Analysis
-
max time kernel
145s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/03/2025, 03:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
General
-
Target
JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe
-
Size
1.2MB
-
MD5
85b477a0eb3a1110d2ee4523bfe14c1b
-
SHA1
ef00a334fab01e8a7e998540efced39ace82ec75
-
SHA256
75a35c634b4438fa9f8f5f0a264a4af5e4942618721fe0b43617b84b369fc000
-
SHA512
de9235dfe241049f848476db020626102464634b3379e0954d6ff7666683a63d5598279381596b1e3206303ffa144a59168a666a93c83c448d9c1cf99c8ffcf8
-
SSDEEP
24576:nwQLyEvOM/mc6kz0ctbwSWftp2oUoX8EMiY4+lEIzh+Z7YniFyJ2i:nl0M+c6kz0ybE32oUoX80Y4+lEchw7v8
Malware Config
Extracted
Family
darkcomet
Botnet
Guest16
C2
192.168.2.21:3724
Mutex
DC_MUTEX-1Y8LAW0
Attributes
-
InstallPath
Dosya\server.exe
-
gencode
fhFgVlj9fFca
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
Server
rc4.plain
Extracted
Family
darkcomet
Attributes
- gencode
-
install
false
-
offline_keylogger
false
-
persistence
false
rc4.plain
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe" JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe -
Checks BIOS information in registry 2 TTPs 24 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe -
Executes dropped EXE 46 IoCs
pid Process 2928 server.exe 2824 server.exe 2972 server.exe 2152 server.exe 3004 server.exe 2004 server.exe 1608 server.exe 2104 server.exe 1892 server.exe 1856 server.exe 2444 server.exe 1412 server.exe 2424 server.exe 1520 server.exe 1504 server.exe 2400 server.exe 2628 server.exe 1484 server.exe 2188 server.exe 2972 server.exe 1268 server.exe 3068 server.exe 848 server.exe 2176 server.exe 1980 server.exe 1148 server.exe 1300 server.exe 1660 server.exe 2520 server.exe 2436 server.exe 2084 server.exe 1664 server.exe 2920 server.exe 2644 server.exe 2756 server.exe 2684 server.exe 284 server.exe 2900 server.exe 1984 server.exe 1936 server.exe 1816 server.exe 1832 server.exe 2072 server.exe 340 server.exe 1536 server.exe 948 server.exe -
Loads dropped DLL 46 IoCs
pid Process 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 2824 server.exe 2824 server.exe 2152 server.exe 2152 server.exe 2004 server.exe 2004 server.exe 2104 server.exe 2104 server.exe 1856 server.exe 1856 server.exe 1412 server.exe 1412 server.exe 1520 server.exe 1520 server.exe 2400 server.exe 2400 server.exe 1484 server.exe 1484 server.exe 2972 server.exe 2972 server.exe 3068 server.exe 3068 server.exe 2176 server.exe 2176 server.exe 1148 server.exe 1148 server.exe 1660 server.exe 1660 server.exe 2436 server.exe 2436 server.exe 1664 server.exe 1664 server.exe 2644 server.exe 2644 server.exe 2684 server.exe 2684 server.exe 2900 server.exe 2900 server.exe 1936 server.exe 1936 server.exe 1832 server.exe 1832 server.exe 340 server.exe 340 server.exe -
Adds Run key to start application 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File created C:\Windows\SysWOW64\Dosya\server.exe JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2504 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 2444 server.exe -
Suspicious use of SetThreadContext 23 IoCs
description pid Process procid_target PID 2504 set thread context of 2332 2504 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 30 PID 2928 set thread context of 2824 2928 server.exe 33 PID 2972 set thread context of 2152 2972 server.exe 35 PID 3004 set thread context of 2004 3004 server.exe 37 PID 1608 set thread context of 2104 1608 server.exe 39 PID 1892 set thread context of 1856 1892 server.exe 41 PID 2444 set thread context of 1412 2444 server.exe 43 PID 2424 set thread context of 1520 2424 server.exe 45 PID 1504 set thread context of 2400 1504 server.exe 47 PID 2628 set thread context of 1484 2628 server.exe 49 PID 2188 set thread context of 2972 2188 server.exe 51 PID 1268 set thread context of 3068 1268 server.exe 53 PID 848 set thread context of 2176 848 server.exe 55 PID 1980 set thread context of 1148 1980 server.exe 57 PID 1300 set thread context of 1660 1300 server.exe 59 PID 2084 set thread context of 1664 2084 server.exe 63 PID 2920 set thread context of 2644 2920 server.exe 65 PID 2756 set thread context of 2684 2756 server.exe 67 PID 284 set thread context of 2900 284 server.exe 69 PID 1984 set thread context of 1936 1984 server.exe 71 PID 1816 set thread context of 1832 1816 server.exe 73 PID 2072 set thread context of 340 2072 server.exe 75 PID 1536 set thread context of 948 1536 server.exe 77 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 48 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe -
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe -
Enumerates system info in registry 2 TTPs 24 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeSecurityPrivilege 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeTakeOwnershipPrivilege 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeLoadDriverPrivilege 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeSystemProfilePrivilege 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeSystemtimePrivilege 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeProfSingleProcessPrivilege 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeIncBasePriorityPrivilege 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeCreatePagefilePrivilege 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeBackupPrivilege 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeRestorePrivilege 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeShutdownPrivilege 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeDebugPrivilege 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeSystemEnvironmentPrivilege 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeChangeNotifyPrivilege 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeRemoteShutdownPrivilege 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeUndockPrivilege 