metasploit | 376ab440e867e921baedd4596cc095d69a5c3d8153eac450a577e3ee9f75416b

Analysis

max time kernel
150s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 22:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_376ab440e867e921baedd4596cc095d69a5c3d8153eac450a577e3ee9f75416b.exe
Size 1.1MB
Sample260924-1zppdataqb
SHA256 376ab440e867e921baedd4596cc095d69a5c3d8153eac450a577e3ee9f75416b
MD5 e9d5e96391ccca649bc90f7e92048323
SHA1 f1a208d03f93ef875e8b432da46e8ef626fcce03
SHA512 bc5221f3020a17d9836bce009ad2e3d9309a6888c8b365b1fdee851cb090eef72aa1feff849d89f885cadfa5912fe82c81d79ab1439fa2f46dc6598cec01c8e1
SSDEEP 24576:l5xSs2UOty0TrfVSDBeJjmHSMSICMWDbUdnkq:KTOexSYD0n
TLSH
T1B835CF22D640C47EE0B680FAD6B58B3A1F9A7F72174509D76BC4CD466AB08D3F47824B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery metasploit persistence trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Checks BIOS information in registry 2 TTPs 20 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	system32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	system32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mrtmoons.exe

Executes dropped EXE 21 IoCs

pid	Process
756	winis.exe
968	system32.exe
4804	system32.exe
4384	mrtmoons.exe
3500	mrtmoons.exe
1524	mrtmoons.exe
464	mrtmoons.exe
4000	mrtmoons.exe
4940	mrtmoons.exe
548	mrtmoons.exe
4736	mrtmoons.exe
4628	mrtmoons.exe
3448	mrtmoons.exe
4808	mrtmoons.exe
4936	mrtmoons.exe
3180	mrtmoons.exe
2420	mrtmoons.exe
4896	mrtmoons.exe
3832	mrtmoons.exe
2616	mrtmoons.exe
2072	mrtmoons.exe

