5d9481413fd0bc0fe9d45936138901ab5d9272afb50886c8d6a37780ab7dbda8

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/09/2026, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe
Size 1.3MB
Sample260920-3dzzbsvvht
SHA256 5d9481413fd0bc0fe9d45936138901ab5d9272afb50886c8d6a37780ab7dbda8
MD5 2a59e33525d393a3044014f8dac28abb
SHA1 bc3aad2c0646928f665657c411a329d5a9960d35
SHA512 48ba9ba715756cf950aa4fbd501b20b32884b4ad6b3f8a84ded48210d884dba5c1a79eaf68b70416169f107da9f31e8f53b45d54b15901430bfca74fa3399965
SSDEEP 24576:Xc7dgadoTXFdeaWcWPaomiPaoR9AMgVnMTYwjiuRMy+4eUw56imm:MMpdefaoTaojDRUwjiuRm3Uwg4
TLSH
T1F05501437A19CA53D52983F57E43DE982B5AB758DD8637AB72E40F8FAE701038C8601D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

collection discovery execution spyware stealer upx

Malware Config

Signatures

Detected Nirsoft tools 14 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/files/0x000800000002444f-19.dat	Nirsoft
behavioral1/memory/4804-62-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/1604-68-0x0000000000400000-0x0000000000415000-memory.dmp	Nirsoft
behavioral1/files/0x0007000000024469-69.dat	Nirsoft
behavioral1/memory/1648-72-0x0000000000400000-0x0000000000416000-memory.dmp	Nirsoft
behavioral1/memory/1648-74-0x0000000000400000-0x0000000000416000-memory.dmp	Nirsoft
behavioral1/files/0x000700000002446a-76.dat	Nirsoft
behavioral1/memory/4172-85-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/3612-91-0x0000000000400000-0x0000000000415000-memory.dmp	Nirsoft
behavioral1/memory/2916-98-0x0000000000400000-0x0000000000426000-memory.dmp	Nirsoft
behavioral1/memory/3576-104-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral1/files/0x000700000002446f-105.dat	Nirsoft
behavioral1/memory/5032-113-0x0000000000400000-0x000000000041D000-memory.dmp	Nirsoft
behavioral1/memory/116-119-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/3576-104-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/files/0x000800000002444f-19.dat	WebBrowserPassView

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe

Executes dropped EXE 12 IoCs

pid	Process
1432	1.exe
4804	3.exe
1604	4.exe
1648	5.exe
4492	6.exe
4172	7.exe
3612	8.exe
2916	9.exe
3576	10.exe
3848	11.exe
5032	12.exe
116	13.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	10.exe

