Analysis
-
max time kernel
117s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06-01-2025 17:01
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_2f8eb2e173c93dae1ddd17031ee8aa0e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_2f8eb2e173c93dae1ddd17031ee8aa0e.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_2f8eb2e173c93dae1ddd17031ee8aa0e.exe
-
Size
5.8MB
-
MD5
2f8eb2e173c93dae1ddd17031ee8aa0e
-
SHA1
9f79361ac3b2d4eae624b8a0c5edf060e4c8d2ff
-
SHA256
365f984abe68ddd398d7b749fb0e69b0f29daf86f0e3e39af3573bb78a265eb9
-
SHA512
018b520f99154bb496ebce3bd7aecb6978608689ddf36444e60d47a547b55d07c03b2789243a27c5516e5fd930a20e5bade69ff72db5afa040b04205493b20cb
-
SSDEEP
98304:yo+BLKm54bo+f1XhdeQ9jVRUgwuZnQtgmqQI81pPQ92RSM6r+rNnYi:yo+ZKmqo4rLfUpuWJI81pqnQyi
Malware Config
Extracted
nullmixer
http://marisana.xyz/
Extracted
cryptbot
lysuht78.top
morisc07.top
-
payload_url
http://damysa10.top/download.php?file=lv.exe
Signatures
-
CryptBot payload 1 IoCs
resource yara_rule behavioral1/memory/1840-411-0x0000000000400000-0x0000000002D19000-memory.dmp family_cryptbot -
Cryptbot family
-
Nullmixer family
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Privateloader family
-
Vidar family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Sun152c6e5fac04c1.exe -
Vidar Stealer 1 IoCs
resource yara_rule behavioral1/memory/2876-412-0x0000000000400000-0x0000000002D15000-memory.dmp family_vidar -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2788 powershell.exe -
resource yara_rule behavioral1/files/0x0008000000015d50-53.dat aspack_v212_v242 behavioral1/files/0x0007000000015d6d-61.dat aspack_v212_v242 behavioral1/files/0x0008000000015d0d-56.dat aspack_v212_v242 -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Sun152c6e5fac04c1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Sun152c6e5fac04c1.exe -
Executes dropped EXE 11 IoCs
pid Process 2508 setup_installer.exe 2764 setup_install.exe 664 Sun15b6c95dba344c935.exe 2184 Sun151b41f669.exe 2876 Sun15a9b9c6cb2b0dc.exe 1984 Sun152c6e5fac04c1.exe 2944 Sun15e1d2d2ead4a.exe 1840 Sun153b63e3ae.exe 2936 Sun154a2227a6e0.exe 1428 Sun154a2227a6e0.exe 3068 Sun15b869d1266d.exe -
Loads dropped DLL 53 IoCs
pid Process 1732 JaffaCakes118_2f8eb2e173c93dae1ddd17031ee8aa0e.exe 2508 setup_installer.exe 2508 setup_installer.exe 2508 setup_installer.exe 2508 setup_installer.exe 2508 setup_installer.exe 2508 setup_installer.exe 2764 setup_install.exe 2764 setup_install.exe 2764 setup_install.exe 2764 setup_install.exe 2764 setup_install.exe 2764 setup_install.exe 2764 setup_install.exe 2764 setup_install.exe 2676 cmd.exe 2676 cmd.exe 664 Sun15b6c95dba344c935.exe 664 Sun15b6c95dba344c935.exe 808 cmd.exe 2472 cmd.exe 2224 cmd.exe 2904 cmd.exe 2224 cmd.exe 808 cmd.exe 2632 cmd.exe 2184 Sun151b41f669.exe 2168 cmd.exe 2184 Sun151b41f669.exe 2876 Sun15a9b9c6cb2b0dc.exe 2876 Sun15a9b9c6cb2b0dc.exe 2732 cmd.exe 2632 cmd.exe 1840 Sun153b63e3ae.exe 1840 Sun153b63e3ae.exe 1984 Sun152c6e5fac04c1.exe 1984 Sun152c6e5fac04c1.exe 2936 Sun154a2227a6e0.exe 2936 Sun154a2227a6e0.exe 2936 Sun154a2227a6e0.exe 1428 Sun154a2227a6e0.exe 1428 Sun154a2227a6e0.exe 964 WerFault.exe 964 WerFault.exe 964 WerFault.exe 964 WerFault.exe 1032 WerFault.exe 1032 WerFault.exe 1032 WerFault.exe 1032 WerFault.exe 1032 WerFault.exe 1032 WerFault.exe 1032 WerFault.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/files/0x0005000000018761-80.dat themida behavioral1/memory/1984-129-0x0000000000080000-0x00000000006EC000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Sun152c6e5fac04c1.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 14 iplogger.org 15 iplogger.org 13 iplogger.org -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1984 Sun152c6e5fac04c1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 964 2764 WerFault.exe 31 1032 2876 WerFault.exe 46 -
