Analysis
- max time kernel
20s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/09/2026, 11:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
General
- Target jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe
- Size 629KB
- Sample260919-ncwsysbl3y
- SHA256 3fb5a4959254c65c9324fb1a30d2247d623d79b40477c2ed7b2e7643295706f3
- MD5 8f44e6bf2987e64fe934a2347b333ae4
- SHA1 d58f350cd778dbbfd9a696804f54aa582a1d38cf
- SHA512 2e6649a408720fdd543a2298696a40ee82d67163a0eaf648b42dff231a1806a7fb9b5ddcd82596b1420b7ffdd60ce0ec91ba83ff7ce90817db7fc1f0c3c906d0
- SSDEEP 12288:Kcn/qJQoVwgyn4lMtmMEchK6WVZ6Hce713GrLm3FFSDp:BnMXKgy4u3EctWT6lIrLmjSDp
- TLSH T140D402466237E2E0D42CD836590771FA5BCA1C625D0FAD1A30947F3B3DB11E4BE16A2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Ardamax main executable 1 IoCs
resource yara_rule behavioral1/files/0x00070000000244a5-35.dat family_ardamax - UAC bypass 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" netsh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" HOSN.exe - Windows security bypass 2 TTPs 18 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" netsh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" HOSN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" HOSN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" netsh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" netsh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" HOSN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" HOSN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" HOSN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" netsh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" netsh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" HOSN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" netsh.exe - Disables RegEdit via registry modification 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Set value (int) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" netsh.exe Set value (int) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" HOSN.exe - Disables Task Manager via registry modification
- Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 2208 netsh.exe 4760 netsh.exe 2944 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe - Executes dropped EXE 2 IoCs
pid Process 2256 HOSN.exe 464 HOSN.exe - Loads dropped DLL 8 IoCs
pid Process 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe 2256 HOSN.exe 2256 HOSN.exe 2256 HOSN.exe 2944 netsh.exe 2208 netsh.exe 464 HOSN.exe 4760 netsh.exe - Windows security modification 2 TTPs 14 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" HOSN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" HOSN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" HOSN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" HOSN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" HOSN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" HOSN.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc HOSN.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HOSN Agent = "C:\\Windows\\SysWOW64\\28463\\HOSN.exe" HOSN.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" HOSN.exe - Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\28463\AKV.exe jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe File opened for modification C:\Windows\SysWOW64\28463 HOSN.exe File created C:\Windows\SysWOW64\28463\HOSN.001 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe File created C:\Windows\SysWOW64\28463\HOSN.006 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe File created C:\Windows\SysWOW64\28463\HOSN.007 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe File created C:\Windows\SysWOW64\28463\HOSN.exe jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe -