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeManageVolumePrivilege 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeImpersonatePrivilege 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeCreateGlobalPrivilege 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: 33 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: 34 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: 35 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeIncreaseQuotaPrivilege 2824 server.exe Token: SeSecurityPrivilege 2824 server.exe Token: SeTakeOwnershipPrivilege 2824 server.exe Token: SeLoadDriverPrivilege 2824 server.exe Token: SeSystemProfilePrivilege 2824 server.exe Token: SeSystemtimePrivilege 2824 server.exe Token: SeProfSingleProcessPrivilege 2824 server.exe Token: SeIncBasePriorityPrivilege 2824 server.exe Token: SeCreatePagefilePrivilege 2824 server.exe Token: SeBackupPrivilege 2824 server.exe Token: SeRestorePrivilege 2824 server.exe Token: SeShutdownPrivilege 2824 server.exe Token: SeDebugPrivilege 2824 server.exe Token: SeSystemEnvironmentPrivilege 2824 server.exe Token: SeChangeNotifyPrivilege 2824 server.exe Token: SeRemoteShutdownPrivilege 2824 server.exe Token: SeUndockPrivilege 2824 server.exe Token: SeManageVolumePrivilege 2824 server.exe Token: SeImpersonatePrivilege 2824 server.exe Token: SeCreateGlobalPrivilege 2824 server.exe Token: 33 2824 server.exe Token: 34 2824 server.exe Token: 35 2824 server.exe Token: SeIncreaseQuotaPrivilege 2152 server.exe Token: SeSecurityPrivilege 2152 server.exe Token: SeTakeOwnershipPrivilege 2152 server.exe Token: SeLoadDriverPrivilege 2152 server.exe Token: SeSystemProfilePrivilege 2152 server.exe Token: SeSystemtimePrivilege 2152 server.exe Token: SeProfSingleProcessPrivilege 2152 server.exe Token: SeIncBasePriorityPrivilege 2152 server.exe Token: SeCreatePagefilePrivilege 2152 server.exe Token: SeBackupPrivilege 2152 server.exe Token: SeRestorePrivilege 2152 server.exe Token: SeShutdownPrivilege 2152 server.exe Token: SeDebugPrivilege 2152 server.exe Token: SeSystemEnvironmentPrivilege 2152 server.exe Token: SeChangeNotifyPrivilege 2152 server.exe Token: SeRemoteShutdownPrivilege 2152 server.exe Token: SeUndockPrivilege 2152 server.exe Token: SeManageVolumePrivilege 2152 server.exe -
Suspicious use of SetWindowsHookEx 46 IoCs
pid Process 2504 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 2504 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 2928 server.exe 2928 server.exe 2972 server.exe 2972 server.exe 3004 server.exe 3004 server.exe 1608 server.exe 1608 server.exe 1892 server.exe 1892 server.exe 2444 server.exe 2444 server.exe 2424 server.exe 2424 server.exe 1504 server.exe 1504 server.exe 2628 server.exe 2628 server.exe 2188 server.exe 2188 server.exe 1268 server.exe 1268 server.exe 848 server.exe 848 server.exe 1980 server.exe 1980 server.exe 1300 server.exe 1300 server.exe 2084 server.exe 2084 server.exe 2920 server.exe 2920 server.exe 2756 server.exe 2756 server.exe 284 server.exe 284 server.exe 1984 server.exe 1984 server.exe 1816 server.exe 1816 server.exe 2072 server.exe 2072 server.exe 1536 server.exe 1536 server.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2332 2504 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 30 PID 2504 wrote to memory of 2332 2504 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 30 PID 2504 wrote to memory of 2332 2504 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 30 PID 2504 wrote to memory of 2332 2504 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 30 PID 2504 wrote to memory of 2332 2504 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 30 PID 2504 wrote to memory of 2332 2504 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 30 PID 2504 wrote to memory of 2332 2504 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 30 PID 2504 wrote to memory of 2332 2504 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 30 PID 2504 wrote to memory of 2332 2504 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 30 PID 2504 wrote to memory of 2332 2504 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 30 PID 2504 wrote to memory of 2332 2504 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 30 PID 2504 wrote to memory of 2332 2504 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 30 PID 2504 wrote to memory of 2332 2504 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 30 PID 2332 wrote to memory of 2928 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 32 PID 2332 wrote to memory of 2928 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 32 PID 2332 wrote to memory of 2928 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 32 PID 2332 wrote to memory of 2928 2332 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 32 PID 2928 wrote to memory of 2824 2928 server.exe 33 PID 2928 wrote to memory of 2824 2928 server.exe 33 PID 2928 wrote to memory of 2824 2928 server.exe 33 PID 2928 wrote to memory of 2824 2928 server.exe 33 PID 2928 wrote to memory of 2824 2928 server.exe 33 PID 2928 wrote to memory of 2824 2928 server.exe 33 PID 2928 wrote to memory of 2824 2928 server.exe 33 PID 2928 wrote to memory of 2824 2928 server.exe 33 PID 2928 wrote to memory of 2824 2928 server.exe 33 PID 2928 wrote to memory of 2824 2928 server.exe 33 PID 2928 wrote to memory of 2824 2928 server.exe 33 PID 2928 wrote to memory of 2824 2928 server.exe 33 PID 2928 wrote to memory of 2824 2928 server.exe 33 PID 2824 wrote to memory of 2972 2824 server.exe 34 PID 2824 wrote to memory of 2972 2824 server.exe 34 PID 2824 wrote to memory of 2972 2824 server.exe 34 PID 2824 wrote to memory of 2972 2824 server.exe 34 PID 2972 wrote to memory of 2152 2972 server.exe 35 PID 2972 wrote to memory of 2152 2972 server.exe 35 PID 2972 wrote to memory of 2152 2972 server.exe 35 PID 2972 wrote to memory of 2152 2972 