System Location Discovery: System Language Discovery 1 TTPs 20 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_installer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sun152c6e5fac04c1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_2f8eb2e173c93dae1ddd17031ee8aa0e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sun15b6c95dba344c935.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sun154a2227a6e0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sun154a2227a6e0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sun151b41f669.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sun153b63e3ae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sun15a9b9c6cb2b0dc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Sun153b63e3ae.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Sun153b63e3ae.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Sun15a9b9c6cb2b0dc.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Sun15a9b9c6cb2b0dc.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Sun15a9b9c6cb2b0dc.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2788 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2788 powershell.exe Token: SeDebugPrivilege 2944 Sun15e1d2d2ead4a.exe Token: SeDebugPrivilege 1984 Sun152c6e5fac04c1.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1840 Sun153b63e3ae.exe 1840 Sun153b63e3ae.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1732 wrote to memory of 2508 1732 JaffaCakes118_2f8eb2e173c93dae1ddd17031ee8aa0e.exe 30 PID 1732 wrote to memory of 2508 1732 JaffaCakes118_2f8eb2e173c93dae1ddd17031ee8aa0e.exe 30 PID 1732 wrote to memory of 2508 1732 JaffaCakes118_2f8eb2e173c93dae1ddd17031ee8aa0e.exe 30 PID 1732 wrote to memory of 2508 1732 JaffaCakes118_2f8eb2e173c93dae1ddd17031ee8aa0e.exe 30 PID 1732 wrote to memory of 2508 1732 JaffaCakes118_2f8eb2e173c93dae1ddd17031ee8aa0e.exe 30 PID 1732 wrote to memory of 2508 1732 JaffaCakes118_2f8eb2e173c93dae1ddd17031ee8aa0e.exe 30 PID 1732 wrote to memory of 2508 1732 JaffaCakes118_2f8eb2e173c93dae1ddd17031ee8aa0e.exe 30 PID 2508 wrote to memory of 2764 2508 setup_installer.exe 31 PID 2508 wrote to memory of 2764 2508 setup_installer.exe 31 PID 2508 wrote to memory of 2764 2508 setup_installer.exe 31 PID 2508 wrote to memory of 2764 2508 setup_installer.exe 31 PID 2508 wrote to memory of 2764 2508 setup_installer.exe 31 PID 2508 wrote to memory of 2764 2508 setup_installer.exe 31 PID 2508 wrote to memory of 2764 2508 setup_installer.exe 31 PID 2764 wrote to memory of 2624 2764 setup_install.exe 33 PID 2764 wrote to memory of 2624 2764 setup_install.exe 33 PID 2764 wrote to memory of 2624 2764 setup_install.exe 33 PID 2764 wrote to memory of 2624 2764 setup_install.exe 33 PID 2764 wrote to memory of 2624 2764 setup_install.exe 33 PID 2764 wrote to memory of 2624 2764 setup_install.exe 33 PID 2764 wrote to memory of 2624 2764 setup_install.exe 33 PID 2764 wrote to memory of 2632 2764 setup_install.exe 34 PID 2764 wrote to memory of 2632 2764 setup_install.exe 34 PID 2764 wrote to memory of 2632 2764 setup_install.exe 34 PID 2764 wrote to memory of 2632 2764 setup_install.exe 34 PID 2764 wrote to memory of 2632 2764 setup_install.exe 34 PID 2764 wrote to memory of 2632 2764 setup_install.exe 34 PID 2764 wrote to memory of 2632 2764 setup_install.exe 34 PID 