Analysis
- max time kernel
94s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20250410-en - resource tags
arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system - submitted
28/04/2025, 03:51
Behavioral task
behavioral1
Sample
JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe
Resource
win10v2004-20250410-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe
Resource
win11-20250410-en
windows11-21h2-x64
23 signatures
150 seconds
General
- Target JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe
- Size 320KB
- Sample250428-eellbs1tcx
- SHA256 296968043dbf6bcf99749b25fbddca245ca799d7d7f74430f0ab76097cd5b42d
- MD5 dbfebfcccbacf0bab0c6674b3ba8ea91
- SHA1 0265115662ff1c6cecd153525c3e88d8439708a8
- SHA512 a36c181b448ce5cc71fb8061e77bb6306a9de522814763197349527dde889c28fc4f0ad60f3aef6a8a01ab86fa0c27e90a4e50475ec015c9c40c328698feabe7
- SSDEEP 6144:hTwEo1IV3puaibGKFHi0mofhaH05kipz016580bHFMdkhq86JQPDHDdx/QtqR:5CgvmzFHi0mo5aH0qMzd5807F7qPJQPx
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" mtvchs.exe - Pykspa family
- UAC bypass 3 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mtvchs.exe - Detect Pykspa worm 1 IoCs
resource yara_rule behavioral2/files/0x001a00000002b051-4.dat family_pykspa - Adds policy Run key to start application 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lpo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zticusfbylusmvhqvrd.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mtvchs = "zticusfbylusmvhqvrd.exe" JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lpo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ypbshcmfzjpkbhqw.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lpo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ypbshcmfzjpkbhqw.exe" JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run mtvchs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mtvchs = "bxokeetrqfqqmxlwdbplc.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mtvchs = "ohvofcojfrzwpxiqup.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mtvchs = "zticusfbylusmvhqvrd.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mtvchs = "fxkcsoztozgcublsv.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mtvchs = "ohvofcojfrzwpxiqup.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mtvchs = "mhxslkyvthrqlvisyvid.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lpo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zticusfbylusmvhqvrd.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lpo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bxokeetrqfqqmxlwdbplc.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mtvchs = "ypbshcmfzjpkbhqw.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lpo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ypbshcmfzjpkbhqw.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mtvchs = "zticusfbylusmvhqvrd.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lpo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohvofcojfrzwpxiqup.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mtvchs = "ypbshcmfzjpkbhqw.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mtvchs = "fxkcsoztozgcublsv.exe" JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lpo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohvofcojfrzwpxiqup.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lpo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bxokeetrqfqqmxlwdbplc.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lpo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhxslkyvthrqlvisyvid.exe" mtvchs.exe - Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Set value (int) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" mtvchs.exe Set value (int) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" mtvchs.exe - Executes dropped EXE 2 IoCs
pid Process 5028 mtvchs.exe 3728 mtvchs.exe - Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager mtvchs.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys mtvchs.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc mtvchs.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power mtvchs.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys mtvchs.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc mtvchs.exe - Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yjpajycpdh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhxslkyvthrqlvisyvid.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yjpajycpdh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhxslkyvthrqlvisyvid.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bhios = "ypbshcmfzjpkbhqw.exe ." mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yjpajycpdh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohvofcojfrzwpxiqup.exe" mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\Run\sxxc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ypbshcmfzjpkbhqw.exe" mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\Run\zhksykl = "ohvofcojfrzwpxiqup.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yjpajycpdh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bxokeetrqfqqmxlwdbplc.exe" mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\Run\zhksykl = "fxkcsoztozgcublsv.