blackshades | 6deff5735317a9b7addf8d9f8d3aeca1de68364e63b69037b2c916bcaee44003

Resubmissions

07/03/2025, 19:43

250307-yfp5pavye1 10

07/03/2025, 19:34

250307-x958bswky3 10

07/03/2025, 19:02

250307-xpxqfsvvbv 10

Analysis

max time kernel
24s
max time network
27s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/03/2025, 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Size

1.2MB
MD5

58ef8399e896e60b181961292fb6d666
SHA1

d5b651f75234877814d8efabb6256fbc23c662ed
SHA256

6deff5735317a9b7addf8d9f8d3aeca1de68364e63b69037b2c916bcaee44003
SHA512

b9c4059148ff6ff96b376b69450a5234b4de8684ef41173601c24140da62a2b623f4117f5f483be478c9542be676cd705511d9540689b247cd44215b8c2f7b37
SSDEEP

24576:D6t9iwCQliK/JJDORRrQl9uM1aIcLkNC2brX5qXI8PP:Wt9iwJTDOPsrNcwNbwxP

Score

10^/10

blackshades darkcomet hawkeye enzcrash credential_access defense_evasion discovery keylogger persistence rat spyware stealer trojan upx

Malware Config

Extracted

Family

darkcomet

Attributes

gencode
install
false
offline_keylogger
false
persistence
false

rc4.plain

Extracted

Family

darkcomet

Botnet

enzcrash

whatthe.no-ip.biz:1604

Mutex

DC_MUTEX-F54S21D

Attributes

InstallPath
winupdate.exe
gencode
=fgh�Num+Xi-
install
true
offline_keylogger
true
persistence
true
reg_key
Windows Updater

rc4.plain

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 3 IoCs

resource	yara_rule
behavioral1/memory/2148-142-0x0000000000400000-0x0000000000474000-memory.dmp	family_blackshades
behavioral1/memory/2148-149-0x0000000000400000-0x0000000000474000-memory.dmp	family_blackshades
behavioral1/memory/1564-158-0x0000000000400000-0x0000000000474000-memory.dmp	family_blackshades

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet
HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
Hawkeye family
hawkeye

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\winupdate.exe"	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe

Modifies firewall policy service 3 TTPs 6 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	winupdate.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winupdate.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1"	winupdate.exe

Modifies security service 2 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	winupdate.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	explorer.exe

Windows security bypass 2 TTPs 4 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	explorer.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	WINDOWSUPDATE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\fredolin = "C:\\Users\\Admin\\AppData\\Roaming\\windowsupdate.exe"	WINDOWSUPDATE.EXE

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5CFF3DC2-AEED-D5C9-ED8B-B1D0CEDCDABC}	WINDOWSUPDATE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5CFF3DC2-AEED-D5C9-ED8B-B1D0CEDCDABC}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\windowsupdate.exe"	WINDOWSUPDATE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{5CFF3DC2-AEED-D5C9-ED8B-B1D0CEDCDABC}	WINDOWSUPDATE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Active Setup\Installed Components\{5CFF3DC2-AEED-D5C9-ED8B-B1D0CEDCDABC}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\windowsupdate.exe"	WINDOWSUPDATE.EXE

Disables RegEdit via registry modification 2 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winupdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	explorer.exe

Disables Task Manager via registry modification
defense_evasion

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	explorer.exe

Executes dropped EXE 6 IoCs

pid	Process
1564	WINDOWSUPDATE.EXE
2924	WINUPDTR.EXE
2628	winupdate.exe
1972	winupdate.exe
2052	WINUPDTR.EXE
2148	WINDOWSUPDATE.EXE

Loads dropped DLL 24 IoCs

pid	Process
2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
1564	WINDOWSUPDATE.EXE
1564	WINDOWSUPDATE.EXE
1564	WINDOWSUPDATE.EXE
2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
2924	WINUPDTR.EXE
2924	WINUPDTR.EXE
2924	WINUPDTR.EXE
2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
2628	winupdate.exe
2628	winupdate.exe
2628	winupdate.exe
2628	winupdate.exe
1972	winupdate.exe
1972	winupdate.exe
1972	winupdate.exe
1700	explorer.exe
1700	explorer.exe
1700	explorer.exe
2052	WINUPDTR.EXE
2052	WINUPDTR.EXE
2148	WINDOWSUPDATE.EXE
2148	WINDOWSUPDATE.EXE

