gh0strat | 31c67757417a79aca92d2a112d64245b8452080deeb8c96ea37e781d78c750ca

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2025, 07:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_3ec86d0266e990db3a951f239687a6f0.exe
Size

120KB
MD5

3ec86d0266e990db3a951f239687a6f0
SHA1

c5c370331a12bf10115eeb17401aad1b95654f85
SHA256

31c67757417a79aca92d2a112d64245b8452080deeb8c96ea37e781d78c750ca
SHA512

9507dab9b169007bfe1afb060a2ded6fae5466469330f875b89cbcf24cc16b87514723cb89e942d7cbe05562b5edaf787dba2d55be8821b91d33f9a8f0237707
SSDEEP

3072:yLk395hYXJePspYCAh7Ap8DLPw3rywS3pWAgZjf0:yQqiHxkGDs+wS3pWAgZ8

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 11 IoCs

resource	yara_rule
behavioral2/files/0x000c000000023c4b-6.dat	family_gh0strat
behavioral2/files/0x000e000000023c4b-12.dat	family_gh0strat
behavioral2/files/0x0008000000023dac-18.dat	family_gh0strat
behavioral2/files/0x000a000000023dac-24.dat	family_gh0strat
behavioral2/files/0x000c000000023dac-31.dat	family_gh0strat
behavioral2/files/0x000d000000023c38-36.dat	family_gh0strat
behavioral2/files/0x000f000000023c38-42.dat	family_gh0strat
behavioral2/files/0x000400000001da71-48.dat	family_gh0strat
behavioral2/files/0x000600000001da71-54.dat	family_gh0strat
behavioral2/files/0x000800000001da71-60.dat	family_gh0strat
behavioral2/files/0x0018000000023c38-66.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Deletes itself 1 IoCs

pid	Process
2756	install8403921.exe

Executes dropped EXE 1 IoCs

pid	Process
2756	install8403921.exe

Loads dropped DLL 33 IoCs

pid	Process
212	svchost.exe
1696	svchost.exe
1380	svchost.exe
4736	svchost.exe
1912	svchost.exe
3228	svchost.exe
3624	svchost.exe
2024	svchost.exe
3932	svchost.exe
2796	svchost.exe
4192	svchost.exe
2624	svchost.exe
4736	svchost.exe
4896	svchost.exe
1932	svchost.exe
980	svchost.exe
4776	svchost.exe
3884	svchost.exe
4636	svchost.exe
4380	svchost.exe
2456	svchost.exe
2424	svchost.exe
1800	svchost.exe
2252	svchost.exe
2612	svchost.exe
4480	svchost.exe
2308	svchost.exe
556	svchost.exe
1708	svchost.exe
2584	svchost.exe
4064	svchost.exe
2560	svchost.exe
2988	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\toypl.cc3	install8403921.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 33 IoCs

pid	pid_target	Process	procid_target
2788	212	WerFault.exe	94
1944	1696	WerFault.exe	99
1100	1380	WerFault.exe	102
1324	4736	WerFault.exe	106
3212	1912	WerFault.exe	109
3240	3228	WerFault.exe	112
232	3624	WerFault.exe	117
400	2024	WerFault.exe	120
3552	3932	WerFault.exe	123
4740	2796	WerFault.exe	126
2164	4192	WerFault.exe	129
760	2624	WerFault.exe	132
4500	4736	WerFault.exe	135
2876	4896	WerFault.exe	138
3388	1932	WerFault.exe	141
4368	980	WerFault.exe	144
2892	4776	WerFault.exe	147
4196	3884	WerFault.exe	150
2392	4636	WerFault.exe	153
2796	4380	WerFault.exe	156
1320	2456	WerFault.exe	159
3668	2424	WerFault.exe	164
1932	1800	WerFault.exe	167
2016	2252	WerFault.exe	170
3436	2612	WerFault.exe	173
1392	4480	WerFault.exe	176
2824	2308	WerFault.exe	179
4740	556	WerFault.exe	182
4024	1708	WerFault.exe	185
2428	2584	WerFault.exe	188
3156	4064	WerFault.exe	199
4504	2560	WerFault.exe	202
5036	2988	WerFault.exe	205