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3668-0-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral1/memory/3668-2-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral1/memory/3668-3-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral1/files/0x0007000000024467-57.dat	upx
behavioral1/memory/4804-60-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/4804-62-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/files/0x0007000000024468-63.dat	upx
behavioral1/memory/1604-65-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral1/memory/1604-68-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral1/files/0x0007000000024469-69.dat	upx
behavioral1/memory/1648-72-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/1648-74-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/files/0x000700000002446b-80.dat	upx
behavioral1/memory/4172-82-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/4172-85-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/files/0x000700000002446c-87.dat	upx
behavioral1/memory/3612-89-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral1/memory/3612-91-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral1/memory/3668-92-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral1/files/0x000700000002446d-93.dat	upx
behavioral1/memory/2916-95-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/2916-98-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/files/0x000700000002446e-99.dat	upx
behavioral1/memory/3576-102-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/3576-104-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/files/0x0007000000024470-109.dat	upx
behavioral1/memory/5032-110-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/5032-113-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/files/0x0007000000024471-115.dat	upx
behavioral1/memory/116-117-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/116-119-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/3668-120-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral1/memory/3668-121-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral1/memory/3668-122-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral1/memory/3668-123-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral1/memory/3668-124-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral1/memory/3668-125-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral1/memory/3668-126-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral1/memory/3668-127-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral1/memory/3668-128-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral1/memory/3668-129-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral1/memory/3668-130-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral1/memory/3668-131-0x0000000000400000-0x0000000000596000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2272	cmd.exe
3524	cmd.exe
3248	cmd.exe
3312	cmd.exe
3916	cmd.exe
3772	cmd.exe
2308	cmd.exe
1272	cmd.exe
1256	cmd.exe
4036	cmd.exe
1152	cmd.exe
4500	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	13.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe
3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe
3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe
3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe
4804	3.exe
4804	3.exe
3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe
3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe
3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe
3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe
3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe
3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe
3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe
3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe
3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe
3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe
3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe
3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe
3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe
3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe
2916	9.exe
2916	9.exe
3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe
3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe
3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe
3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe
3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe
3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4804	3.exe
Token: SeDebugPrivilege	2916	9.exe
Token: SeDebugPrivilege	5032	12.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe
3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 2308	3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe	97
PID 2308 wrote to memory of 1432	2308	cmd.exe	99
PID 3668 wrote to memory of 1272	3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe	100
PID 1272 wrote to memory of 4804	1272	cmd.exe	102
PID 3668 wrote to memory of 2272	3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe	103
PID 2272 wrote to memory of 1604	2272	cmd.exe	105
PID 3668 wrote to memory of 3524	3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe	106
PID 3524 wrote to memory of 1648	3524	cmd.exe	108
PID 3668 wrote to memory of 3248	3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe	109
PID 3248 wrote to memory of 4492	3248	cmd.exe	111
PID 3668 wrote to memory of 1256	3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe	112
PID 1256 wrote to memory of 4172	1256	cmd.exe	114
PID 3668 wrote to memory of 4036	3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe	115
PID 4036 wrote to memory of 3612	4036	cmd.exe	117
PID 3668 wrote to memory of 1152	3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe	118
PID 1152 wrote to memory of 2916	1152	cmd.exe	120
PID 3668 wrote to memory of 3312	3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe	121
PID 3312 wrote to memory of 3576	3312	cmd.exe	123
PID 3668 wrote to memory of 4500	3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe	124
PID 4500 wrote to memory of 3848	4500	cmd.exe	126
PID 3668 wrote to memory of 3916	3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe	127
PID 3916 wrote to memory of 5032	3916	cmd.exe	129
PID 3668 wrote to memory of 3772	3668	jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe	130
PID 3772 wrote to memory of 116	3772	cmd.exe	132

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2a59e33525d393a3044014f8dac28abb.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start C:\iNST\1.exe /stext C:\iNST\PWS.txt"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\iNST\1.exe
    C:\iNST\1.exe /stext C:\iNST\PWS.txt"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1432
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start C:\iNST\3.exe /stext C:\iNST\PWS3.txt"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\iNST\3.exe
    C:\iNST\3.exe /stext C:\iNST\PWS3.txt"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4804
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start C:\iNST\4.exe /stext C:\iNST\PWS4.txt"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\iNST\4.exe
    C:\iNST\4.exe /stext C:\iNST\PWS4.txt"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1604
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start C:\iNST\5.exe /stext C:\iNST\PWS5.txt"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\iNST\5.exe
    C:\iNST\5.exe /stext C:\iNST\PWS5.txt"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1648
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start C:\iNST\6.exe /stext C:\iNST\PWS6.txt"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\iNST\6.exe
    C:\iNST\6.exe /stext C:\iNST\PWS6.txt"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4492
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start C:\iNST\7.exe /stext C:\iNST\PWS7.txt"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\iNST\7.exe
    C:\iNST\7.exe /stext C:\iNST\PWS7.txt"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4172
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start C:\iNST\8.exe /stext C:\iNST\PWS8.txt"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\iNST\8.exe
    C:\iNST\8.exe /stext C:\iNST\PWS8.txt"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3612
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start C:\iNST\9.exe /stext C:\iNST\PWS9.txt"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\iNST\9.exe
    C:\iNST\9.exe /stext C:\iNST\PWS9.txt"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2916
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start C:\iNST\10.exe /stext C:\iNST\PWS10.txt"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\iNST\10.exe
    C:\iNST\10.exe /stext C:\iNST\PWS10.txt"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:3576
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start C:\iNST\11.exe /stext C:\iNST\PWS11.txt"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\iNST\11.exe
    C:\iNST\11.exe /stext C:\iNST\PWS11.txt"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3848
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start C:\iNST\12.exe /stext C:\iNST\PWS12.txt"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\iNST\12.exe
    C:\iNST\12.exe /stext C:\iNST\PWS12.txt"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5032
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start C:\iNST\13.exe /stext C:\iNST\PWS13.txt"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\iNST\13.exe
    C:\iNST\13.exe /stext C:\iNST\PWS13.txt"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.exe

