Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
21/03/2025, 21:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_84c8b1fbeeb717c572934e564de714f4.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
General
-
Target
JaffaCakes118_84c8b1fbeeb717c572934e564de714f4.exe
-
Size
903KB
-
MD5
84c8b1fbeeb717c572934e564de714f4
-
SHA1
2609343d195368a5b118e4d5b4587b11680c109b
-
SHA256
2f5bdc3c1540373a46565095571394adbe591b3b8b11322aefe461111d650d42
-
SHA512
d5fd6e30e64591cb8f3bcdf0e7e65f93ce3f9331516e6f8560a4124c3d0cd41a568442b04644ebee13582ecfc910a19008ddbe67dcb6979bdb650fc462b556b9
-
SSDEEP
12288:NBJHa4SSqrzuhQ88jIYSl10R/IqSBk58tKTGPM2Leov6uqoi2W+/gF1chxGZZlxt:NrHaFSIR/998CGPMAHgzmxGE0
Malware Config
Extracted
Family
cybergate
Version
v1.01.0
Botnet
viko89
C2
124.123.38.124:82
Mutex
CyberGate1
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Winlog
-
install_file
winlogonn.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
allahisgreat
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
-
Adds policy Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Key created \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Key created \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Crypted.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Winlog\\winlogonn.exe" Crypted.exe Key created \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Key created \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Key created \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Key created \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Key created \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Key created \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Key created \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Key created \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Key created \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Winlog\\winlogonn.exe" Crypted.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Key created \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Key created \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Key created \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Key created \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Key created \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Crypted.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Key created \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Key created \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Key created \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Key created \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winlogonn.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 60 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart" winlogonn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart" winlogonn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} winlogonn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart" winlogonn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Windows\\system32\\Winlog\\winlogonn.exe" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart" winlogonn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart" winlogonn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} winlogonn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} Crypted.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} winlogonn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} winlogonn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart" winlogonn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} winlogonn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} winlogonn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} winlogonn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} winlogonn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Windows\\system32\\Winlog\\winlogonn.exe Restart" Crypted.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart" winlogonn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart" winlogonn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} winlogonn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart" winlogonn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart" winlogonn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart" winlogonn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart" winlogonn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} winlogonn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart" winlogonn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} winlogonn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart" winlogonn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe Restart" winlogonn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} winlogonn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{060450C4-878T-I7DL-13H6-74778Q4GEE5U} winlogonn.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation JaffaCakes118_84c8b1fbeeb717c572934e564de714f4.exe -
Executes dropped EXE 29 IoCs
pid Process 3948 Crypted.exe 1680 winlogonn.exe 2992 winlogonn.exe 1932 winlogonn.exe 1832 winlogonn.exe 3264 winlogonn.exe 4032 winlogonn.exe 3756 winlogonn.exe 4012 winlogonn.exe 1856 winlogonn.exe 2528 winlogonn.exe 2924 winlogonn.exe 3676 winlogonn.exe 4604 winlogonn.exe 1728 winlogonn.exe 2100 winlogonn.exe 2168 winlogonn.exe 1520 winlogonn.exe 2532 winlogonn.exe 4436 winlogonn.exe 3640 winlogonn.exe 1448 winlogonn.exe 3680 winlogonn.exe 4372 winlogonn.exe 2212 winlogonn.exe 4876 winlogonn.exe 4920 winlogonn.exe 2872 winlogonn.exe 2996 winlogonn.exe -