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winupdate.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Updater = "C:\\Users\\Admin\\AppData\\Roaming\\winupdate.exe"	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fredolin = "C:\\Users\\Admin\\AppData\\Roaming\\windowsupdate.exe"	WINDOWSUPDATE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\fredolin = "C:\\Users\\Admin\\AppData\\Roaming\\windowsupdate.exe"	WINDOWSUPDATE.EXE

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2504 set thread context of 2244	2504	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	30
PID 2628 set thread context of 1972	2628	winupdate.exe	39
PID 1972 set thread context of 1292	1972	winupdate.exe	40
PID 1292 set thread context of 1700	1292	explorer.exe	41

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000015cdd-35.dat	upx
behavioral1/memory/1564-36-0x0000000000400000-0x0000000000474000-memory.dmp	upx
behavioral1/memory/2148-142-0x0000000000400000-0x0000000000474000-memory.dmp	upx
behavioral1/memory/2148-149-0x0000000000400000-0x0000000000474000-memory.dmp	upx
behavioral1/memory/1564-158-0x0000000000400000-0x0000000000474000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINUPDTR.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINDOWSUPDATE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINUPDTR.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINDOWSUPDATE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	winupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
2764	timeout.exe
1576	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
2688	reg.exe
2204	reg.exe
1440	reg.exe
1020	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1148	chrome.exe
1148	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1700	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Token: SeSecurityPrivilege	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Token: SeTakeOwnershipPrivilege	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Token: SeLoadDriverPrivilege	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Token: SeSystemProfilePrivilege	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Token: SeSystemtimePrivilege	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Token: SeProfSingleProcessPrivilege	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Token: SeIncBasePriorityPrivilege	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Token: SeCreatePagefilePrivilege	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Token: SeBackupPrivilege	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Token: SeRestorePrivilege	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Token: SeShutdownPrivilege	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Token: SeDebugPrivilege	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Token: SeSystemEnvironmentPrivilege	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Token: SeChangeNotifyPrivilege	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Token: SeRemoteShutdownPrivilege	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Token: SeUndockPrivilege	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Token: SeManageVolumePrivilege	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Token: SeImpersonatePrivilege	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Token: SeCreateGlobalPrivilege	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Token: 33	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Token: 34	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Token: 35	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Token: 1	1564	WINDOWSUPDATE.EXE
Token: SeCreateTokenPrivilege	1564	WINDOWSUPDATE.EXE
Token: SeAssignPrimaryTokenPrivilege	1564	WINDOWSUPDATE.EXE
Token: SeLockMemoryPrivilege	1564	WINDOWSUPDATE.EXE
Token: SeIncreaseQuotaPrivilege	1564	WINDOWSUPDATE.EXE
Token: SeMachineAccountPrivilege	1564	WINDOWSUPDATE.EXE
Token: SeTcbPrivilege	1564	WINDOWSUPDATE.EXE
Token: SeSecurityPrivilege	1564	WINDOWSUPDATE.EXE
Token: SeTakeOwnershipPrivilege	1564	WINDOWSUPDATE.EXE
Token: SeLoadDriverPrivilege	1564	WINDOWSUPDATE.EXE
Token: SeSystemProfilePrivilege	1564	WINDOWSUPDATE.EXE
Token: SeSystemtimePrivilege	1564	WINDOWSUPDATE.EXE
Token: SeProfSingleProcessPrivilege	1564	WINDOWSUPDATE.EXE
Token: SeIncBasePriorityPrivilege	1564	WINDOWSUPDATE.EXE
Token: SeCreatePagefilePrivilege	1564	WINDOWSUPDATE.EXE
Token: SeCreatePermanentPrivilege	1564	WINDOWSUPDATE.EXE
Token: SeBackupPrivilege	1564	WINDOWSUPDATE.EXE
Token: SeRestorePrivilege	1564	WINDOWSUPDATE.EXE
Token: SeShutdownPrivilege	1564	WINDOWSUPDATE.EXE
Token: SeDebugPrivilege	1564	WINDOWSUPDATE.EXE
Token: SeAuditPrivilege	1564	WINDOWSUPDATE.EXE
Token: SeSystemEnvironmentPrivilege	1564	WINDOWSUPDATE.EXE
Token: SeChangeNotifyPrivilege	1564	WINDOWSUPDATE.EXE
Token: SeRemoteShutdownPrivilege	1564	WINDOWSUPDATE.EXE
Token: SeUndockPrivilege	1564	WINDOWSUPDATE.EXE
Token: SeSyncAgentPrivilege	1564	WINDOWSUPDATE.EXE
Token: SeEnableDelegationPrivilege	1564	WINDOWSUPDATE.EXE
Token: SeManageVolumePrivilege	1564	WINDOWSUPDATE.EXE
Token: SeImpersonatePrivilege	1564	WINDOWSUPDATE.EXE
Token: SeCreateGlobalPrivilege	1564	WINDOWSUPDATE.EXE
Token: 31	1564	WINDOWSUPDATE.EXE
Token: 32	1564	WINDOWSUPDATE.EXE
Token: 33	1564	WINDOWSUPDATE.EXE
Token: 34	1564	WINDOWSUPDATE.EXE
Token: 35	1564	WINDOWSUPDATE.EXE
Token: SeRestorePrivilege	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Token: SeBackupPrivilege	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Token: SeIncreaseQuotaPrivilege	1972	winupdate.exe