Path C:\Users\Admin\AppData\Local\Temp\MMBPlayer\1.exe
Size 314KB
SHA256 19b407a14e315608404342c7a663fcd1cfeb789c22001d7f2a37d950bed71c93
MD5 3ecde01c966289d0066354588aaba6c4
SHA1 37f29c113604ed140d3b2ae42f53261bd56a5df2
SHA512 b92674d257f3fdc453ab00ff7ddda1863201daab49a9ed92fe5487f641e8297ead7085e0c547b13d9d42612631e6c81d566ed615a411a882e0e6873a22f33d11
SSDEEP 6144:jXSYdvy0RL7mRn9S7zPiiZv+jgWs+/I+1gjAtgkihe:jXSuZLykf3v+jBsi1gTkx
TLSH
T15564BE13B3E28037E8F70130466B5B62ADFE7A201A75895747E41C49AF70691BB3E74B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10.exe

Path C:\iNST\10.exe
Size 51KB
SHA256 861c43e6e2a1a82b25d018caa6994d858638006cc60775f09e02092264d7f772
MD5 5d0bbfc455b9db47ad32b41a7b3e499d
SHA1 fcbc9f6d2a50660ae0d7c635a22a63ec2daa12af
SHA512 0d3e1ee6a3919831fb018e00a65b3575089ed93bbbe7f504251d7de009ab8a8d4abc46a950b7e9fbf47aa40ffffd05f1ba6cc0ec7096e3253c244b3e4d95d944
SSDEEP 768:tXSk5RxWd1dzDMW2f/2yDc1Vax8jdbuCG9rtilT6Z90lMnufvN:tX0d1dB2fupLaugdt2CC
TLSH
T1A933E1AAB3D0606DDD2A42362D171F681B0C724057E5074B3A98AC4EDDF92B0FF16BD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11.exe

Path C:\iNST\11.exe
Size 51KB
SHA256 64788b6f74875aed53ca80669b06f407e132d7be49586925dbb3dcde56cbca9c
MD5 35861f4ea9a8ecb6c357bdb91b7df804
SHA1 836cb49c8d08d5e305ab8976f653b97f1edba245
SHA512 0fdfe62c86c8601bb98991149eea51ddf91b812ad2c2d45e53aaf1f36a09d00aaf02fc3d183179cf5367fda09d6f62d36c0187da2dfa5e08df4c07cf634690be
SSDEEP 768:JWNjuQOjoBiZFmOlhAIqAs8Q65bQPC1/u8fxmZTxeA9r7Vw:JWNaQOjgiZFmOlpCrq1/ubZTxT9r7V
TLSH
T141331903BBE1C471D0F684701A369B7949B9BC3394B2E61FA7C05E4F2D33A46D92935A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

12.exe

Path C:\iNST\12.exe
Size 47KB
SHA256 346fe9f64265e5a2c413531b7037e5507643241dcb82779cc1ed5384fe1fff48
MD5 12d09c1b90e5c0976f95eded01ab0eaf
SHA1 80a688150a45083f6eabf24ae1638a0c8da604f1
SHA512 c79a0cd31b78f9b2b1a7fc2cd75b75f0dfa189d8ac20bfc50bd1887bbb6c4786f9fa6a5246ea338bc8ff84e3b461fc97a7b9a88d22e784f6fce450ed3fa016b9
SSDEEP 768:FCnPxW8Dk5sbrH4h4pt8bzz55ar+KLpogoevqIkTl/Csz3ecz9Pn8yvh0R:4QYk5sPQ4p0wSKLZoNTxCsL9/by
TLSH
T1FA23D013D7905D64EAD4C833055B49681A98B88BC0DBEFAA4FC05E2F2F73992DF4449B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13.exe

