44aa86c6880354edb6c4df8c9d6c0075c0da0fb8e1537a47329deda54c041344

Analysis

max time kernel
106s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
17/03/2025, 15:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
Size

281KB
MD5

7e6fc2d6bc70a57d3e6bc35e066d9cff
SHA1

2fae1438e0d749a88d4227da5db48ddc90bb54ab
SHA256

44aa86c6880354edb6c4df8c9d6c0075c0da0fb8e1537a47329deda54c041344
SHA512

89dd93d051432e740c1cbfa2e3142c4e184e196547a789d31aa92f4d83df876ded0742b8272947993ebb738a8dff80fe8190f0d5e2096c62dd2efda29f8e286d
SSDEEP

6144:gScrLt4mp8D6WGc/YSlIipBReybLzeh7Yy0DMIdeXijX:xcKy78QSVndyhsFMCeSjX

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\install\\server.exe"	server.exe
Key created	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\install\\server.exe"	server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
Key created	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	server.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7L4HR7J7-O046-W22W-C2F8-AD8ADB6R2F8U}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart"	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{7L4HR7J7-O046-W22W-C2F8-AD8ADB6R2F8U}	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7L4HR7J7-O046-W22W-C2F8-AD8ADB6R2F8U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\install\\server.exe Restart"	server.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{7L4HR7J7-O046-W22W-C2F8-AD8ADB6R2F8U}	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	server.exe

Executes dropped EXE 3 IoCs

pid	Process
1076	server.exe
116	server.exe
4832	server.exe

Loads dropped DLL 1 IoCs

pid	Process
2836	server.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe"	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe"	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\install\\server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\install\\server.exe"	server.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\install\server.exe	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	server.exe
File created	C:\Windows\SysWOW64\install\server.exe	server.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	server.exe
File created	C:\Windows\SysWOW64\install\server.exe	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1604-3-0x0000000010410000-0x0000000010482000-memory.dmp	upx
behavioral2/memory/1604-63-0x0000000010490000-0x0000000010502000-memory.dmp	upx
behavioral2/memory/2212-67-0x0000000010490000-0x0000000010502000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
4844	2212	WerFault.exe	87
5968	4812	WerFault.exe	91
4684	5188	WerFault.exe	95
1744	2836	WerFault.exe	98
5004	4360	WerFault.exe	102
4772	4832	WerFault.exe	105

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
1076	server.exe
1076	server.exe
1076	server.exe
1076	server.exe
116	server.exe
116	server.exe
116	server.exe
116	server.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
1076	server.exe
116	server.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56
PID 1604 wrote to memory of 3432	1604	JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3432
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe"
  2⤵
  - Adds policy Run key to start application
  - Boot or Logon Autostart Execution: Active Setup
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2212
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 812
      4⤵
      Program crash
      PID:4844
- - C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e6fc2d6bc70a57d3e6bc35e066d9cff.exe"
    3⤵
    PID:4812
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 496
      4⤵
      Program crash
      PID:5968
- - C:\Windows\SysWOW64\install\server.exe
    "C:\Windows\system32\install\server.exe"
    3⤵
    - Adds policy Run key to start application
    - Boot or Logon Autostart Execution: Active Setup
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:1076
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5188
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5188 -s 812
        5⤵
        Program crash
        
        PID:4684
  - - C:\Windows\SysWOW64\install\server.exe
      "C:\Windows\SysWOW64\install\server.exe"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2836
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 528
        5⤵
        Program crash
        
        PID:1744
  - - C:\Users\Admin\AppData\Roaming\install\server.exe
      "C:\Users\Admin\AppData\Roaming\install\server.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:116
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4360
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 812
        6⤵
        Program crash
        
        PID:5004
    - - C:\Users\Admin\AppData\Roaming\install\server.exe
        
        "C:\Users\Admin\AppData\Roaming\install\server.exe"
        5⤵
        Executes dropped EXE
        
        PID:4832
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 508
        6⤵
        Program crash
        
        PID:4772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2212 -ip 2212
1⤵
PID:5140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4812 -ip 4812
1⤵
PID:232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5188 -ip 5188
1⤵
PID:5472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2836 -ip 2836
1⤵
PID:2324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 4360 -ip 4360
1⤵
PID:5140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4832 -ip 4832
1⤵
PID:232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

Filesize
236KB

MD5
e3070601bf7de2b9bbb2335b25905ea4

SHA1
1a410e0ba88583a48ac0b7f29a325a7a7b5fd325

SHA256
2298f33ce2aee4061745b5a537a70202fcabb857777a8eb4c87b4fd6afc3811b

SHA512
26b0536a146a0845515ba44e86b3705c69cfa1c04cadd8bb3cd134219cf547b4aed1a6738e2e338046d84ee98d0c1546cbcbcafed8ac40f52e006dd83d35bee9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin2.txt

Filesize
236KB

MD5
63570976e06b551c3cde0028cde2e876

SHA1
410225155783936ce519fdbbe2922419392a9e38

SHA256
7e71e993da66ff881ca62317447025c4bbf22b1ac43f650ed9b05869ef9eda27

SHA512
dc0e8f5b5c732ad9f72202509a42c3c5c73f0056f5322f7cac54205c6e4a4e1eb961a355458b71866e8a75013962e7aa9541f8fabaa6fc21406571e84de8bd3d

Download Submit
C:\Windows\SysWOW64\install\server.exe

Filesize
281KB

MD5
7e6fc2d6bc70a57d3e6bc35e066d9cff

SHA1
2fae1438e0d749a88d4227da5db48ddc90bb54ab

SHA256
44aa86c6880354edb6c4df8c9d6c0075c0da0fb8e1537a47329deda54c041344

SHA512
89dd93d051432e740c1cbfa2e3142c4e184e196547a789d31aa92f4d83df876ded0742b8272947993ebb738a8dff80fe8190f0d5e2096c62dd2efda29f8e286d

Download Submit
memory/1604-3-0x0000000010410000-0x0000000010482000-memory.dmp

Filesize
456KB

Download
memory/1604-63-0x0000000010490000-0x0000000010502000-memory.dmp

Filesize
456KB

Download
memory/2212-7-0x00000000010D0000-0x00000000010D1000-memory.dmp

Filesize
4KB

Download
memory/2212-8-0x0000000001190000-0x0000000001191000-memory.dmp

Filesize
4KB

Download
memory/2212-66-0x0000000003C20000-0x0000000003C21000-memory.dmp

Filesize
4KB

Download
memory/2212-67-0x0000000010490000-0x0000000010502000-memory.dmp

Filesize
456KB

Download