	AppLaunch.exe
4312	AppLaunch.exe
1144	AppLaunch.exe
4704	AppLaunch.exe
3916	AppLaunch.exe
3032	AppLaunch.exe
1980	AppLaunch.exe
1424	AppLaunch.exe
396	AppLaunch.exe
3012	AppLaunch.exe
836	AppLaunch.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 3728	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	83
PID 4528 wrote to memory of 3728	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	83
PID 4528 wrote to memory of 3728	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	83
PID 4528 wrote to memory of 3728	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	83
PID 4528 wrote to memory of 3728	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	83
PID 4528 wrote to memory of 3728	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	83
PID 4528 wrote to memory of 3728	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	83
PID 4528 wrote to memory of 3728	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	83
PID 3728 wrote to memory of 3068	3728	AppLaunch.exe	84
PID 3728 wrote to memory of 3068	3728	AppLaunch.exe	84
PID 3728 wrote to memory of 3068	3728	AppLaunch.exe	84
PID 3728 wrote to memory of 3068	3728	AppLaunch.exe	84
PID 3728 wrote to memory of 3068	3728	AppLaunch.exe	84
PID 3728 wrote to memory of 3068	3728	AppLaunch.exe	84
PID 3728 wrote to memory of 3068	3728	AppLaunch.exe	84
PID 3728 wrote to memory of 3068	3728	AppLaunch.exe	84
PID 4528 wrote to memory of 704	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	85
PID 4528 wrote to memory of 704	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	85
PID 4528 wrote to memory of 704	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	85
PID 4528 wrote to memory of 704	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	85
PID 4528 wrote to memory of 704	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	85
PID 4528 wrote to memory of 704	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	85
PID 4528 wrote to memory of 704	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	85
PID 4528 wrote to memory of 704	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	85
PID 704 wrote to memory of 4492	704	AppLaunch.exe	86
PID 704 wrote to memory of 4492	704	AppLaunch.exe	86
PID 704 wrote to memory of 4492	704	AppLaunch.exe	86
PID 704 wrote to memory of 4492	704	AppLaunch.exe	86
PID 704 wrote to memory of 4492	704	AppLaunch.exe	86
PID 704 wrote to memory of 4492	704	AppLaunch.exe	86
PID 704 wrote to memory of 4492	704	AppLaunch.exe	86
PID 704 wrote to memory of 4492	704	AppLaunch.exe	86
PID 3728 wrote to memory of 4168	3728	AppLaunch.exe	90
PID 3728 wrote to memory of 4168	3728	AppLaunch.exe	90
PID 3728 wrote to memory of 4168	3728	AppLaunch.exe	90
PID 3728 wrote to memory of 4168	3728	AppLaunch.exe	90
PID 3728 wrote to memory of 4168	3728	AppLaunch.exe	90
PID 3728 wrote to memory of 4168	3728	AppLaunch.exe	90
PID 3728 wrote to memory of 4168	3728	AppLaunch.exe	90
PID 3728 wrote to memory of 4168	3728	AppLaunch.exe	90
PID 704 wrote to memory of 4108	704	AppLaunch.exe	97
PID 704 wrote to memory of 4108	704	AppLaunch.exe	97
PID 704 wrote to memory of 4108	704	AppLaunch.exe	97
PID 704 wrote to memory of 4108	704	AppLaunch.exe	97
PID 704 wrote to memory of 4108	704	AppLaunch.exe	97
PID 704 wrote to memory of 4108	704	AppLaunch.exe	97
PID 704 wrote to memory of 4108	704	AppLaunch.exe	97
PID 704 wrote to memory of 4108	704	AppLaunch.exe	97
PID 4528 wrote to memory of 3208	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	100
PID 4528 wrote to memory of 3208	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	100
PID 4528 wrote to memory of 3208	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	100
PID 4528 wrote to memory of 3208	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	100
PID 4528 wrote to memory of 3208	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	100
PID 4528 wrote to memory of 3208	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	100
PID 4528 wrote to memory of 3208	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	100
PID 4528 wrote to memory of 3208	4528	JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe	100
PID 3208 wrote to memory of 3196	3208	AppLaunch.exe	101
PID 3208 wrote to memory of 3196	3208	AppLaunch.exe	101
PID 3208 wrote to memory of 3196	3208	AppLaunch.exe	101
PID 3208 wrote to memory of 3196	3208	AppLaunch.exe	101
PID 3208 wrote to memory of 3196	3208	AppLaunch.exe	101
PID 3208 wrote to memory of 3196	3208	AppLaunch.exe	101
PID 3208 wrote to memory of 3196	3208	AppLaunch.exe	101
PID 3208 wrote to memory of 3196	3208	AppLaunch.exe	101