Adds Run key to start application 2 TTPs 60 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\Winlog\\winlogonn.exe" Crypted.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\Winlog\\winlogonn.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\Winlog\\winlogonn.exe" Crypted.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\Winlog\\winlogonn.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\winlogonn.exe" winlogonn.exe -
Drops file in System32 directory 58 IoCs
description ioc Process File created C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File created C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File created C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File created C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File created C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File created C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File created C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File created C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File created C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File created C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File created C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe Crypted.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File created C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File created C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File created C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File created C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File created C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File created C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File created C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File created C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File created C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File created C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File created C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File created C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File created C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File created C:\Windows\SysWOW64\Winlog\winlogonn.exe Crypted.exe File created C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File created C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File opened for modification C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File created C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe File created C:\Windows\SysWOW64\Winlog\winlogonn.exe winlogonn.exe -
resource yara_rule behavioral2/files/0x0009000000024017-13.dat upx behavioral2/memory/3948-17-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/3948-23-0x0000000024010000-0x0000000024070000-memory.dmp upx behavioral2/memory/3948-26-0x0000000024070000-0x00000000240D0000-memory.dmp upx behavioral2/memory/3948-83-0x0000000024070000-0x00000000240D0000-memory.dmp upx behavioral2/memory/184-88-0x0000000024070000-0x00000000240D0000-memory.dmp upx behavioral2/memory/3948-92-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/184-96-0x0000000024070000-0x00000000240D0000-memory.dmp upx behavioral2/memory/1680-103-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/2992-110-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1932-119-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1832-126-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/3264-134-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4032-144-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/3756-153-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4012-164-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1856-174-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/2528-186-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4604-205-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/2924-204-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/3676-218-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4604-230-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1728-237-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/2100-250-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1520-260-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/2168-266-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/2532-276-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1520-281-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4436-292-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/2532-307-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4436-313-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1448-325-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/3680-341-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/3640-340-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1448-355-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/3680-370-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4372-374-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/2212-390-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4876-404-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/2872-418-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4920-424-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/2996-436-0x0000000000400000-0x0000000000456000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Crypted.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogonn.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 1680 winlogonn.exe 1680 winlogonn.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 3948 Crypted.exe 1680 winlogonn.exe 1680 winlogonn.exe 1680 winlogonn.exe 1680 winlogonn.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3948 Crypted.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1576 wrote to memory of 3948 1576 JaffaCakes118_84c8b1fbeeb717c572934e564de714f4.exe 88 PID 1576 wrote to memory of 3948 1576 JaffaCakes118_84c8b1fbeeb717c572934e564de714f4.exe 88 PID 1576 wrote to memory of 3948 1576 JaffaCakes118_84c8b1fbeeb717c572934e564de714f4.exe 88 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56 PID 3948 wrote to memory of 3464 3948 Crypted.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_84c8b1fbeeb717c572934e564de714f4.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_84c8b1fbeeb717c572934e564de714f4.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\Crypted.exe"C:\Users\Admin\AppData\Local\Temp\Crypted.exe"3⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:184 -