2764 wrote to memory of 2676 2764 setup_install.exe 35 PID 2764 wrote to memory of 2676 2764 setup_install.exe 35 PID 2764 wrote to memory of 2676 2764 setup_install.exe 35 PID 2764 wrote to memory of 2676 2764 setup_install.exe 35 PID 2764 wrote to memory of 2676 2764 setup_install.exe 35 PID 2764 wrote to memory of 2676 2764 setup_install.exe 35 PID 2764 wrote to memory of 2676 2764 setup_install.exe 35 PID 2764 wrote to memory of 2732 2764 setup_install.exe 36 PID 2764 wrote to memory of 2732 2764 setup_install.exe 36 PID 2764 wrote to memory of 2732 2764 setup_install.exe 36 PID 2764 wrote to memory of 2732 2764 setup_install.exe 36 PID 2764 wrote to memory of 2732 2764 setup_install.exe 36 PID 2764 wrote to memory of 2732 2764 setup_install.exe 36 PID 2764 wrote to memory of 2732 2764 setup_install.exe 36 PID 2764 wrote to memory of 2224 2764 setup_install.exe 37 PID 2764 wrote to memory of 2224 2764 setup_install.exe 37 PID 2764 wrote to memory of 2224 2764 setup_install.exe 37 PID 2764 wrote to memory of 2224 2764 setup_install.exe 37 PID 2764 wrote to memory of 2224 2764 setup_install.exe 37 PID 2764 wrote to memory of 2224 2764 setup_install.exe 37 PID 2764 wrote to memory of 2224 2764 setup_install.exe 37 PID 2764 wrote to memory of 2904 2764 setup_install.exe 38 PID 2764 wrote to memory of 2904 2764 setup_install.exe 38 PID 2764 wrote to memory of 2904 2764 setup_install.exe 38 PID 2764 wrote to memory of 2904 2764 setup_install.exe 38 PID 2764 wrote to memory of 2904 2764 setup_install.exe 38 PID 2764 wrote to memory of 2904 2764 setup_install.exe 38 PID 2764 wrote to memory of 2904 2764 setup_install.exe 38 PID 2764 wrote to memory of 2472 2764 setup_install.exe 39 PID 2764 wrote to memory of 2472 2764 setup_install.exe 39 PID 2764 wrote to memory of 2472 2764 setup_install.exe 39 PID 2764 wrote to memory of 2472 2764 setup_install.exe 39 PID 2764 wrote to memory of 2472 2764 setup_install.exe 39 PID 2764 wrote to memory of 2472 2764 setup_install.exe 39 PID 2764 wrote to memory of 2472 2764 setup_install.exe 39 PID 2764 wrote to memory of 2168 2764 setup_install.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2f8eb2e173c93dae1ddd17031ee8aa0e.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2f8eb2e173c93dae1ddd17031ee8aa0e.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\7zSCC9D2696\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSCC9D2696\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- System Location Discovery: System Language Discovery
PID:2624 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2788
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun154a2227a6e0.exe4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\7zSCC9D2696\Sun154a2227a6e0.exeSun154a2227a6e0.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\7zSCC9D2696\Sun154a2227a6e0.exe"C:\Users\Admin\AppData\Local\Temp\7zSCC9D2696\Sun154a2227a6e0.exe" -a6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1428
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun15b6c95dba344c935.exe4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\7zSCC9D2696\Sun15b6c95dba344c935.exeSun15b6c95dba344c935.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:664
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun15b869d1266d.exe4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\7zSCC9D2696\Sun15b869d1266d.exeSun15b869d1266d.exe5⤵
- Executes dropped EXE
PID:3068