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sxxc = "ohvofcojfrzwpxiqup.exe" mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bhios = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ypbshcmfzjpkbhqw.exe ." mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bhios = "fxkcsoztozgcublsv.exe ." mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bhios = "bxokeetrqfqqmxlwdbplc.exe ." JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\Run\zhksykl = "zticusfbylusmvhqvrd.exe" JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\Run\sxxc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohvofcojfrzwpxiqup.exe" JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bhios = "ohvofcojfrzwpxiqup.exe ." mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\Run\zhksykl = "mhxslkyvthrqlvisyvid.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bhios = "zticusfbylusmvhqvrd.exe ." mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\Run\zhksykl = "ypbshcmfzjpkbhqw.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fpuemadpc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fxkcsoztozgcublsv.exe ." mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\Run\zhksykl = "ohvofcojfrzwpxiqup.exe" mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\Run\zhksykl = "bxokeetrqfqqmxlwdbplc.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sxxc = "bxokeetrqfqqmxlwdbplc.exe" mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\oxbkregr = "mhxslkyvthrqlvisyvid.exe ." mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\Run\sxxc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ypbshcmfzjpkbhqw.exe" mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\oxbkregr = "zticusfbylusmvhqvrd.exe ." mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bhios = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zticusfbylusmvhqvrd.exe ." mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bhios = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohvofcojfrzwpxiqup.exe ." mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\oxbkregr = "fxkcsoztozgcublsv.exe ." JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yjpajycpdh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohvofcojfrzwpxiqup.exe" JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sxxc = "mhxslkyvthrqlvisyvid.exe" mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\Run\zhksykl = "ypbshcmfzjpkbhqw.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sxxc = "fxkcsoztozgcublsv.exe" mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\Run\zhksykl = "bxokeetrqfqqmxlwdbplc.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bhios = "zticusfbylusmvhqvrd.exe ." mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bhios = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fxkcsoztozgcublsv.exe ." mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fpuemadpc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohvofcojfrzwpxiqup.exe ." mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\Run\sxxc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhxslkyvthrqlvisyvid.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bhios = "mhxslkyvthrqlvisyvid.exe ." mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\Run\sxxc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bxokeetrqfqqmxlwdbplc.exe" mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bhios = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bxokeetrqfqqmxlwdbplc.exe ." mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sxxc = "ypbshcmfzjpkbhqw.exe" mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bhios = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhxslkyvthrqlvisyvid.exe ." mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\oxbkregr = "fxkcsoztozgcublsv.exe ." mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yjpajycpdh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ypbshcmfzjpkbhqw.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yjpajycpdh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fxkcsoztozgcublsv.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fpuemadpc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ypbshcmfzjpkbhqw.exe ." mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\oxbkregr = "ohvofcojfrzwpxiqup.exe ." mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bhios = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohvofcojfrzwpxiqup.exe ." mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\oxbkregr = "fxkcsoztozgcublsv.exe ." mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fpuemadpc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohvofcojfrzwpxiqup.exe ." mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\Run\zhksykl = "mhxslkyvthrqlvisyvid.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sxxc = "bxokeetrqfqqmxlwdbplc.exe" mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\oxbkregr = "ohvofcojfrzwpxiqup.exe ." mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\oxbkregr = "mhxslkyvthrqlvisyvid.exe ." mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bhios = "bxokeetrqfqqmxlwdbplc.exe ." mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\Run\sxxc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohvofcojfrzwpxiqup.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fpuemadpc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ypbshcmfzjpkbhqw.exe ." JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sxxc = "mhxslkyvthrqlvisyvid.exe" mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bhios = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ypbshcmfzjpkbhqw.exe ." mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bhios = "mhxslkyvthrqlvisyvid.exe ." mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sxxc = "fxkcsoztozgcublsv.exe" mtvchs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yjpajycpdh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohvofcojfrzwpxiqup.exe" mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bhios = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fxkcsoztozgcublsv.exe ." mtvchs.exe Set value (str) \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bhios = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhxslkyvthrqlvisyvid.exe ." mtvchs.exe - Checks whether UAC is enabled 1 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mtvchs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mtvchs.exe - Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" mtvchs.exe - Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 whatismyipaddress.com 2 whatismyip.everdot.org 4 www.whatismyip.ca 4 whatismyip.everdot.org 2 www.showmyipaddress.com - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\bhioscbjsrmwcxvqhpntuaeonve.yio mtvchs.exe File created C:\Windows\SysWOW64\bhioscbjsrmwcxvqhpntuaeonve.yio mtvchs.exe File opened for modification C:\Windows\SysWOW64\ypbshcmfzjpkbhqwyrardujeohblrmdjsyatct.wlg mtvchs.exe File created C:\Windows\SysWOW64\ypbshcmfzjpkbhqwyrardujeohblrmdjsyatct.wlg mtvchs.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\bhioscbjsrmwcxvqhpntuaeonve.yio mtvchs.exe File created C:\Program Files (x86)\bhioscbjsrmwcxvqhpntuaeonve.yio mtvchs.exe File opened for modification C:\Program Files (x86)\ypbshcmfzjpkbhqwyrardujeohblrmdjsyatct.wlg mtvchs.exe File created C:\Program Files (x86)\ypbshcmfzjpkbhqwyrardujeohblrmdjsyatct.wlg mtvchs.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\ypbshcmfzjpkbhqwyrardujeohblrmdjsyatct.wlg mtvchs.exe File opened for modification C:\Windows\bhioscbjsrmwcxvqhpntuaeonve.yio mtvchs.exe File created C:\Windows\bhioscbjsrmwcxvqhpntuaeonve.yio mtvchs.exe File opened for modification C:\Windows\ypbshcmfzjpkbhqwyrardujeohblrmdjsyatct.wlg mtvchs.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mtvchs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mtvchs.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000_Classes\Local Settings JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Key created \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000_Classes\Local Settings mtvchs.exe Key created \REGISTRY\USER\S-1-5-21-649025904-2769175349-3954215257-1000_Classes\Local Settings mtvchs.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 3728 mtvchs.exe 3728 mtvchs.exe 3728 mtvchs.exe 3728 mtvchs.exe 3728 mtvchs.exe 3728 mtvchs.exe 3728 mtvchs.exe 3728 mtvchs.exe 3728 mtvchs.exe 3728 mtvchs.exe 3728 mtvchs.exe 3728 mtvchs.exe 3728 mtvchs.exe 3728 mtvchs.exe 3728 mtvchs.exe 3728 mtvchs.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3728 mtvchs.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4532 wrote to memory of 5028 4532 JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe 90 PID 4532 wrote to memory of 5028 4532 JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe 90 PID 4532 wrote to memory of 5028 4532 JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe 90 PID 4532 wrote to memory of 3728 4532 JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe 91 PID 4532 wrote to memory of 3728 4532 JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe 91 PID 4532 wrote to memory of 3728 4532 JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe 91 - System policy modification 1 TTPs 36 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mtvchs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" mtvchs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" mtvchs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" mtvchs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" mtvchs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" mtvchs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dbfebfcccbacf0bab0c6674b3ba8ea91.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\mtvchs.exe"C:\Users\Admin\AppData\Local\Temp\mtvchs.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- Modifies registry class
- System policy modification
PID:5028
-
-
C:\Users\Admin\AppData\Local\Temp\mtvchs.exe"C:\Users\Admin\AppData\Local\Temp\mtvchs.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3728
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c bxokeetrqfqqmxlwdbplc.exe1⤵PID:2800
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c bxokeetrqfqqmxlwdbplc.exe .1⤵PID:1096
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c zticusfbylusmvhqvrd.exe1⤵PID:228
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c fxkcsoztozgcublsv.exe .1⤵PID:3552
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ohvofcojfrzwpxiqup.exe1⤵PID:2840
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ypbshcmfzjpkbhqw.exe .1⤵PID:5180
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c mhxslkyvthrqlvisyvid.exe1⤵PID:784
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5596
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ohvofcojfrzwpxiqup.exe .1⤵PID:3484
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c zticusfbylusmvhqvrd.exe .1⤵PID:2080
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c fxkcsoztozgcublsv.exe1⤵PID:812
