Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
22/03/2025, 03:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
General
-
Target
JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe
-
Size
1.2MB
-
MD5
85b477a0eb3a1110d2ee4523bfe14c1b
-
SHA1
ef00a334fab01e8a7e998540efced39ace82ec75
-
SHA256
75a35c634b4438fa9f8f5f0a264a4af5e4942618721fe0b43617b84b369fc000
-
SHA512
de9235dfe241049f848476db020626102464634b3379e0954d6ff7666683a63d5598279381596b1e3206303ffa144a59168a666a93c83c448d9c1cf99c8ffcf8
-
SSDEEP
24576:nwQLyEvOM/mc6kz0ctbwSWftp2oUoX8EMiY4+lEIzh+Z7YniFyJ2i:nl0M+c6kz0ybE32oUoX80Y4+lEchw7v8
Malware Config
Extracted
Family
darkcomet
Botnet
Guest16
C2
192.168.2.21:3724
Mutex
DC_MUTEX-1Y8LAW0
Attributes
-
InstallPath
Dosya\server.exe
-
gencode
fhFgVlj9fFca
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
Server
rc4.plain
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 25 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe" JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe,C:\\Windows\\system32\\Dosya\\server.exe" server.exe -
Checks BIOS information in registry 2 TTPs 25 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate server.exe -
Checks computer location settings 2 TTPs 25 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation server.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation server.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation server.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation server.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation server.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation server.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation server.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation server.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation server.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation server.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation server.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation server.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation server.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation server.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation server.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation server.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation server.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation server.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation server.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation server.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation server.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation server.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation server.exe Key value queried \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation server.exe -
Executes dropped EXE 48 IoCs
pid Process 2848 server.exe 3872 server.exe 1812 server.exe 2204 server.exe 4192 server.exe 1544 server.exe 548 server.exe 2252 server.exe 4508 server.exe 4788 server.exe 456 server.exe 2736 server.exe 1688 server.exe 4560 server.exe 4852 server.exe 3724 server.exe 612 server.exe 3112 server.exe 448 server.exe 2184 server.exe 1812 server.exe 1972 server.exe 3100 server.exe 456 server.exe 1156 server.exe 1008 server.exe 3780 server.exe 3696 server.exe 2916 server.exe 1016 server.exe 4812 server.exe 5040 server.exe 3668 server.exe 4604 server.exe 4516 server.exe 1316 server.exe 4840 server.exe 3996 server.exe 3428 server.exe 5004 server.exe 4620 server.exe 4804 server.exe 4612 server.exe 4744 server.exe 1760 server.exe 2216 server.exe 2916 server.exe 1772 server.exe -
Adds Run key to start application 2 TTPs 25 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Windows\\system32\\Dosya\\server.exe" server.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Dosya\server.exe JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File created C:\Windows\SysWOW64\Dosya\server.exe server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe File created C:\Windows\SysWOW64\Dosya\server.exe JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe File opened for modification C:\Windows\SysWOW64\Dosya\ server.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 3480 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 2848 server.exe 4192 server.exe 2916 server.exe 4620 server.exe 1760 server.exe -
Suspicious use of SetThreadContext 25 IoCs
description pid Process procid_target PID 3480 set thread context of 3540 3480 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 89 PID 2848 set thread context of 3872 2848 server.exe 96 PID 1812 set thread context of 2204 1812 server.exe 100 PID 4192 set thread context of 1544 4192 server.exe 102 PID 548 set thread context of 2252 548 server.exe 104 PID 4508 set thread context of 4788 4508 server.exe 107 PID 456 set thread context of 2736 456 server.exe 117 PID 1688 set thread context of 4560 1688 server.exe 119 PID 4852 set thread context of 3724 4852 server.exe 121 PID 612 set thread context of 3112 612 server.exe 123 PID 448 set thread context of 2184 448 server.exe 125 PID 1812 set thread context of 1972 1812 server.exe 127 PID 3100 set thread context of 456 3100 server.exe 129 PID 1156 set thread context of 1008 1156 server.exe 132 PID 3780 set thread context of 3696 3780 server.exe 134 PID 2916 set thread context of 1016 2916 server.exe 136 PID 4812 set thread context of 5040 4812 server.exe 138 PID 3668 set thread context of 4604 3668 server.exe 140 PID 4516 set thread context of 1316 4516 server.exe 142 PID 4840 set thread context of 3996 4840 server.exe 144 PID 3428 set thread context of 5004 3428 server.exe 146 PID 4620 set thread context of 4804 4620 server.exe 148 PID 4612 set thread context of 4744 4612 server.exe 150 PID 1760 set thread context of 2216 1760 server.exe 152 PID 2916 set thread context of 1772 2916 server.exe 154 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 50 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe -