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a578b50b62fa21da49e9368b1de3fa0.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\X4NAJHRHQv.ini"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3068
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\ksMEoySygC.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:4168
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:704
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\gGw8Z8zEhj.ini"
    3⤵
    PID:4492
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\Dbl8jK2N64.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:4108
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\XgfvBITm3e.ini"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3196
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\oWlu9oIK15.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:4316
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3820
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\NBCMtAsaet.ini"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2480
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\qSyH37O4nl.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:1868
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1940
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\U6fAh1ajRj.ini"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2916
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\8CrDKu9Nyr.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:2144
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1820
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\V1tXaKfTDP.ini"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2284
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\mNx3RhQiZA.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:2364
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1936
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\3GYQI4mz3l.ini"
    3⤵
    PID:1412
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\xNUxFmeXdU.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:3164
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  PID:1104
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\CR8JnDTWYu.ini"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:404
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\jnxJxPWfxF.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:2688
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4356
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\kBoec7fL0v.ini"
    3⤵
    PID:4232
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\iT4c9Qb13d.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:4708
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4048
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\m611WPk5mc.ini"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2684
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\3y45FeR2Wh.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:1708
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  PID:1356
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\dXko8aFc8X.ini"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4300
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\X8ioBRATKv.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:2508
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:760
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\T1HFqSdQim.ini"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3756
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\34PDT6gQzR.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:4044
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2052
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\ptoE9jBdcX.ini"
    3⤵
    PID:2720
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\clAK0rH06S.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:3824
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2300
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\xAxoFpd3yf.ini"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:948
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\tC7i6qaLJ3.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:4952
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  PID:2064
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\tekhrFeGa3.ini"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5024
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\XF036rZOAX.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:1080
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5056
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\XpqXy2ubCM.ini"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4916
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\rYKKVsl2Up.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:1480
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  PID:348
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\aZ0vBHXcXE.ini"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:404
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\Q6wkUB4OgT.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:5048
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4312
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\dQQfzth65a.ini"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1120
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\fDyWXtKUl6.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:4964
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  PID:1144
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\xQSaCGbPAK.ini"
    3⤵
    PID:4068
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\zlpTDOLwuB.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:1048
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4704
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\pqBOoQ5xWF.ini"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:860
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\dYB8xuVBvs.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:2508
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3916
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\fLioWIUl6U.ini"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4328
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\bI44GcWnEZ.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:2916
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3032
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\Xgey1m33F5.ini"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3768
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\LTRMGxOXs2.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:2380
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1980
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\NBBPjdSrpK.ini"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3824
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\A9rdoEobmz.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:2600
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1424
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\ThFOGazB6p.ini"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3676
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\Pebe0u1DDu.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:2944
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:396
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\CXizUvxGof.ini"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1984
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\9o1mVoA8I2.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:3160
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3012
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\DTvMOE20aL.ini"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:700
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\Pw2dJEIe9L.ini"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:4796
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:836
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    /scomma "C:\Users\Admin\AppData\Local\Temp\KOOAB5kAOB.ini"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\X4NAJHRHQv.ini

Filesize
5B

MD5
d1ea279fb5559c020a1b4137dc4de237

SHA1
db6f8988af46b56216a6f0daf95ab8c9bdb57400

SHA256
fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba

SHA512
720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3

Download Submit
memory/704-68-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/704-41-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3068-12-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3068-18-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3068-15-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3068-14-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3196-62-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3196-63-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3728-56-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3728-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3728-54-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3728-5-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3728-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4168-47-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4168-46-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4168-45-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4492-39-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4528-21-0x0000000006DD0000-0x0000000006E27000-memory.dmp

Filesize
348KB

Download
memory/4528-67-0x0000000006F20000-0x0000000007020000-memory.dmp

Filesize
1024KB

Download
memory/4528-0-0x0000000075232000-0x0000000075233000-memory.dmp

Filesize
4KB

Download
memory/4528-33-0x0000000006F20000-0x0000000007020000-memory.dmp

Filesize
1024KB

Download
memory/4528-26-0x0000000006F20000-0x0000000007020000-memory.dmp

Filesize
1024KB

Download
memory/4528-40-0x0000000006F20000-0x0000000007020000-memory.dmp

Filesize
1024KB

Download
memory/4528-29-0x0000000006F20000-0x0000000007020000-memory.dmp

Filesize
1024KB

Download
memory/4528-42-0x0000000075230000-0x00000000757E1000-memory.dmp

Filesize
5.7MB

Download
memory/4528-43-0x0000000075232000-0x0000000075233000-memory.dmp

Filesize
4KB

Download
memory/4528-27-0x0000000006F20000-0x0000000007020000-memory.dmp

Filesize
1024KB

Download
memory/4528-1-0x0000000075230000-0x00000000757E1000-memory.dmp

Filesize
5.7MB

Download
memory/4528-36-0x0000000006F20000-0x0000000007020000-memory.dmp

Filesize
1024KB

Download
memory/4528-53-0x0000000075230000-0x00000000757E1000-memory.dmp

Filesize
5.7MB

Download
memory/4528-52-0x0000000075230000-0x00000000757E1000-memory.dmp

Filesize
5.7MB

Download
memory/4528-37-0x0000000006F20000-0x0000000007020000-memory.dmp

Filesize
1024KB

Download
memory/4528-17-0x0000000075230000-0x00000000757E1000-memory.dmp

Filesize
5.7MB

Download
memory/4528-55-0x0000000006F20000-0x0000000007020000-memory.dmp

Filesize
1024KB

Download
memory/4528-11-0x0000000075230000-0x00000000757E1000-memory.dmp

Filesize
5.7MB

Download
memory/4528-8-0x0000000075230000-0x00000000757E1000-memory.dmp

Filesize
5.7MB

Download
memory/4528-2-0x0000000075230000-0x00000000757E1000-memory.dmp

Filesize
5.7MB

Download
memory/4528-65-0x0000000006F20000-0x0000000007020000-memory.dmp

Filesize
1024KB

Download
memory/4528-19-0x0000000075230000-0x00000000757E1000-memory.dmp

Filesize
5.7MB

Download
memory/4528-66-0x0000000006F20000-0x0000000007020000-memory.dmp

Filesize
1024KB

Download
memory/4528-25-0x0000000006F20000-0x0000000007020000-memory.dmp

Filesize
1024KB

Download