Token: SeSecurityPrivilege	1972	winupdate.exe
Token: SeTakeOwnershipPrivilege	1972	winupdate.exe
Token: SeLoadDriverPrivilege	1972	winupdate.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1564	WINDOWSUPDATE.EXE
1564	WINDOWSUPDATE.EXE
2148	WINDOWSUPDATE.EXE
2148	WINDOWSUPDATE.EXE
1700	explorer.exe
1564	WINDOWSUPDATE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2244	2504	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	30
PID 2504 wrote to memory of 2244	2504	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	30
PID 2504 wrote to memory of 2244	2504	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	30
PID 2504 wrote to memory of 2244	2504	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	30
PID 2504 wrote to memory of 2244	2504	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	30
PID 2504 wrote to memory of 2244	2504	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	30
PID 2504 wrote to memory of 2244	2504	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	30
PID 2504 wrote to memory of 2244	2504	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	30
PID 2504 wrote to memory of 2244	2504	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	30
PID 2504 wrote to memory of 2244	2504	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	30
PID 2504 wrote to memory of 2244	2504	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	30
PID 2504 wrote to memory of 2244	2504	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	30
PID 2504 wrote to memory of 2244	2504	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	30
PID 2504 wrote to memory of 2244	2504	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	30
PID 2504 wrote to memory of 2244	2504	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	30
PID 2504 wrote to memory of 2244	2504	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	30
PID 2244 wrote to memory of 1564	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	31
PID 2244 wrote to memory of 1564	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	31
PID 2244 wrote to memory of 1564	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	31
PID 2244 wrote to memory of 1564	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	31
PID 2244 wrote to memory of 1564	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	31
PID 2244 wrote to memory of 1564	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	31
PID 2244 wrote to memory of 1564	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	31
PID 2244 wrote to memory of 2924	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	32
PID 2244 wrote to memory of 2924	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	32
PID 2244 wrote to memory of 2924	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	32
PID 2244 wrote to memory of 2924	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	32
PID 2244 wrote to memory of 2924	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	32
PID 2244 wrote to memory of 2924	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	32
PID 2244 wrote to memory of 2924	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	32
PID 2924 wrote to memory of 3032	2924	WINUPDTR.EXE	33
PID 2924 wrote to memory of 3032	2924	WINUPDTR.EXE	33
PID 2924 wrote to memory of 3032	2924	WINUPDTR.EXE	33
PID 2924 wrote to memory of 3032	2924	WINUPDTR.EXE	33
PID 2924 wrote to memory of 3032	2924	WINUPDTR.EXE	33
PID 2924 wrote to memory of 3032	2924	WINUPDTR.EXE	33
PID 2924 wrote to memory of 3032	2924	WINUPDTR.EXE	33
PID 3032 wrote to memory of 2764	3032	cmd.exe	35
PID 3032 wrote to memory of 2764	3032	cmd.exe	35
PID 3032 wrote to memory of 2764	3032	cmd.exe	35
PID 3032 wrote to memory of 2764	3032	cmd.exe	35
PID 3032 wrote to memory of 2764	3032	cmd.exe	35
PID 3032 wrote to memory of 2764	3032	cmd.exe	35
PID 3032 wrote to memory of 2764	3032	cmd.exe	35
PID 2244 wrote to memory of 2676	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	36
PID 2244 wrote to memory of 2676	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	36
PID 2244 wrote to memory of 2676	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	36
PID 2244 wrote to memory of 2676	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	36
PID 2244 wrote to memory of 2676	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	36
PID 2244 wrote to memory of 2676	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	36
PID 2244 wrote to memory of 2676	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	36
PID 2244 wrote to memory of 2628	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	37
PID 2244 wrote to memory of 2628	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	37
PID 2244 wrote to memory of 2628	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	37
PID 2244 wrote to memory of 2628	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	37
PID 2244 wrote to memory of 2628	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	37
PID 2244 wrote to memory of 2628	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	37
PID 2244 wrote to memory of 2628	2244	JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe	37
PID 2628 wrote to memory of 1972	2628	winupdate.exe	39
PID 2628 wrote to memory of 1972	2628	winupdate.exe	39
PID 2628 wrote to memory of 1972	2628	winupdate.exe	39
PID 2628 wrote to memory of 1972	2628	winupdate.exe	39
PID 2628 wrote to memory of 1972	2628	winupdate.exe	39
PID 2628 wrote to memory of 1972	2628	winupdate.exe	39