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier server.exe -
Enumerates system info in registry 2 TTPs 25 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier server.exe -
Modifies registry class 25 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ server.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ server.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ server.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ server.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ server.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ server.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ server.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ server.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ server.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ server.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ server.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ server.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ server.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ server.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ server.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ server.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ server.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ server.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ server.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ server.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ server.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ server.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ server.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ server.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3540 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeSecurityPrivilege 3540 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeTakeOwnershipPrivilege 3540 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeLoadDriverPrivilege 3540 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeSystemProfilePrivilege 3540 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeSystemtimePrivilege 3540 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeProfSingleProcessPrivilege 3540 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeIncBasePriorityPrivilege 3540 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeCreatePagefilePrivilege 3540 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeBackupPrivilege 3540 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeRestorePrivilege 3540 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeShutdownPrivilege 3540 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeDebugPrivilege 3540 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeSystemEnvironmentPrivilege 3540 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeChangeNotifyPrivilege 3540 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeRemoteShutdownPrivilege 3540 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeUndockPrivilege 3540 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeManageVolumePrivilege 3540 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeImpersonatePrivilege 3540 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeCreateGlobalPrivilege 3540 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: 33 3540 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: 34 3540 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: 35 3540 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: 36 3540 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe Token: SeIncreaseQuotaPrivilege 3872 server.exe Token: SeSecurityPrivilege 3872 server.exe Token: SeTakeOwnershipPrivilege 3872 server.exe Token: SeLoadDriverPrivilege 3872 server.exe Token: SeSystemProfilePrivilege 3872 server.exe Token: SeSystemtimePrivilege 3872 server.exe Token: SeProfSingleProcessPrivilege 3872 server.exe Token: SeIncBasePriorityPrivilege 3872 server.exe Token: SeCreatePagefilePrivilege 3872 server.exe Token: SeBackupPrivilege 3872 server.exe Token: SeRestorePrivilege 3872 server.exe Token: SeShutdownPrivilege 3872 server.exe Token: SeDebugPrivilege 3872 server.exe Token: SeSystemEnvironmentPrivilege 3872 server.exe Token: SeChangeNotifyPrivilege 3872 server.exe Token: SeRemoteShutdownPrivilege 3872 server.exe Token: SeUndockPrivilege 3872 server.exe Token: SeManageVolumePrivilege 3872 server.exe Token: SeImpersonatePrivilege 3872 server.exe Token: SeCreateGlobalPrivilege 3872 server.exe Token: 33 3872 server.exe Token: 34 3872 server.exe Token: 35 3872 server.exe Token: 36 3872 server.exe Token: SeIncreaseQuotaPrivilege 2204 server.exe Token: SeSecurityPrivilege 2204 server.exe Token: SeTakeOwnershipPrivilege 2204 server.exe Token: SeLoadDriverPrivilege 2204 server.exe Token: SeSystemProfilePrivilege 2204 server.exe Token: SeSystemtimePrivilege 2204 server.exe Token: SeProfSingleProcessPrivilege 2204 server.exe Token: SeIncBasePriorityPrivilege 2204 server.exe Token: SeCreatePagefilePrivilege 2204 server.exe Token: SeBackupPrivilege 2204 server.exe Token: SeRestorePrivilege 2204 server.exe Token: SeShutdownPrivilege 2204 server.exe Token: SeDebugPrivilege 2204 server.exe Token: SeSystemEnvironmentPrivilege 2204 server.exe Token: SeChangeNotifyPrivilege 2204 server.exe Token: SeRemoteShutdownPrivilege 2204 server.exe -