resource yara_rule behavioral1/memory/4440-1-0x0000000002280000-0x00000000032B3000-memory.dmp upx behavioral1/memory/4440-18-0x0000000002280000-0x00000000032B3000-memory.dmp upx behavioral1/memory/4440-16-0x0000000002280000-0x00000000032B3000-memory.dmp upx behavioral1/memory/4440-19-0x0000000002280000-0x00000000032B3000-memory.dmp upx behavioral1/memory/2944-65-0x0000000002BF0000-0x0000000003C23000-memory.dmp upx behavioral1/memory/2944-62-0x0000000002BF0000-0x0000000003C23000-memory.dmp upx behavioral1/memory/2944-75-0x0000000002BF0000-0x0000000003C23000-memory.dmp upx behavioral1/memory/2944-77-0x0000000002BF0000-0x0000000003C23000-memory.dmp upx behavioral1/memory/2944-83-0x0000000002BF0000-0x0000000003C23000-memory.dmp upx behavioral1/memory/2256-98-0x0000000004700000-0x0000000005733000-memory.dmp upx behavioral1/memory/2256-96-0x0000000004700000-0x0000000005733000-memory.dmp upx behavioral1/memory/2256-104-0x0000000004700000-0x0000000005733000-memory.dmp upx behavioral1/memory/2256-108-0x0000000004700000-0x0000000005733000-memory.dmp upx behavioral1/memory/2256-110-0x0000000004700000-0x0000000005733000-memory.dmp upx behavioral1/memory/2256-125-0x0000000004700000-0x0000000005733000-memory.dmp upx behavioral1/memory/2256-126-0x0000000004700000-0x0000000005733000-memory.dmp upx behavioral1/memory/2256-129-0x0000000004700000-0x0000000005733000-memory.dmp upx behavioral1/memory/2256-132-0x0000000004700000-0x0000000005733000-memory.dmp upx behavioral1/memory/2256-135-0x0000000004700000-0x0000000005733000-memory.dmp upx behavioral1/memory/2256-145-0x0000000004700000-0x0000000005733000-memory.dmp upx behavioral1/memory/2256-163-0x0000000004700000-0x0000000005733000-memory.dmp upx behavioral1/memory/2256-166-0x0000000004700000-0x0000000005733000-memory.dmp upx behavioral1/memory/2256-167-0x0000000004700000-0x0000000005733000-memory.dmp upx - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HOSN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HOSN.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe 2944 netsh.exe 2944 netsh.exe 2256 HOSN.exe 2256 HOSN.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe Token: SeDebugPrivilege 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2256 HOSN.exe 2256 HOSN.exe 2256 HOSN.exe 2256 HOSN.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4440 wrote to memory of 2944 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe 86 PID 4440 wrote to memory of 788 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe 9 PID 4440 wrote to memory of 792 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe 10 PID 4440 wrote to memory of 448 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe 14 PID 4440 wrote to memory of 2776 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe 51 PID 4440 wrote to memory of 440 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe 52 PID 4440 wrote to memory of 768 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe 53 PID 4440 wrote to memory of 3292 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe 56 PID 4440 wrote to memory of 3424 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe 57 PID 4440 wrote to memory of 3616 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe 58 PID 4440 wrote to memory of 3708 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe 59 PID 4440 wrote to memory of 3776 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe 60 PID 4440 wrote to memory of 3860 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe 61 PID 4440 wrote to memory of 4040 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe 62 PID 4440 wrote to memory of 4536 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe 65 PID 4440 wrote to memory of 888 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe 77 PID 4440 wrote to memory of 4148 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe 83 PID 4440 wrote to memory of 756 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe 84 PID 4440 wrote to memory of 2944 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe 86 PID 4440 wrote to memory of 2944 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe 86 PID 4440 wrote to memory of 2172 