System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install8403921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3ec86d0266e990db3a951f239687a6f0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2756	install8403921.exe
2756	install8403921.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeRestorePrivilege	2756	install8403921.exe
Token: SeBackupPrivilege	2756	install8403921.exe
Token: SeBackupPrivilege	2756	install8403921.exe
Token: SeRestorePrivilege	2756	install8403921.exe
Token: SeRestorePrivilege	2756	install8403921.exe
Token: SeBackupPrivilege	2756	install8403921.exe
Token: SeBackupPrivilege	2756	install8403921.exe
Token: SeRestorePrivilege	2756	install8403921.exe
Token: SeRestorePrivilege	2756	install8403921.exe
Token: SeBackupPrivilege	2756	install8403921.exe
Token: SeBackupPrivilege	2756	install8403921.exe
Token: SeRestorePrivilege	2756	install8403921.exe
Token: SeRestorePrivilege	2756	install8403921.exe
Token: SeBackupPrivilege	2756	install8403921.exe
Token: SeBackupPrivilege	2756	install8403921.exe
Token: SeRestorePrivilege	2756	install8403921.exe
Token: SeRestorePrivilege	2756	install8403921.exe
Token: SeBackupPrivilege	2756	install8403921.exe
Token: SeBackupPrivilege	2756	install8403921.exe
Token: SeRestorePrivilege	2756	install8403921.exe
Token: SeRestorePrivilege	2756	install8403921.exe
Token: SeBackupPrivilege	2756	install8403921.exe
Token: SeBackupPrivilege	2756	install8403921.exe
Token: SeRestorePrivilege	2756	install8403921.exe
Token: SeRestorePrivilege	2756	install8403921.exe
Token: SeBackupPrivilege	2756	install8403921.exe
Token: SeBackupPrivilege	2756	install8403921.exe
Token: SeRestorePrivilege	2756	install8403921.exe
Token: SeRestorePrivilege	2756	install8403921.exe
Token: SeBackupPrivilege	2756	install8403921.exe
Token: SeBackupPrivilege	2756	install8403921.exe
Token: SeRestorePrivilege	2756	install8403921.exe
Token: SeRestorePrivilege	2756	install8403921.exe
Token: SeBackupPrivilege	2756	install8403921.exe
Token: SeBackupPrivilege	2756	install8403921.exe
Token: SeRestorePrivilege	2756	install8403921.exe
Token: SeRestorePrivilege	2756	install8403921.exe
Token: SeBackupPrivilege	2756	install8403921.exe
Token: SeBackupPrivilege	2756	install8403921.exe
Token: SeRestorePrivilege	2756	install8403921.exe
Token: SeRestorePrivilege	2756	install8403921.exe
Token: SeBackupPrivilege	2756	install8403921.exe
Token: SeBackupPrivilege	2756	install8403921.exe
Token: SeRestorePrivilege	2756	install8403921.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 2756	3900	JaffaCakes118_3ec86d0266e990db3a951f239687a6f0.exe	88
PID 3900 wrote to memory of 2756	3900	JaffaCakes118_3ec86d0266e990db3a951f239687a6f0.exe	88
PID 3900 wrote to memory of 2756	3900	JaffaCakes118_3ec86d0266e990db3a951f239687a6f0.exe	88

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3ec86d0266e990db3a951f239687a6f0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3ec86d0266e990db3a951f239687a6f0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Users\Admin\AppData\Roaming\install8403921.exe
  "C:\Users\Admin\AppData\Roaming\install8403921.exe" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3ec86d0266e990db3a951f239687a6f0.exe" -sC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3ec86d0266e990db3a951f239687a6f0.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2756

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 592
  2⤵
  - Program crash
  PID:2788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 212 -ip 212
1⤵
PID:2824

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 592
  2⤵
  - Program crash
  PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1696 -ip 1696
1⤵
PID:1492

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 592
  2⤵
  - Program crash
  PID:1100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1380 -ip 1380
1⤵
PID:3428

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ias
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 592
  2⤵
  - Program crash
  PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4736 -ip 4736
1⤵
PID:1600

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ias
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 592
  2⤵
  - Program crash
  PID:3212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1912 -ip 1912
1⤵
PID:3316

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ias
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 592
  2⤵
  - Program crash
  PID:3240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3228 -ip 3228
1⤵
PID:4372

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s irmon
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 592
  2⤵
  - Program crash
  PID:232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3624 -ip 3624
1⤵
PID:3648

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s irmon
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 592
  2⤵
  - Program crash
  PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2024 -ip 2024
1⤵
PID:4196

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s irmon
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 592
  2⤵
  - Program crash
  PID:3552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3932 -ip 3932
1⤵
PID:3652

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nla
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 592
  2⤵
  - Program crash
  PID:4740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2796 -ip 2796
1⤵
PID:1540

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nla
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 592
  2⤵
  - Program crash
  PID:2164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4192 -ip 4192
1⤵
PID:4988

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nla
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 592
  2⤵
  - Program crash
  PID:760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2624 -ip 2624
1⤵
PID:3836

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ntmssvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 592
  2⤵
  - Program crash
  PID:4500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4736 -ip 4736
1⤵
PID:4912

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ntmssvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 592
  2⤵
  - Program crash
  PID:2876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4896 -ip 4896
1⤵
PID:3228

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ntmssvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 592
  2⤵
  - Program crash
  PID:3388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1932 -ip 1932
1⤵
PID:1064