Suspicious use of SetWindowsHookEx 50 IoCs
pid Process 3480 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 3480 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 2848 server.exe 2848 server.exe 1812 server.exe 1812 server.exe 4192 server.exe 4192 server.exe 548 server.exe 548 server.exe 4508 server.exe 4508 server.exe 456 server.exe 456 server.exe 1688 server.exe 1688 server.exe 4852 server.exe 4852 server.exe 612 server.exe 612 server.exe 448 server.exe 448 server.exe 1812 server.exe 1812 server.exe 3100 server.exe 3100 server.exe 1156 server.exe 1156 server.exe 3780 server.exe 3780 server.exe 2916 server.exe 2916 server.exe 4812 server.exe 4812 server.exe 3668 server.exe 3668 server.exe 4516 server.exe 4516 server.exe 4840 server.exe 4840 server.exe 3428 server.exe 3428 server.exe 4620 server.exe 4620 server.exe 4612 server.exe 4612 server.exe 1760 server.exe 1760 server.exe 2916 server.exe 2916 server.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3480 wrote to memory of 3540 3480 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 89 PID 3480 wrote to memory of 3540 3480 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 89 PID 3480 wrote to memory of 3540 3480 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 89 PID 3480 wrote to memory of 3540 3480 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 89 PID 3480 wrote to memory of 3540 3480 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 89 PID 3480 wrote to memory of 3540 3480 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 89 PID 3480 wrote to memory of 3540 3480 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 89 PID 3480 wrote to memory of 3540 3480 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 89 PID 3480 wrote to memory of 3540 3480 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 89 PID 3480 wrote to memory of 3540 3480 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 89 PID 3480 wrote to memory of 3540 3480 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 89 PID 3480 wrote to memory of 3540 3480 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 89 PID 3480 wrote to memory of 3540 3480 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 89 PID 3480 wrote to memory of 3540 3480 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 89 PID 3540 wrote to memory of 2848 3540 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 95 PID 3540 wrote to memory of 2848 3540 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 95 PID 3540 wrote to memory of 2848 3540 JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe 95 PID 2848 wrote to memory of 3872 2848 server.exe 96 PID 2848 wrote to memory of 3872 2848 server.exe 96 PID 2848 wrote to memory of 3872 2848 server.exe 96 PID 2848 wrote to memory of 3872 2848 server.exe 96 PID 2848 wrote to memory of 3872 2848 server.exe 96 PID 2848 wrote to memory of 3872 2848 server.exe 96 PID 2848 wrote to memory of 3872 2848 server.exe 96 PID 2848 wrote to memory of 3872 2848 server.exe 96 PID 2848 wrote to memory of 3872 2848 server.exe 96 PID 2848 wrote to memory of 3872 2848 server.exe 96 PID 2848 wrote to memory of 3872 2848 server.exe 96 PID 2848 wrote to memory of 3872 2848 server.exe 96 PID 2848 wrote to memory of 3872 2848 server.exe 96 PID 2848 wrote to memory of 3872 2848 server.exe 96 PID 3872 wrote to memory of 1812 3872 server.exe 99 PID 3872 wrote to memory of 1812 3872 server.exe 99 PID 3872 wrote to memory of 1812 3872 server.exe 99 PID 1812 wrote to memory of 2204 1812 server.exe 100 PID 1812 wrote to memory of 2204 1812 server.exe 100 PID 1812 wrote to memory of 2204 1812 server.exe 100 PID 1812 wrote to memory of 2204 1812 server.exe 100 PID 1812 wrote to memory of 2204 1812 server.exe 100 PID 1812 wrote to memory of 2204 1812 server.exe 100 PID 1812 wrote to memory of 2204 1812 server.exe 100 PID 1812 wrote to memory of 2204 1812 server.exe 100 PID 1812 wrote to memory of 2204 1812 server.exe 100 PID 1812 wrote to memory of 2204 1812 server.exe 100 PID 1812 wrote to memory of 2204 1812 server.exe 100 PID 1812 wrote to memory of 2204 1812 server.exe 100 PID 1812 wrote to memory of 2204 1812 server.exe 100 PID 1812 wrote to memory of 2204 1812 server.exe 100 PID 2204 wrote to memory of 4192 2204 server.exe 101 PID 2204 wrote to memory of 4192 2204 server.exe 101 PID 2204 wrote to memory of 4192 2204 server.exe 101 PID 4192 wrote to memory of 1544 4192 server.exe 102 PID 4192 wrote to memory of 1544 4192 server.exe 102 PID 4192 wrote to memory of 1544 4192 server.exe 102 PID 4192 wrote to memory of 1544 4192 server.exe 102 PID 4192 wrote to memory of 1544 4192 server.exe 102 PID 4192 wrote to memory of 1544 4192 server.exe 102 PID 4192 wrote to memory of 1544 4192 server.exe 102 PID 4192 wrote to memory of 1544 4192 server.exe 102 PID 4192 wrote to memory of 1544 4192 server.exe 102 PID 4192 wrote to memory of 1544 4192 server.exe 102 PID 4192 wrote to memory of 1544 4192 server.exe 102 PID 4192 wrote to memory of 1544 4192 server.exe 102 PID 4192 wrote to memory of 1544 4192 server.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_85b477a0eb3a1110d2ee4523bfe14c1b.exe2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe4⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe6⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"7⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe8⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