Loads dropped DLL 1 IoCs

pid	Process
756	winis.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winis = "C:\\Windows\\system32\\winis.exe"	jaffacakes118_376ab440e867e921baedd4596cc095d69a5c3d8153eac450a577e3ee9f75416b.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\check	winis.exe
File created	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File opened for modification	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File created	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File created	C:\Windows\SysWOW64\winis.exe	jaffacakes118_376ab440e867e921baedd4596cc095d69a5c3d8153eac450a577e3ee9f75416b.exe
File opened for modification	C:\Windows\SysWOW64\winis.exe	jaffacakes118_376ab440e867e921baedd4596cc095d69a5c3d8153eac450a577e3ee9f75416b.exe
File opened for modification	C:\Windows\SysWOW64\vbzip10.dll	winis.exe
File opened for modification	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File opened for modification	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File created	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File created	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File opened for modification	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File opened for modification	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File created	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File opened for modification	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File created	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File created	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File opened for modification	C:\Windows\SysWOW64\vbzip10.dll	jaffacakes118_376ab440e867e921baedd4596cc095d69a5c3d8153eac450a577e3ee9f75416b.exe
File opened for modification	C:\Windows\SysWOW64\mrtmoons.exe	system32.exe
File created	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File opened for modification	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File created	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File opened for modification	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File opened for modification	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File opened for modification	C:\Windows\SysWOW64\set.exe	jaffacakes118_376ab440e867e921baedd4596cc095d69a5c3d8153eac450a577e3ee9f75416b.exe
File created	C:\Windows\SysWOW64\mrtmoons.exe	system32.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Ares\My Shared Folder\share\.zip	winis.exe
File opened for modification	C:\Program Files (x86)\Ares\My Shared Folder\share\	winis.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_376ab440e867e921baedd4596cc095d69a5c3d8153eac450a577e3ee9f75416b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winis.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{50D98E86-D0F3-B2A3-9E11-F8FAFA8862C6}\LocalServer32\ = "%SystemRoot%\\winsxs\\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_220320d2c4216035\\TiWorker.exe"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{50D98E86-D0F3-B2A3-9E11-F8FAFA8862C6}	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{50D98E86-D0F3-B2A3-9E11-F8FAFA8862C6}\ = "Component Based Servicing Worker"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{50D98E86-D0F3-B2A3-9E11-F8FAFA8862C6}\AppID = "{8D15A4F3-1BE5-4120-8A4D-2EF92A5DD58D}"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{50D98E86-D0F3-B2A3-9E11-F8FAFA8862C6}\LocalServer32	system32.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: 33	4804	system32.exe
Token: SeIncBasePriorityPrivilege	4804	system32.exe
Token: 33	3500	mrtmoons.exe
Token: SeIncBasePriorityPrivilege	3500	mrtmoons.exe
Token: 33	464	mrtmoons.exe
Token: SeIncBasePriorityPrivilege	464	mrtmoons.exe
Token: 33	4940	mrtmoons.exe
Token: SeIncBasePriorityPrivilege	4940	mrtmoons.exe
Token: 33	4736	mrtmoons.exe
Token: SeIncBasePriorityPrivilege	4736	mrtmoons.exe
Token: 33	3448	mrtmoons.exe
Token: SeIncBasePriorityPrivilege	3448	mrtmoons.exe
Token: 33	4936	mrtmoons.exe
Token: SeIncBasePriorityPrivilege	4936	mrtmoons.exe
Token: 33	2420	mrtmoons.exe
Token: SeIncBasePriorityPrivilege	2420	mrtmoons.exe
Token: 33	3832	mrtmoons.exe
Token: SeIncBasePriorityPrivilege	3832	mrtmoons.exe
Token: 33	2072	mrtmoons.exe
Token: SeIncBasePriorityPrivilege	2072	mrtmoons.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2980	jaffacakes118_376ab440e867e921baedd4596cc095d69a5c3d8153eac450a577e3ee9f75416b.exe
756	winis.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 756	2980	jaffacakes118_376ab440e867e921baedd4596cc095d69a5c3d8153eac450a577e3ee9f75416b.exe	85
PID 756 wrote to memory of 968	756	winis.exe	87
PID 968 wrote to memory of 4804	968	system32.exe	88
PID 4804 wrote to memory of 4384	4804	system32.exe	99
PID 4384 wrote to memory of 3500	4384	mrtmoons.exe	100
PID 3500 wrote to memory of 1524	3500	mrtmoons.exe	104
PID 1524 wrote to memory of 464	1524	mrtmoons.exe	105
PID 464 wrote to memory of 4000	464	mrtmoons.exe	109
PID 4000 wrote to memory of 4940	4000	mrtmoons.exe	110
PID 4940 wrote to memory of 548	4940	mrtmoons.exe	118
PID 548 wrote to memory of 4736	548	mrtmoons.exe	119
PID 4736 wrote to memory of 4628	4736	mrtmoons.exe	120
PID 4628 wrote to memory of 3448	4628	mrtmoons.exe	121
PID 3448 wrote to memory of 4808	3448	mrtmoons.exe	124
PID 4808 wrote to memory of 4936	4808	mrtmoons.exe	125
PID 4936 wrote to memory of 3180	4936	mrtmoons.exe	126
PID 3180 wrote to memory of 2420	3180	mrtmoons.exe	127
PID 2420 wrote to memory of 4896	2420	mrtmoons.exe	129
PID 4896 wrote to memory of 3832	4896	mrtmoons.exe	130
PID 3832 wrote to memory of 2616	3832	mrtmoons.exe	131
PID 2616 wrote to memory of 2072	2616	mrtmoons.exe	132