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun15a9b9c6cb2b0dc.exe4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\7zSCC9D2696\Sun15a9b9c6cb2b0dc.exeSun15a9b9c6cb2b0dc.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:2876 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 9886⤵
- Loads dropped DLL
- Program crash
PID:1032
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun152c6e5fac04c1.exe4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\7zSCC9D2696\Sun152c6e5fac04c1.exeSun152c6e5fac04c1.exe5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1984
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun151b41f669.exe4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\7zSCC9D2696\Sun151b41f669.exeSun151b41f669.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2184
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun15e1d2d2ead4a.exe4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\7zSCC9D2696\Sun15e1d2d2ead4a.exeSun15e1d2d2ead4a.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2944
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun153b63e3ae.exe4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:808 -
C:\Users\Admin\AppData\Local\Temp\7zSCC9D2696\Sun153b63e3ae.exeSun153b63e3ae.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
PID:1840
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 4244⤵
- Loads dropped DLL
- Program crash
PID:964
-
-
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
631KB
MD594f06bfbb349287c89ccc92ac575123f
SHA134e36e640492423d55b80bd5ac3ddb77b6b9e87c
SHA256d05cb3a734aaa9d090be20fbaeddf8069a829fa78c44dd8378a2350c1510e1fc
SHA512c8a5362f9a35737ac04b6e0c48371aa60e64adf1157e16191691ac4dccb8dbaac261b516ebb89fc84ba741616ea1ca888a4a180ef2cf89ca04ebdc7768ea0fbb
-
Filesize
6.4MB
MD534204113c6ce7ea4d620b872782d9f93
SHA11050d166517966a662d140672c783865589ef5a6
SHA256f02b2b1d45d83e1dc1b8b04394d1b4e54edbab282137573a7cbb7a868179a6de
SHA5124a7e3fe06265f0bd9e476ffabc17022bbc79c0388ea898d88e77ffa062abeb42cccae09447c015c0bd6fd5ae85c3d4513de69c26354378c235a90e347eac2de0
-
Filesize
558KB
MD59f9fe691456732f485aebaa6f03237dd
SHA12b250665c81c8410c1e489ba2e6e2bd6d91d9a60
SHA2563a5353d3e176941fa3f57bada2df9d8c48f7b3ece7d1636ae8b49f718fec8a0c
SHA512e5decc71fdf63ae1ef1778b936c6fec2e4abff65bcaf864d7a38d602b164bb6c5b424246c5ba33dbfcdc881d99ec254ad7dc1eb8cc0ceec8733b8a63c903f345
-
Filesize
56KB
MD53263859df4866bf393d46f06f331a08f
SHA15b4665de13c9727a502f4d11afb800b075929d6c
SHA2569dcacda3913e30cafd92c909648b5bffde14b8e39e6adbfb15628006c0d4d3c2
SHA51258205110a017f5d73dd131fefb1e3bbbcc670ed0c645aeefebe5281579c7b1dceffa56671cd7b186554bdb81710e21018ed0d7088a27517dfc5e48d6d3578cf6
-
Filesize
241KB
MD55866ab1fae31526ed81bfbdf95220190
SHA175a5e08b3b9ad2dff35dfbbb3ffe8d983c2be25f
SHA2569e1a149370efe9814bf2cbd87acfcfa410d1769efd86a9722da4373d6716d22e
SHA5128d99ab09e84e4ef309da34be94946cbfcffeb1c0ca49e2452deb738d801e551062ebb134f1b99a9baf03003a8e720d525521ce09aeac341d3cba3fcfbc618fb5
-
Filesize
179KB
MD59e5fe0b1e93e31bffc2f1988c8ff1064
SHA143166e7b3912177b228a1fd44f6f475f1d216a31
SHA25621acb6a5372199d01c00ce120bcbf53dea4e1a0fceabe7787252b96662ad3b46
SHA512c758776aaee99155b819fb19941463a41e9bfa669640627e6536cade8cfb4176ac18ba0600816f66eff1811ebe3527bea8663519b4f0e86b56eaa930b1fd2c50
-
Filesize
2.1MB
MD5fc8475732da83755e63fa00126532c85
SHA1eaab0816fbbc7ef68b798319c31faad06a776d9b
SHA256f0d7d8c41aa67cf3a6fe065387b715ec59a8a4864c764c8c92a6cf6d6ee1bb8b
SHA512c19c986e1d39ff35fa186323134ec4f65e080cd86118e4711c2c4ddf9571016e8e38711e8b910cd0331d3053fff30696bb6deef6d9641c894ab5c77391667a89
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
32KB
MD566ed3612d20c29889ee4178f7326009c
SHA1285b2a9c8e9bd09380f4fa344a7fd9c4d1201b76