Path C:\iNST\13.exe
Size 41KB
SHA256 b0bbab534ff881c07b034c71cf7835be6bb94cd5cf25a7cea0b1198d2edd2a75
MD5 90355ceb2f91362dd24023e0927c3a6c
SHA1 5650557adddff0b7841acdff094587ede830193d
SHA512 fbe21fbb46cbd31b8e1270e54fa3be8762bf2116fdb3740f6deff44996ac674cb75b4d4ef0791bda1ba62f387ec1dd25bbf447dbae99c557418da5b8c902acaf
SSDEEP 768:O1gyTEgC/LYzNs+Y4mTSzk4Cn/ZMJ8GLu7KwDiDSAU:O1zTEngsd4OSzk4C/G67FDN7
TLSH
T13413E102F3944817C8CE1A360F778B7C266FA912A9144BBFADF1968E7CB4741AD6251C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3.exe

Path C:\iNST\3.exe
Size 44KB
SHA256 e4f5d1723c5df61d49494538db368d147c19b1aa6994fbc23c6a59672bd6b0a9
MD5 a0ce317e42c7a6607d33d8a3703a8ad7
SHA1 4bf3913183ad8d967c90ce36c5f8f9aaf674e746
SHA512 6dbf5d5376456fe8e9e9a560875db4f9281da2f1c3f9b103d1491305c45f8d144015deb54d1918349cf0a2a078d81ee1b211f5bdd314e48a464811c8428843e4
SSDEEP 768:SNeLi/J+T5XaGkvasAHciDGoYatP6WtnkCRGIvIm2amLo8V93pU6Fn:SNB+TTnHKax9vl23VtF
TLSH
T1B023C003CA108964CAE9883045DB48F40718FC76E6503F9757D43E2FBCB77A6DE1229A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4.exe

Path C:\iNST\4.exe
Size 30KB
SHA256 ba5c4766fd2fbf9e0c76444f152b861b9977f1b23c963a9c8b8a6970c43bcde6
MD5 3b33a134cb7ce76859f25dd246da50d6
SHA1 37adb7c54943b338000cefce6d895c05468fa2ce
SHA512 acab9d3c862934617ba3ede342681e91e0232cda1b2ad9b7d2595f0cd31f8c41ac911a323d94bf865571a38041293b90bde23a4049c6c90fc911b7d3f26f68ba
SSDEEP 768:qTJP8LHdCut1D473mNVQ4rkyaE9jfhrnOuK:cJUL9LPQ2NVQ4IcxnOuK
TLSH
T175D2BF83EF83CC2AE99E4577142B4A186791FD21A7AC0B9B40E97C1E7D323A67D01735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5.exe

Path C:\iNST\5.exe
Size 32KB
SHA256 460fc0ae9b29b61d7a147b599eb02b70ea6a830df0f5cd16a317a95e466513c0
MD5 f3ca95a762a4101a2cd5789190681a78
SHA1 cac61068382b93ee63dc06324e501ddc71ac65ef
SHA512 d33d62c0f5b65bbfd55c6a4281bff60980f3e335c3a4ff802dd8ac92cc417785f3a3d82607dbfd542222ce40ff1a45c8c3c9ac46e3543cd4f5af94527dace2b5
SSDEEP 768:ZaasL8BOrd2XEBBi/fiuUu9Zd25S941h05C:Za/82d20B+tB9G+5
TLSH
T17EE2D003A2A64D61C46402748C83073597FAB9206F68C74FF9D5A26FAD747C17DCA26B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6.exe