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nwcworkstation
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 596
  2⤵
  - Program crash
  PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 980 -ip 980
1⤵
PID:4764

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nwcworkstation
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 592
  2⤵
  - Program crash
  PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4776 -ip 4776
1⤵
PID:3828

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nwcworkstation
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 592
  2⤵
  - Program crash
  PID:4196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3884 -ip 3884
1⤵
PID:1392

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s srservice
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 592
  2⤵
  - Program crash
  PID:2392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4636 -ip 4636
1⤵
PID:3820

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s srservice
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 592
  2⤵
  - Program crash
  PID:2796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4380 -ip 4380
1⤵
PID:4740

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s srservice
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 592
  2⤵
  - Program crash
  PID:1320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2456 -ip 2456
1⤵
PID:1388

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmi
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 592
  2⤵
  - Program crash
  PID:3668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2424 -ip 2424
1⤵
PID:4884

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmi
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 592
  2⤵
  - Program crash
  PID:1932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1800 -ip 1800
1⤵
PID:4260

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmi
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 592
  2⤵
  - Program crash
  PID:2016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2252 -ip 2252
1⤵
PID:4204

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmdmpmsp
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 592
  2⤵
  - Program crash
  PID:3436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2612 -ip 2612
1⤵
PID:980

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmdmpmsp
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 592
  2⤵
  - Program crash
  PID:1392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4480 -ip 4480
1⤵
PID:4776

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmdmpmsp
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 592
  2⤵
  - Program crash
  PID:2824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2308 -ip 2308
1⤵
PID:3884

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s logonhours
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 592
  2⤵
  - Program crash
  PID:4740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 556 -ip 556
1⤵
PID:5020

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s logonhours
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 592
  2⤵
  - Program crash
  PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1708 -ip 1708
1⤵
PID:3940

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s logonhours
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 592
  2⤵
  - Program crash
  PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2584 -ip 2584
1⤵
PID:4472

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s pcaudit
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 596
  2⤵
  - Program crash
  PID:3156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4064 -ip 4064
1⤵
PID:1100

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s pcaudit
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 592
  2⤵
  - Program crash
  PID:4504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2560 -ip 2560
1⤵
PID:1380

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s pcaudit
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 592
  2⤵
  - Program crash
  PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2988 -ip 2988
1⤵
PID:1144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\install8403921.exe

Filesize
23.4MB

MD5
2aa07b0852ea1125035b7d250975c964

SHA1
faa7cd73234d5e373a2f1158473b7445a76f750c

SHA256
a4bd56257d047dda240f370018e1c595515178c4169fdf7e012a6890aa87480b

SHA512
625227887ce52728e9e91d7006c0f66a2b66d6180696668c4176e41fe8519127319ae978ad905b0b0056e26ca5feb1f732ac9e41764d7a36578c75de1ec16c7b

Download Submit
C:\Windows\SysWOW64\toypl.cc3

Filesize
24.1MB

MD5
77c53a98aa70f1fb49cedf8555f52a40

SHA1
7df7cfd6d592d6477245432fadd37dcb426fa2a9

SHA256
0528fafe353316d821400b7070bc0b0e33160bb6348d502f4681c618a64f78a9

SHA512
4e1c88a855238ff0ca61152dbf4ad53b379b9ebd016dba7e37b3f3dc4b9938ece6b8131713c61a45ac087ef8a839e17807163254b6d4908987021bdf2c5e5cca

Download Submit
\??\c:\windows\SysWOW64\toypl.cc3

Filesize
19.1MB

MD5
7fc545d5f25ae7b25fcdef6ccba82f86

SHA1
64b05b0eaecbd8e802319192dfbc892818e21c41

SHA256
1ad7966875ce833f2468f1079840eaeb69e437bae9b63ee57eed4a9fa17574cc

SHA512
f439cf7f7426b121afd51f79c90893fa2950f943cb4c45c6daa5c5372955cfb7bf1f46259f47959d625bab3b483703ce581fd98656b8a5fb7c3c3f1c0d43dad1

Download Submit
\??\c:\windows\SysWOW64\toypl.cc3

Filesize
22.1MB

MD5
6fb0a2bb418d31cfc5e1eb633d8da241

SHA1
03dd4232bbf47cc6cd54a4a6a8e5b65df3137180

SHA256
3df76668eba11fac750d49858191defc4537714fcdb6e06f9f9f941bc2e6a37a

SHA512
38cc338b0570d6f75e8249be42a576dc92eaffe3032c8a73a4a1d2fde15fab54ffdfe96ac56bc69109dd630dba3563e6e28182051d8864b1c25a59b0f3cbc708