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	winupdate.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Checks BIOS information in registry
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Users\Admin\AppData\Local\Temp\WINDOWSUPDATE.EXE
    "C:\Users\Admin\AppData\Local\Temp\WINDOWSUPDATE.EXE"
    3⤵
    - Adds policy Run key to start application
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1564
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3020
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1440
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\WINDOWSUPDATE.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WINDOWSUPDATE.exe:*:Enabled:Windows Messanger" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2932
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\WINDOWSUPDATE.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WINDOWSUPDATE.exe:*:Enabled:Windows Messanger" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2688
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2936
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1020
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\windowsupdate.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\windowsupdate.exe:*:Enabled:Windows Messanger" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2988
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\windowsupdate.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\windowsupdate.exe:*:Enabled:Windows Messanger" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2204
- - C:\Users\Admin\AppData\Local\Temp\WINUPDTR.EXE
    "C:\Users\Admin\AppData\Local\Temp\WINUPDTR.EXE"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 5 && del C:\Users\Admin\AppData\Local\Temp\WINUPDTR.EXE
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3032
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 5
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2764
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\SysWOW64\explorer.exe"
    3⤵
    PID:2676
- - C:\Users\Admin\AppData\Roaming\winupdate.exe
    "C:\Users\Admin\AppData\Roaming\winupdate.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Users\Admin\AppData\Roaming\winupdate.exe
      "C:\Users\Admin\AppData\Roaming\winupdate.exe"
      4⤵
      Modifies firewall policy service
      Modifies security service
      Windows security bypass
      Disables RegEdit via registry modification
      Checks BIOS information in registry
      Executes dropped EXE
      Loads dropped DLL
      Windows security modification
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      System policy modification
      PID:1972
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1292
      - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        6⤵
        Modifies firewall policy service
        Modifies security service
        Windows security bypass
        Disables RegEdit via registry modification
        Checks BIOS information in registry
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\WINDOWSUPDATE.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\WINDOWSUPDATE.EXE"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\WINUPDTR.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\WINUPDTR.EXE"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2052
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout 5 && del C:\Users\Admin\AppData\Local\Temp\WINUPDTR.EXE
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1068
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 5
        9⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1576

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef76c9758,0x7fef76c9768,0x7fef76c9778
  2⤵
  PID:340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1908,i,15600351363433570215,16846746813504025856,131072 /prefetch:2
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1404 --field-trial-handle=1908,i,15600351363433570215,16846746813504025856,131072 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1480 --field-trial-handle=1908,i,15600351363433570215,16846746813504025856,131072 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2308 --field-trial-handle=1908,i,15600351363433570215,16846746813504025856,131072 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2316 --field-trial-handle=1908,i,15600351363433570215,16846746813504025856,131072 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1960 --field-trial-handle=1908,i,15600351363433570215,16846746813504025856,131072 /prefetch:2
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1356 --field-trial-handle=1908,i,15600351363433570215,16846746813504025856,131072 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3456 --field-trial-handle=1908,i,15600351363433570215,16846746813504025856,131072 /prefetch:8
  2⤵
  PID:236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3448 --field-trial-handle=1908,i,15600351363433570215,16846746813504025856,131072 /prefetch:8
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3460 --field-trial-handle=1908,i,15600351363433570215,16846746813504025856,131072 /prefetch:8
  2⤵
  PID:1988

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2708

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe"
1⤵
PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\665d78f2-9399-4f15-ac9e-a471585b6e2a.tmp

Filesize
352KB

MD5
03e56ca2000295c83d2e2a9e136d6d6e

SHA1
84df1219402c0c1c6a188951d4de1533753242ae

SHA256
72cb3f94ef714b8001be31043a0f3ea9e85d26dcc6beb631eb8a45bb59c71ce1

SHA512
f088aa070701a1cda83675a9db1f67f01f5e95e4c2a145317b4ff917000ff722a14b2536685adae3ab0ab91b78eb90b1492bb0b6d21d9bccbf2851e16a64f7d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
b406074cf53048cf726feca162cc539a