Path C:\iNST\6.exe
Size 61KB
SHA256 3d878cb175c3ade6a0229b7bf016da04e798c8165eb3931be6d848314873beb3
MD5 cacb0b9b1c43bacefef243356211cad0
SHA1 5cd73a7146339c7924dfeb7edf83b8adc0ff6949
SHA512 aa96ca9d04eee004f5dd92528c2bd6075c0ef84b97535a48e4838b6ec1332cee098d1ebe0898c075573ea0d30bf8c79770d16ca1c19970246b9e2ad24fd4e020
SSDEEP 768:fHWu70cd1VdJ+cIE7UyPmaIlPQEkqc6gSWiA2f6agwWuqR8+p26abLkQQRtt5zZ:+Dcd1BTYSrIlPQz55iAAAw5bwl75zZ
TLSH
T1E8534B4372E48075E9BF0A706E332B224AF93D205674C56B87A09D0E7CB56CAED3535B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7.exe

Path C:\iNST\7.exe
Size 55KB
SHA256 f75a34ce31833e85c762c58cf6c3bc6aa61b1e2123615d4dbf19adae654182dc
MD5 9e23abe59bbdbe1c2174a3261c9e75c5
SHA1 8d6fa0d1ec816f9db4cd90cc69a1eef09ba5b23c
SHA512 0d555d9457b3f4911a8522a47c7098276d8435d7eea04a22a5788475c9e366ceae7a065db714be72dbe9123fb9b7324601d097f6cf9192098fd79af905128c40
SSDEEP 1536:0lhP/CpS5Usr7WOFzXvON1GWiuGxvynZKSvvzFHWY0q:0bTDRvK1+tvy8SHhHWY0q
TLSH
T10D43F10BF979DA24EA37043EC543B6391B88BAEE4F66478B07905E6FBC31741AD87150
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8.exe

Path C:\iNST\8.exe
Size 34KB
SHA256 efbda9735bc0ea45de494d513224e0d297c1d389628284674ce19fca1f5fb952
MD5 209393e48c170c05b1f57be82398f8b6
SHA1 d3f5d5f93d1bd62b7b52c6c8ba56e848e46ff218
SHA512 ec10ce25e349c90d4165f73a014f46ddf7abd5cfc86a9dcf68b4a07f0a8af7449a721330efe09494636b4e8239476d4e3d1ba746a181a7407341994fd3f2aaf2
SSDEEP 768:yZ7Vdo/dQnJ+shZWEGJUx9Y1PJ/+pcIU6nqSMxSl18j5/ABpwaI:yVVsdQQshZWEGuM5JPIUILz8jhCpwaI
TLSH
T126F2D046FAE06820D9366831982316351D48F8B5FF3D4BCF15606E8FBE322867D36617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9.exe

Path C:\iNST\9.exe
Size 65KB
SHA256 3f3c8484962b395f304a836ee5e8ee17beaafe982795c9747d8ee98cc6e4ca8f
MD5 ffc52f2b4435fcddaca6e15489a88b75
SHA1 63ec31a04cf176852344d544ae855da0dac64980
SHA512 389694feccfe6ca352705b9481913fece6d1d47083f235ccdd60c05cfda82606be53845fde0dba8ec3f3748f820a828c9be0ce078c8b9cc853285b23f172841c
SSDEEP 1536:hBcOUiUlO1/DXn4cHJ4dPaCnpWqOaeziqf7mvvXWVcZ0:hBcu/hDXn/JgaMEjaOsXV6
TLSH
T1DA53F10DF2842B91D85719379B232C18639EF56B6B3A499EE754FB7E3D7238C9E00025
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/116-119-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/116-117-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/1604-68-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/1604-65-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/1648-74-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/1648-72-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/2916-98-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/2916-95-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/3576-104-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3576-102-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3612-89-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/3612-91-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/3668-3-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/3668-125-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/3668-0-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/3668-92-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/3668-131-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/3668-2-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/3668-130-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/3668-129-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/3668-1-0x0000000000595000-0x0000000000596000-memory.dmp

Download

memory/3668-128-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/3668-127-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/3668-120-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/3668-121-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/3668-122-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/3668-123-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/3668-124-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/3668-126-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/4172-82-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4172-85-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4804-60-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4804-62-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5032-113-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/5032-110-0x0000000000400000-0x000000000041D000-memory.dmp

Download