PID:1544 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:548 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe10⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
PID:2252 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4508 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe12⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
PID:4788 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:456 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe14⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
PID:2736 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1688 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe16⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
PID:4560 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4852 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe18⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
PID:3724 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:612 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe20⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
PID:3112 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:448 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe22⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
PID:2184 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1812 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe24⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
PID:1972 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3100 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe26⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
PID:456 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1156 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe28⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
PID:1008 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3780 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe30⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
PID:3696 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"31⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2916 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe32⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
PID:1016 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4812 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe34⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
PID:5040 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3668 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe36⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
PID:4604 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4516 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe38⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
PID:1316 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4840 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe40⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
PID:3996 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3428 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe42⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
PID:5004 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"43⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4620 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe44⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
PID:4804 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4612 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe46⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
PID:4744 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"47⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1760 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe48⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
PID:2216 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2916 -
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe50⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
PID:1772 -
C:\Windows\SysWOW64\Dosya\server.exe"C:\Windows\system32\Dosya\server.exe"51⤵PID:3592
-
C:\Windows\SysWOW64\Dosya\server.exeC:\Windows\SysWOW64\Dosya\server.exe52⤵PID:3552
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD585b477a0eb3a1110d2ee4523bfe14c1b
SHA1ef00a334fab01e8a7e998540efced39ace82ec75
SHA25675a35c634b4438fa9f8f5f0a264a4af5e4942618721fe0b43617b84b369fc000
SHA512de9235dfe241049f848476db020626102464634b3379e0954d6ff7666683a63d5598279381596b1e3206303ffa144a59168a666a93c83c448d9c1cf99c8ffcf8
-
Filesize
14B
MD576744fd0fef037cb9504b3401a57de29
SHA199b04b5bbe22b1d38e6c899a17d898ba0509f751
SHA2561dbb16ea80fbd0346177a11e75ca938190456106495e975b6d67cf238a4b9a09
SHA51200d403238a2c9e958d304777cc01a279f5318e826f93e82e64df75e1deac68e2843348447e026ed627195b0584ac50e223aa3dae19a57152d20c3ad8a2439cb7