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe 87 PID 4440 wrote to memory of 2256 4440 jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe 88 PID 2944 wrote to memory of 2208 2944 netsh.exe 89 PID 2944 wrote to memory of 788 2944 netsh.exe 9 PID 2944 wrote to memory of 792 2944 netsh.exe 10 PID 2944 wrote to memory of 448 2944 netsh.exe 14 PID 2944 wrote to memory of 2776 2944 netsh.exe 51 PID 2944 wrote to memory of 440 2944 netsh.exe 52 PID 2944 wrote to memory of 768 2944 netsh.exe 53 PID 2944 wrote to memory of 3292 2944 netsh.exe 56 PID 2944 wrote to memory of 3424 2944 netsh.exe 57 PID 2944 wrote to memory of 3616 2944 netsh.exe 58 PID 2944 wrote to memory of 3708 2944 netsh.exe 59 PID 2944 wrote to memory of 3776 2944 netsh.exe 60 PID 2944 wrote to memory of 3860 2944 netsh.exe 61 PID 2944 wrote to memory of 4040 2944 netsh.exe 62 PID 2944 wrote to memory of 4536 2944 netsh.exe 65 PID 2944 wrote to memory of 888 2944 netsh.exe 77 PID 2944 wrote to memory of 4148 2944 netsh.exe 83 PID 2944 wrote to memory of 756 2944 netsh.exe 84 PID 2944 wrote to memory of 2172 2944 netsh.exe 87 PID 2944 wrote to memory of 2256 2944 netsh.exe 88 PID 2944 wrote to memory of 2256 2944 netsh.exe 88 PID 2944 wrote to memory of 2208 2944 netsh.exe 89 PID 2944 wrote to memory of 2208 2944 netsh.exe 89 PID 2256 wrote to memory of 4760 2256 HOSN.exe 92 PID 2256 wrote to memory of 788 2256 HOSN.exe 9 PID 2256 wrote to memory of 792 2256 HOSN.exe 10 PID 2256 wrote to memory of 448 2256 HOSN.exe 14 PID 2256 wrote to memory of 2776 2256 HOSN.exe 51 PID 2256 wrote to memory of 440 2256 HOSN.exe 52 PID 2256 wrote to memory of 768 2256 HOSN.exe 53 PID 2256 wrote to memory of 3292 2256 HOSN.exe 56 PID 2256 wrote to memory of 3424 2256 HOSN.exe 57 PID 2256 wrote to memory of 3616 2256 HOSN.exe 58 PID 2256 wrote to memory of 3708 2256 HOSN.exe 59 PID 2256 wrote to memory of 3776 2256 HOSN.exe 60 PID 2256 wrote to memory of 3860 2256 HOSN.exe 61 PID 2256 wrote to memory of 4040 2256 HOSN.exe 62 PID 2256 wrote to memory of 4536 2256 HOSN.exe 65 PID 2256 wrote to memory of 888 2256 HOSN.exe 77 PID 2256 wrote to memory of 4148 2256 HOSN.exe 83 PID 2256 wrote to memory of 756 2256 HOSN.exe 84 PID 2256 wrote to memory of 4760 2256 HOSN.exe 92 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" HOSN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:448
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2776
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:440
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:768
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8f44e6bf2987e64fe934a2347b333ae4.exe"2⤵
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Checks computer location settings
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4440 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode disable3⤵
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Modifies Windows Firewall
- Loads dropped DLL
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:2172
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode disable4⤵
- Modifies Windows Firewall
- Loads dropped DLL
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2208
-
-
-
C:\Windows\SysWOW64\28463\HOSN.exe"C:\Windows\system32\28463\HOSN.exe"3⤵
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2256 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode disable4⤵
- Modifies Windows Firewall
- Loads dropped DLL
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4760 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:3172
-
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE"4⤵PID:536
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3424
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3616
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3708
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3776
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3860
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4040