SHA256dd1aee06de6a5a60a4c8ab8510a50f1b92c94010c5bdc65caa47738f863926ae
SHA5120393695a6f0641b71faa025c614d69cea71b6fcccdc6682fa947accb6f338d20f92640659d3b3d6e596eb013e8b6752a204abcb7228c792f8b3eecc4d7b09a71
-
Filesize
8KB
MD590a1f5c8d8309b7a2e3c1290b29afcf3
SHA19793280a720f2dd477aeae973bfc63c5b896d15d
SHA256f0962e6113d7ee9cb82c5a7f493b635a19a1d3623f97372fd4b3279a58c77e68
SHA5124586ddbb8700793b6da8020388e6b20a0e1a4de8e672768e44b8b6df17b601d9bde47ce51c5df3df90637afb15cd53a1decb3e0c9e5015954a2763a0c542139b
-
Filesize
40KB
MD506f20f0b88d7b2865cb52c79ef1d792e
SHA194ebbd6b4ae86e0c11dc2c8bc9ec782bbfca4747
SHA256a95edffd2920262bce0bf9c00f38501a2aa886594ad0fa434d41333a43048f42
SHA5121b54b5603bd1e787143597d132d75c74aa42575995946fefff738986ccab12b37ba6c85d0bcf236799c07a9e0d13f0587a8c99d05cf58683dd59dae36ac3e384
-
Filesize
2KB
MD53353867365d87965182ae8bdbadb05ba
SHA1307d9caf9d2f598fb4c51c372c4a713b227c517c
SHA25691d765f044f9e2526e765fc4e47145291b31db88b0c822641b37a530ac632c37
SHA512ede741936e7d50711238919b22221a463e0c7a0863c5d1d95c6e2d18a3150139251e17ab83d7aeb592b32c01c1b9f1164645a86213ffc037b970d7b83ab911d4
-
Filesize
2KB
MD50fa617fcb14ba048f79474d529bff264
SHA1466e7397cc7f68bfcd9eac62e1626627278e1152
SHA2564b40ccb423074354dc58b5ffb4051833f80623f954e856a06f3e17cf7fcc25a7
SHA5126aa8bec15fb84c40cfd7f33ee31cd061a337e07022b4149082c3ff4465ef0fb62a0178436f9b806ba2585d3f8030efa16be8e125e9234a6c2551ef1a453582b6
-
Filesize
3KB
MD5f0bf1471ba4a1933e5ce856f47a700a7
SHA1759a4d3bb5c898aedc41b2846373ce8fb2ce076a
SHA2568fccc9514cc3362076eacb3e732fd440a13e44cf580faedc7c6486cb7a4d4f1b
SHA5125f54cfae00a98f8b2e0fe998d325d3370ea735c77a4d9613a1d1dcd1dbe0a4c8cd8afa17cf0bc09aecefcce377db64497ce8bbcde01360c608d0f0a3caadbbaa
-
Filesize
3KB
MD5bc5eddbd5232649cd7dfb26fe01d89e3
SHA1d5cae4b5299eae67528f29dbd73ca1d289645853
SHA2560a8706e5883611cda33a78daab60bc076a317d13de00bbaa55b27ee6903b8216
SHA5123284505fd1d55e03a0b4b24519aa340ad1ad8fcb5bcc899339f88efa6fce0faccef4a353974cbfb6891bb542dcfe5ed455f3e7caa7f72d4b558d3ee6c0b3ddc7
-
Filesize
8KB
MD502977f133eb5afd649657c1bbec7e5b8
SHA11c21bbbfcf98e627796a6a6734305f39153bff49
SHA256c9d13ff13c41b57a3e4c7cba7dd7fb65fbde028a266b3a6f7369ed696baab0c7
SHA512026b00d73917d8729a7c0d732c1583a3f0469dd7efb0776611deaae2916c1126eb7b7b945f884fc97711185f3e72b2e0dae758c7810c4236ccb4e4d2b159d91d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
545KB
MD5fb9ad0689729c79c6f99e8936599844f
SHA172175d24ee104fad4e9f3ed0f10a3321368ffd23
SHA2564853fb340a419a6f41fa1ade7b207e1814eb61f9e4d242a9268a7167f28d3d49
SHA512746d3f141525d477e700f3c2185855f0f162b7d9118bb566a897fb247fde626ce8ce67375675b8cdf777cf2dd164a09b05ba8bddb575bf151a3149ae176e681f
-
Filesize
178KB
MD504a0eb90f556564e4345c8329c4162a9
SHA15ad23b92d473e2b93b4d3b1594a53e0151860282
SHA2566c13874f1958ac3269128ffd90c3d6bdb5d65fc636312af290e09ddef664d83c
SHA512f8726f67823adfef1fdec421732dd4a25b9fdc11b782eb7f82f0981c66e131ef16c796851b1795685f4d88f0c94fdb25803917fb567a1a0dde2d925d8b3e0278
-
Filesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
Filesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
Filesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
Filesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
Filesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
Filesize
5.7MB
MD5fc9162ddfff7da3cb4803548b6e660fc
SHA1cf432e387ea0e74dda16707bd89d5569ac652783
SHA256466ee2d5941bdc11323d6621225a59df9b8199d2ab95febdcc650213cb1523c6
SHA512a40181bd048df6b10c6825b2ca7b21c9b3635df3ef695776956664933e806283041e27de6e652ac13ba20a1c1f27b5ad577542d8af136e69ae1577a8eacf9347