C:\Windows\SysWOW64\Winlog\winlogonn.exe"C:\Windows\system32\Winlog\winlogonn.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1680
-
-
C:\Windows\SysWOW64\Winlog\winlogonn.exe"C:\Windows\system32\Winlog\winlogonn.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2992
-
-
C:\Windows\SysWOW64\Winlog\winlogonn.exe"C:\Windows\system32\Winlog\winlogonn.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1932
-
-
C:\Windows\SysWOW64\Winlog\winlogonn.exe"C:\Windows\system32\Winlog\winlogonn.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1832
-
-
C:\Windows\SysWOW64\Winlog\winlogonn.exe"C:\Windows\system32\Winlog\winlogonn.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:3264
-
-
C:\Windows\SysWOW64\Winlog\winlogonn.exe"C:\Windows\system32\Winlog\winlogonn.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:4032
-
-
C:\Windows\SysWOW64\Winlog\winlogonn.exe"C:\Windows\system32\Winlog\winlogonn.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:3756
-
-
C:\Windows\SysWOW64\Winlog\winlogonn.exe"C:\Windows\system32\Winlog\winlogonn.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:4012
-
-
C:\Windows\SysWOW64\Winlog\winlogonn.exe"C:\Windows\system32\Winlog\winlogonn.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1856
-
-
C:\Windows\SysWOW64\Winlog\winlogonn.exe"C:\Windows\system32\Winlog\winlogonn.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2528
-
-
C:\Windows\SysWOW64\Winlog\winlogonn.exe"C:\Windows\system32\Winlog\winlogonn.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2924
-
-
C:\Windows\SysWOW64\Winlog\winlogonn.exe"C:\Windows\system32\Winlog\winlogonn.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:3676
-
-
C:\Windows\SysWOW64\Winlog\winlogonn.exe"C:\Windows\system32\Winlog\winlogonn.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:4604
-
-
C:\Windows\SysWOW64\Winlog\winlogonn.exe"C:\Windows\system32\Winlog\winlogonn.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1728
-
-
C:\Windows\SysWOW64\Winlog\winlogonn.exe"C:\Windows\system32\Winlog\winlogonn.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2100
-
-
C:\Windows\SysWOW64\Winlog\winlogonn.exe"C:\Windows\system32\Winlog\winlogonn.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2168
-
-
C:\Windows\SysWOW64\Winlog\winlogonn.exe"C:\Windows\system32\Winlog\winlogonn.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1520
-
-
C:\Windows\SysWOW64\Winlog\winlogonn.exe"C:\Windows\system32\Winlog\winlogonn.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2532
-
-
C:\Windows\SysWOW64\Winlog\winlogonn.exe"C:\Windows\system32\Winlog\winlogonn.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:4436
-
-
C:\Windows\SysWOW64\Winlog\winlogonn.exe"C:\Windows\system32\Winlog\winlogonn.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:3640
-
-
C:\Windows\SysWOW64\Winlog\winlogonn.exe"C:\Windows\system32\Winlog\winlogonn.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1448
-
-
C:\Windows\SysWOW64\Winlog\winlogonn.exe"C:\Windows\system32\Winlog\winlogonn.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:3680
-
-
C:\Windows\SysWOW64\Winlog\winlogonn.exe"C:\Windows\system32\Winlog\winlogonn.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:4372
-
-
C:\Windows\SysWOW64\Winlog\winlogonn.exe"C:\Windows\system32\Winlog\winlogonn.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2212
-
-
C:\Windows\SysWOW64\Winlog\winlogonn.exe"C:\Windows\system32\Winlog\winlogonn.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:4876
-
-
C:\Windows\SysWOW64\Winlog\winlogonn.exe"C:\Windows\system32\Winlog\winlogonn.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:4920
-
-
C:\Windows\SysWOW64\Winlog\winlogonn.exe"C:\Windows\system32\Winlog\winlogonn.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2872
-
-
C:\Windows\SysWOW64\Winlog\winlogonn.exe"C:\Windows\system32\Winlog\winlogonn.exe"5⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2996
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
274KB
MD5919dd12016105c1c493266b8cf953be4
SHA1c10905f567ed84e902558dc28a4403e31d9156f5
SHA256a59d766c381fe3fa7f273b42ecc646a8ccca83d432dac96d75aebb422539a3f9
SHA5127e8a9ad5b0c1d306f0b75c49d01de7dc006c28180152a4191b38e6486d3e0ac5f67cb2cf1fbaf0f9729a821d44a2117a511635720046245a39f6d1cd6ba3e47b
-
Filesize
227KB
MD5af61e40bb6fefb8cc39bafd1630dce8f
SHA18a854139b4305ed184eb73ca47c677c44aa50cf5
SHA25615c4c1213a79675ec0f2ea4ea16fadee790c65dd4cb6dc6faeb0313e937b1a78
SHA512e3cee1a34fea429ac7c0db231b2005a4013f2ac79aac0e30647ae15e7545e7417c41aa1fc5b9cf74669bf371bde4ffb9020c7c5443ad5e3c676dcb7d1fc64aac
-
Filesize
227KB
MD555d3f623c6ca6abc5ef4065b90f4b819
SHA11673dd7e6a9ab865ef9f0d6ba62097225b8b48c8
SHA256add9d847001f41cf1c6ad5f15d835b77eff0fb6ee7ac9defc801e1873e2f4b77
SHA5128509ad33d53eba356a076f8c9023de0d1a15415427ba47f51639ff31093b950d88b52d98a271b48ed2e78ea53cc2d3cb8ad44d3a1a70051963f55c861470d50c