SHA1
6c39c2bdc32fca2fd092810aad8ff456f4efb08f

SHA256
a06a4236f9db3a4361691f3b3b76a1073f373d6f479e245646d0740a69f59318

SHA512
6950ef1745193723b7a51f6dd2c90890b8abf1971e014194009ff107084adb7f659e50bfdb0e5c0d6a0e3ee862196552cbb4536456785b1732a510110b5feca3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
352KB

MD5
e5f6506b846967d5e2224b72244e27a2

SHA1
7a4289353f3dba6aab6381ad6c3f9b0f8aa41004

SHA256
dd8747b64c190ee8c2d4ed6b9477baf1c696bd8e9d870337cae663385562cb04

SHA512
e012e737c1e54e8f0e6c2c8e68c7df0a4db356c5f0065b33567b5e9d5fade636716533fe75c2cae43c8c0fc47c223ec4681d55b0a48950529e508a0d41da1160

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\WINDOWSUPDATE.EXE

Filesize
163KB

MD5
24e2f8699579dc971a255076c08e829f

SHA1
5b45b15f4993d3112083b73806415d5eb587b9ea

SHA256
2a05046af890c5c4daa47277ccf630ac99228709ee489bd5517ba019fd0f5750

SHA512
de76329069c601feb874159360a28e3106dca47c05b069cb4c1d25e80a6fe7a44e6fa756a83c9f4d7da0b1f27628e389aaa60e2db7ae29d5e6d47537acce4a84

Download Submit
C:\Users\Admin\AppData\Roaming\chrtmp

Filesize
92KB

MD5
f98745d81e8b84f39630844a63afc1ee

SHA1
d7977c2dab5de25630f7d869f9b16a8502cd3bb3

SHA256
9c34e13f0d2852fb4a8a53a4727a59d24691a507edb6ff1965024a6147799a83

SHA512
e6b1bf12139e627d6aa2b25c9d7e8ebab1e86fc3025655bf88bc735413f55b10490f0237b8d11fd5db0eb6045f6176e93228c70d8e940a62ea4324816c31a3dd

Download Submit
\Users\Admin\AppData\Local\Temp\WINUPDTR.EXE

Filesize
340KB

MD5
55642a17d2b2f4a3b0622380cbd7a398

SHA1
54a6f1c9d6f207af5dcea9557b420fade8a30f82

SHA256
c8bb9bc16ff8cebc7ec50e94c4d6ee1c884c5bbe57c61b5dde520e953845fca0

SHA512
83084e5595f4e5e226f4a924100b8f9d9707b15966aa54956a0169b84c1e852b55f82280f8f9014ec78ece6e151078aa51c4ae2e841f23a44b9c060ad24d0948

Download Submit
\Users\Admin\AppData\Roaming\winupdate.exe

Filesize
1.2MB

MD5
58ef8399e896e60b181961292fb6d666

SHA1
d5b651f75234877814d8efabb6256fbc23c662ed

SHA256
6deff5735317a9b7addf8d9f8d3aeca1de68364e63b69037b2c916bcaee44003

SHA512
b9c4059148ff6ff96b376b69450a5234b4de8684ef41173601c24140da62a2b623f4117f5f483be478c9542be676cd705511d9540689b247cd44215b8c2f7b37

Download Submit
memory/1292-102-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1292-103-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1292-107-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1292-96-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1292-97-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1292-94-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1292-100-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1564-41-0x00000000008E0000-0x0000000000954000-memory.dmp

Filesize
464KB

Download
memory/1564-42-0x00000000008E0000-0x0000000000954000-memory.dmp

Filesize
464KB

Download
memory/1564-158-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1564-43-0x00000000008E0000-0x0000000000954000-memory.dmp

Filesize
464KB

Download
memory/1564-36-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1564-161-0x00000000008E0000-0x0000000000954000-memory.dmp

Filesize
464KB

Download
memory/1564-162-0x00000000008E0000-0x0000000000954000-memory.dmp

Filesize
464KB

Download
memory/1972-98-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/1972-93-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/1972-92-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/1972-91-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/1972-86-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2148-144-0x00000000008E0000-0x0000000000954000-memory.dmp

Filesize
464KB

Download
memory/2148-143-0x00000000008E0000-0x0000000000954000-memory.dmp

Filesize
464KB

Download
memory/2148-149-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2148-142-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2244-12-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2244-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2244-0-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2244-4-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2244-2-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2244-34-0x00000000037D0000-0x0000000003844000-memory.dmp

Filesize
464KB

Download
memory/2244-10-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2244-70-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2244-14-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2244-8-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2244-18-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2244-20-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2244-23-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2244-24-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2244-22-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2244-19-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2244-6-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download