Download Submit
\??\c:\windows\SysWOW64\toypl.cc3

Filesize
24.0MB

MD5
acbed64cff173c6d14bdcc55a18724b1

SHA1
9dd3ced98459c7371783deb21efef0806cc38dc4

SHA256
a25d6bf651c281d3420fc1abdf4ee9f8b184d9e7affe996cc24e9f5ee3101e43

SHA512
f5d4281d3ac733589431213b2fb6cc2eae74b5c351759db334f5c0fadfe7eb5483d4fd43ed7121e5f90e065533e0dfd6a49e4e8fd74d2630347c74e280026e09

Download Submit
\??\c:\windows\SysWOW64\toypl.cc3

Filesize
20.0MB

MD5
d824006591487a431e3235be54545e6f

SHA1
7d905f8fd74a278e8f4051eb74aa002c292ffc8b

SHA256
08d553b2244fff3b993f609dc0df8d89b740a1eb679a38cbf0d9ffbb0778f71e

SHA512
45f6c42e5d0d4f3b6835e93e40db161684f152d174a400026a6e86a5fadd1c606ccf9490f27e229894674c94fef029a9d0ec0c4a03cf047d37032bece8fcb419

Download Submit
\??\c:\windows\SysWOW64\toypl.cc3

Filesize
19.1MB

MD5
5901a352cd8de7879cb8350587073c1b

SHA1
da10dec50c2cc78932065fb06c94e291d38f03c7

SHA256
5ef75466c257e6e30de6aca357bbb470875b6b54bc7f17680a43f571dd542628

SHA512
43cf0d5645a9abea3b0e0ea187de4809451a422f9ef63ee75365cadeabe208dd23b0f2fd7710878363baadd9b494aa62e586f16a0e98246bb82189bc220aedd9

Download Submit
\??\c:\windows\SysWOW64\toypl.cc3

Filesize
23.1MB

MD5
0e284ff8a288e743ed56105209817a16

SHA1
0f930014fd2b0c1cbe8890a8fb6e5f4167baf284

SHA256
ad4d9fe8f292508572bad30c02438e0a47d1fccebce474868ea840a15ad2838e

SHA512
e19ae33da5d5036b6bae40dfb78b6bf17f08797000f0f5ce47cee8ec5cffd370030375f16a95ae782a2adc4a54e17de1ee7db4b105d4a2f7b2ccdb9cb9127ce2

Download Submit
\??\c:\windows\SysWOW64\toypl.cc3

Filesize
20.0MB

MD5
6c611a995c91eaafe9132dfca6a3f4d7

SHA1
e4ec9a2f43a8a3dca58946ee3fb3179bad92ea68

SHA256
de2849be428d2b33227a02c5d073a5e79e7be1e0bc5cec715657824df4f11261

SHA512
c4a55b04e12c97fdec97644ebc83891f3695d20e4013aadf96f19f3b55bb8f1e3fa9b6fdc0be858ec9e3c42482714c02a19902e8d1fc74a9d2950c7deadfc9ea

Download Submit
\??\c:\windows\SysWOW64\toypl.cc3

Filesize
22.1MB

MD5
1d34d34b1d8cbe60ce6549315b3f6552

SHA1
4394a825fd1ac16e1f7396b66234551aa8354975

SHA256
d8b136eab5dadfbab1a1e3ffd575f9f5f568f65a133a9a75edc0d4bbf83fa2bd

SHA512
67eef6ba2f0177c88a58dd0604f78f45698581a4174fe0565eb24c19a3d491592f9e75fd6477a76fce823aad2e19bfb923154760f0db0d79583b045e17d6499c

Download Submit
\??\c:\windows\SysWOW64\toypl.cc3

Filesize
23.1MB

MD5
62c161d70743ae39166eca340a78b85a

SHA1
576fd110d9abf9ae5ed23a96d4e17bcd0c5c0efc

SHA256
ebeb53e56edd4d430f068eb9ef2760934b309e7f118c8d8d5ae96b5c13a0b626

SHA512
36d29e1ea4950b5669ea9e9479b4cb7c21f48d05c73b3f5932a711fd8207718a8f1ea520b3f671c753d93b5c27de3d429612146b08a0536e3ec2e8a7917c9524

Download Submit
\??\c:\windows\SysWOW64\toypl.cc3

Filesize
24.1MB

MD5
968ae16a3412e383ba14a65423619231

SHA1
94da1a55fab4e4f61e5d52bd6ee6c3c16b4aaacb

SHA256
6a6d4666828d3b6d573ad1ba722d9be7c2ef0b5222b9e4630d9823db9a6cf47e

SHA512
34e0b0ab06f8b808f9d62f7aa7a128bdf3f2d106a72dc398a3761d5b073b1b843c14367da3fa03d9e141c2010010c9a0999b16a3f867ed0e3cd1e5f72fc7134b

Download Submit