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c mhxslkyvthrqlvisyvid.exe .1⤵PID:5804
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zticusfbylusmvhqvrd.exe1⤵PID:4632
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\mhxslkyvthrqlvisyvid.exe1⤵PID:5012
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bxokeetrqfqqmxlwdbplc.exe .1⤵PID:1684
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\zticusfbylusmvhqvrd.exe .1⤵PID:4888
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ypbshcmfzjpkbhqw.exe1⤵PID:5984
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ypbshcmfzjpkbhqw.exe1⤵PID:3704
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\fxkcsoztozgcublsv.exe1⤵PID:3160
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bxokeetrqfqqmxlwdbplc.exe1⤵PID:1100
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\fxkcsoztozgcublsv.exe .1⤵PID:2032
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ypbshcmfzjpkbhqw.exe .1⤵PID:3560
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ohvofcojfrzwpxiqup.exe .1⤵PID:3424
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\mhxslkyvthrqlvisyvid.exe .1⤵PID:4656
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ohvofcojfrzwpxiqup.exe1⤵PID:3100
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\bhioscbjsrmwcxvqhpntuaeonve.yio
- Size 280B
- SHA256 c7b1d4edc3a045cc4ef07ab038e7ab573f8923b10657f84f8ae7da483202c86c
- MD5 7815c651e95981b28c05a5ffff01d061
- SHA1 46f48c56ce963f583a97a43e896f7c50e1302ff7
- SHA512 7c467cafb4382569085896aab6785d1bf2fb498af81d04ac6288ef000104e2bf1a82c48da90329970457bc7a6879535a172592e718517b0d51a13b6a7e60c83c
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\bhioscbjsrmwcxvqhpntuaeonve.yio
- Size 280B
- SHA256 379a2f9dfb7db865cbd8a678516bc5d811019bd5c47971b015f780973af18bc8
- MD5 a2a326ba86a4e7f5fb376a66e05c33b5
- SHA1 7b343cf385a603e8b2f4a8eb7b23310e4c039084
- SHA512 7cbfaa9881b5813bf2d4d589b55b27a9b15d618ead8f0c83739db6874000be6467d0a5fcdbafdf9642fa9698b2b1dde319ad1d4427eb13b6f5d87014502a5999
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\mtvchs.exe
- Size 700KB
- SHA256 28611558aabf75c28f048749c728bddb498f584ebe4f0a848d89e226ca8a8d78
- MD5 13826d96e4e26fdcab37b50690d8f275
- SHA1 21e0b3bcc4f5cce16b30b6c27aebd1b1f2bf30ad
- SHA512 070aa69e271e555e8c056502fd0f36c3e87d32a33dbc6b3c332ff2664f6590d0e8dd4862f2f2b7c01784d60d2b832016185489c67f2a9c4f0378910c9dfbe381
- SSDEEP 12288:lCgvmzFHi0mo5aH0qMzd5807FiZPJQPDHvd:lCgvOHi0mGaH0qSdPFW4V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\bhioscbjsrmwcxvqhpntuaeonve.yio
- Size 280B
- SHA256 c0e6cc08d9d5e78b1d31e2d1cc15976cfe4e35768e4af4682a5e9a6dba284984
- MD5 4b06e1c81b54dd90f9505694f4d1d980
- SHA1 8766f22705ce2e6a0182d19b1fa05b54c4a5e3d9
- SHA512 7d2dd42d6a7a9741685969db03be06effe3b502d9eabfd7c10cdaf3a8868755e959383dc195942903aa376084cc18166bab919b3a7707983e9d2bee60fd7859a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\bhioscbjsrmwcxvqhpntuaeonve.yio
- Size 280B
- SHA256 494ec2fa0b641981d82b5c9164a4fae2508f5efefa3690b1f122c0a421201859
- MD5 36d8011223426262b29c0c66c04a5c84
- SHA1 3a5f47747d1db01961451be6fd3741c32da0acf3
- SHA512 64622bd159f811935a28811c1baa67c55a66ee3ec6caf45d86a47b91c4cbfe99205e6375335edddcb903586626eb5628382d75d4335d89f730d1a7894025ea3a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\bhioscbjsrmwcxvqhpntuaeonve.yio
- Size 280B
- SHA256 4af4ee7fe8981dcde8027e34607175c2b3e60938edc23a5c66471388339998d1
- MD5 fa329b4fa19cefa6578965c6eb11c821
- SHA1 6d449a91bb85d3e95ba643f352cbbb07f9c5f8d6
- SHA512 76a6ae69b048b3e91e7d777f4768d456bf1bf39490b2deb1588e812b89b7774fa86ed2210f3e524f5630077091f5c92de50353367e5f59caf22db325ad687ebb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\bhioscbjsrmwcxvqhpntuaeonve.yio
- Size 280B
- SHA256 11469dab260199b682039d13921550d7cf28155b48097359b75ad8dcad040061
- MD5 af62e8d741e1580668d439458debd230
- SHA1 0aa6b2c5874632c6615e171a6c6b0bd9c59480c3
- SHA512 f382ed1ddeff495f5f4a14afc54956e3392ef7753c44dd7cd818969c29b3226bd38dbb3b8346b8549c67bdca7188a02c499410b18adae03e9d3c2afb6c00bc0f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\bhioscbjsrmwcxvqhpntuaeonve.yio
- Size 280B
- SHA256 cc62be0614f27e4e24c60dd7c3347879ffdef59d605341d09fdc6b28933819de
- MD5 35d1881044525d0adbf4eb25dc553cc3
- SHA1 17d5cd66198cf660a2cd19269f64dc86414a6dab
- SHA512 a64fbb29ad96868e9766edaa721fde3dc1c463b2dfe2e1ba745a7cb657e2304452f738e6ab5032c6384b1781beb1599862465e27b987315b66932ff53ce660ea
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\bhioscbjsrmwcxvqhpntuaeonve.yio
- Size 280B
- SHA256 e460a4bdfdfb34dc2c960a0344c4a00245edea5f7739b6cea590673586053635
- MD5 5dc5032e4aeac991deb517a44ae8599d
- SHA1 24ff558e24e049e8dd8513848296c89ce3366ea6
- SHA512 f91a398eb8caa5a02c59037875aa2c6a777e46886194541a9bbb1f337bdeb27fc5bfb2476588ca49f0fe57f9467645612046155eda963941b3ecc01df17b82ae
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\ypbshcmfzjpkbhqwyrardujeohblrmdjsyatct.wlg
- Size 4KB
- SHA256 f7f288eb3c53e4eb97e6d250e6b9b8d4fe4dfb08ec223170423d18f96c869019
- MD5 b5c72ffe0d4cd134e25d335f48fa2727
- SHA1 c3a5e4de835c3f14ee6b45b298cfa5d92905bd8c
- SHA512 f8aa736a48d70f64a83cc356291df6ebe8e5458b57085effd4d1b462d8820dc94fad88e2220e95b295b82b4c0284897f80311e151c5af0876ba89eeb73116a01
- SSDEEP 96:roFg+mFAqKmHQ8QZxWeYRhhUDbO/txpEGYQl2X86gBnVJOKK5LnnA:roFgJ0HMUDKFFYQAYg4
- MD5 SHA1 SHA512 SSDEEP