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4536
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:888
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:4148
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:756
-
C:\Windows\SysWOW64\28463\HOSN.exeC:\Windows\SysWOW64\28463\HOSN.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:464
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\@BA52.tmp
- Size 4KB
- SHA256 3fb6b438ad1530abdd068bffb303fb8a4de51430e0e18ddb6b1a0469ffab8325
- MD5 25530555085337eb644b061f239aa9d4
- SHA1 8d91e099aba5439d4bfa8bce464c94e3e1acf620
- SHA512 b1f9de0c276533a5a7070aeb2b6415cc1c0bdd2baf5e0645c6ac5ba767cab0d76e5b4461800d89724992af2c863294ada3c1eb2e4516183fe2010c33d47d6a2a
- TLSH T13E81667B77D90473C143ABB235DE41AEF657B23007E64419CAA307072A69DDBD824792
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SYSTEM.INI
- Size 258B
- SHA256 c7643712e26f2c3aedfde23d38d2201db0c02ce9268fb5d484ea0e952b22c9dd
- MD5 aaa1defdcecee0bea016bb0f72feaedd
- SHA1 c9666f855079c60dbb97424c01f8788da315fa27
- SHA512 450332b9958b5d4eff3fdd86e06459dc1b36b0efd837c5ba0edd497cda6818a1876cc4ce9c96ee54844a069967f9ebd9be044bf8751a84724f107f36637dc44c
- TLSH T195D05E0E4BDD11ADA046003E3178E4C272399F11DC720F4C5039674164286D9BF7E3AE
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\28463\AKV.exe
- Size 395KB
- SHA256 29b3646a556879a4a48e4f2f81e09179c34ac2051ed3e4f4c28e293092470d3d
- MD5 d63cc8679a63448db1c64252e14e4ab5
- SHA1 10b3a9ac4bc16e8ac1cd05e50b4d540fa3ef223e
- SHA512 cb1911e1a77fb9be560aa4fd8bbef65e181b6d4438d65657501dbcd8dbf488ba01738a7222f35f8d4317e8df8c6f307d9e3623d6e3e45753e138b80fb68ff768
- SSDEEP 6144:RHADFzXu/aNl8l8YhhAzMb7uUSHzG6u1U4I1/GVx8aFr:RHMztNl8l82hAzM3urC6ud/
- TLSH T10B84DF00F6D0C0B2C4AA11704D5397B99B75BF512B3A95E3B7D43E4AAD317E2AE36306
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\28463\HOSN.001
- Size 478B
- SHA256 7524bb09f3b876b68c9116a7fb458a05698a83480d11aa5cb3d9c00ac4f95976
- MD5 d2734f73639da59ec9f85eb16d88f927
- SHA1 e7d5ae43c1aeadb5f4afabc26ccfb7e3f67ed56a
- SHA512 f2dd7c2515bc38e6a771a2e231b3d0933a8eb33b1cf0f0348c3a285d920d14dcdca1f320d72f8cf06c7075139880a5f64858578ceb3c9c099361b9f6b3de40d2
- TLSH T16BF0B672E8D855423308723736D48D71B25B45ACB13F79C8B81B0358AA4B723F4C83C1
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\28463\HOSN.006
- Size 8KB
- SHA256 e6e8b4a29dccb3531f58c75b754caf7f26afe3e7043239305fd0ae7ab2f7571d
- MD5 81e20f4361cf8f5a57812871c24d945e
- SHA1 5d7877d6959ab26599b05795a71633f00c37a3da
- SHA512 69b1d75ab7123054bf98cf3a0f2cc7a0749cda8d85ebdef85be7d89f1454154ce29070907b934727a6c5276ff430e94810b87a5634d25d8529df9ee36fd20818
- SSDEEP 96:6Anh3GtHUW5ZTXQHL8P/YYfR+cwXofW1oEIYoWkQr8yHe1e2mIXT6pDxj9:F3GpUQAHAP/YY50tI1WkQDoeyD6pZ9
- TLSH T11FF1F93623C509B2DB7E26F14D93262A836B1121A7D140F34BA31AD52C926D3FF38B47
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\28463\HOSN.007
- Size 5KB
- SHA256 cc440cfc4ce1a1ff503cc9e8937c59aae64bfce4daa3e7dc757220a25cadc2e4
- MD5 e9fbdcc2f5fb657fa519b3f5c69fc52d
- SHA1 c49cca77b46a59d620711de7564d43e5dafcd2b5
- SHA512 913759967e16b99d8ea66433e5dc99d5ddbf737be6784306e67c2b23a525b7a578fcae1028221d3209abc452ff30508eb750c62113c3868a7af36b544e525fb1
- SSDEEP 48:6gklbtGoI0EE/KD4rJaKzx/aGJYkoyXB/AECi1cBaVM+kHTDouE:6gSSDIFayYAx4ECiRQHTDoz
- TLSH T182C18572F3D504B3F51B53B2659611EB37BAB13047A3040A58D711562966AA3DE3C723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\28463\HOSN.exe
- Size 473KB
- SHA256 661df22a66b2062b233eb0bd9665de924cfe0ac9c6ba29e20ffef24f817f9331
- MD5 97d8ad45f48b4b28a93aab94699b7168
- SHA1 8b69b7fd7c008b95d12386f6da415097e72151de
- SHA512 3351eac970bab391de410fcf1937da75d2e4722b808f10332f487ddfe469544e32e7d4ed0e5bdc19bd5f472cffcc55ca1498c95945b4e9c4ceff6ff5cc521c8a
- SSDEEP 6144:Tv5xxgKfSSwokLvNzLyMRJbsvyxAbR+GEu4zDGpUO/pV2ZNYXdGAb:df5won4JZkAGEoppjb
- TLSH T144A49F0073E2C0B2D0F706B01977A7658B797A2117398AC7B7E46E4A7D706D1AF3A352
- MD5 SHA1 SHA512 SSDEEP TLSH