server.exe 35 PID 2972 wrote to memory of 2152 2972 server.exe 35 PID 2972 wrote to memory of 2152 2972 server.exe 35 PID 2972 wrote to memory of 2152 2972 server.exe 35 PID 2972 wrote to memory of 2152 2972 server.exe 35 PID 2972 wrote to memory of 2152 2972 server.exe 35 PID 2972 wrote to memory of 2152 2972 server.exe 35 PID 2972 wrote to memory of 2152 2972 server.exe 35 PID 2972 wrote to memory of 2152 2972 server.exe 35 PID 2972 wrote to memory of 2152 2972 server.exe 35 PID 2152 wrote to memory of 3004 2152 server.exe 36 PID 2152 wrote to memory of 3004 2152 server.exe 36 PID 2152 wrote to memory of 3004 2152 server.exe 36 PID 2152 wrote to memory of 3004 2152 server.exe 36 PID 3004 wrote to memory of 2004 3004 server.exe 37 PID 3004 wrote to memory of 2004 3004 server.exe 37 PID 3004 wrote to memory of 2004 3004 server.exe 37 PID 3004 wrote to memory of 2004 3004 server.exe 37 PID 3004 wrote to memory of 2004 3004 server.exe 37 PID 3004 wrote to memory of 2004 3004 server.exe 37 PID 3004 wrote to memory of 2004 3004 server.exe 37 PID 3004 wrote to memory of 2004 3004 server.exe 37 PID 3004 wrote to memory of 2004 3004 server.exe 37 PID 3004 wrote to memory of 2004 3004 server.exe 37 PID 3004 wrote to memory of 2004 3004 server.exe 37 PID 3004 wrote to memory of 2004 3004 server.exe 37 PID 3004 wrote to memory of 2004 3004 server.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe4⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe6⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe8⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
PID:2004 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1608 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe10⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
PID:2104 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1892 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe12⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
PID:1856 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"13⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2444 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe14⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
PID:1412 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2424 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe16⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
PID:1520 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1504 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe18⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
PID:2400 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2628 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe20⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
PID:1484 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2188 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe22⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
PID:2972 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1268 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe24⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
PID:3068 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:848 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe26⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
PID:2176 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1980 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe28⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
PID:1148 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1300 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe30⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
PID:1660 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2520 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe32⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
PID:2436 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2084 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe34⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
PID:1664 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2920 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe36⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
PID:2644 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2756 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe38⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
PID:2684 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:284 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe40⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
PID:2900 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1984 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe42⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
PID:1936 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1816 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe44⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
PID:1832 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2072 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe46⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
PID:340 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1536 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe48⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
PID:948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14B
MD576744fd0fef037cb9504b3401a57de29
SHA199b04b5bbe22b1d38e6c899a17d898ba0509f751
SHA2561dbb16ea80fbd0346177a11e75ca938190456106495e975b6d67cf238a4b9a09
SHA51200d403238a2c9e958d304777cc01a279f5318e826f93e82e64df75e1deac68e2843348447e026ed627195b0584ac50e223aa3dae19a57152d20c3ad8a2439cb7
-
Filesize
1.2MB
MD585b477a0eb3a1110d2ee4523bfe14c1b
SHA1ef00a334fab01e8a7e998540efced39ace82ec75
SHA25675a35c634b4438fa9f8f5f0a264a4af5e4942618721fe0b43617b84b369fc000
SHA512de9235dfe241049f848476db020626102464634b3379e0954d6ff7666683a63d5598279381596b1e3206303ffa144a59168a666a93c83c448d9c1cf99c8ffcf8