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_376ab440e867e921baedd4596cc095d69a5c3d8153eac450a577e3ee9f75416b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_376ab440e867e921baedd4596cc095d69a5c3d8153eac450a577e3ee9f75416b.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\winis.exe
  C:\Windows\system32\winis.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Users\Admin\system32.exe
    C:\Users\Admin\system32.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:968
  - - C:\Users\Admin\system32.exe
      C:\Users\Admin\system32.exe
      4⤵
      Checks BIOS information in registry
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4804
    - - C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 1480 "C:\Users\Admin\system32.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4384
      - C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 1480 "C:\Users\Admin\system32.exe"
        6⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3500
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 1224 "C:\Windows\SysWOW64\mrtmoons.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1524
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 1224 "C:\Windows\SysWOW64\mrtmoons.exe"
        8⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 1072 "C:\Windows\SysWOW64\mrtmoons.exe"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4000
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 1072 "C:\Windows\SysWOW64\mrtmoons.exe"
        10⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4940
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 1424 "C:\Windows\SysWOW64\mrtmoons.exe"
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:548
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 1424 "C:\Windows\SysWOW64\mrtmoons.exe"
        12⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4736
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 1040 "C:\Windows\SysWOW64\mrtmoons.exe"
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4628
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 1040 "C:\Windows\SysWOW64\mrtmoons.exe"
        14⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3448
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 1424 "C:\Windows\SysWOW64\mrtmoons.exe"
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 1424 "C:\Windows\SysWOW64\mrtmoons.exe"
        16⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4936
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 1068 "C:\Windows\SysWOW64\mrtmoons.exe"
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3180
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 1068 "C:\Windows\SysWOW64\mrtmoons.exe"
        18⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2420
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 1084 "C:\Windows\SysWOW64\mrtmoons.exe"
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 1084 "C:\Windows\SysWOW64\mrtmoons.exe"
        20⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3832
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 956 "C:\Windows\SysWOW64\mrtmoons.exe"
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2616
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 956 "C:\Windows\SysWOW64\mrtmoons.exe"
        22⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C68B7B09.TMP

Path C:\Users\Admin\AppData\Local\Temp\C68B7B09.TMP
Size 116B
SHA256 3be65f7c478cf03ee76d7803f65efee405e7abb18aa45cc6c8abcb5e76b4ffb2
MD5 812185b30fc312ae1d5c5d5765afc30c
SHA1 13fedd1404241611fa6966e8e760d9cb1371904a
SHA512 8f823c7f0662b49f80ff90c230d048ccca79e78a294fd00ee5bf33f97a37b99d5880df301d794505b7f9b1cd70b984362618a445ded3020fd9e3844317526f72
TLSH
T145B02B3540BBA01681A058140224C80163222F710C040052C4EB28040CC160010B85E3
MD5 SHA1 SHA512 TLSH

Submit Download

C68B7B09.TMP

Path C:\Users\Admin\AppData\Local\Temp\C68B7B09.TMP
Size 116B
SHA256 6e6102c4781abfaddfd8167c8980e31e5705b2a27a51151e93457dd0979fefd6
MD5 defd843b92046635f75e2594907c7bcb
SHA1 5f343b7aef2ed1bbe17374c2477ffffb7ea6bb8a
SHA512 c1295a0b3e2faf20635872e3de638e64eba31c7cd0defc2c5fce62e00332c99c9518276804569bf720678609b2421befa85f4651f14a1b1ab708f41bac1f802a
TLSH
T11FB09B2900AB9567C2955D144164C44156236F750C154542F4F725485C4265524BC4E6
MD5 SHA1 SHA512 TLSH

Submit Download

C68B7B09.TMP

Path C:\Users\Admin\AppData\Local\Temp\C68B7B09.TMP
Size 116B
SHA256 86ee3659bb6875ae6bab268db079363e9ca20af10c0c44fbf748a9ec97549ac4
MD5 2a52e2aa2bb313b969d6c65a943a1d0f
SHA1 40586259fbf1729c33a995c1826b07bc4b94d734
SHA512 3ad3aa8020a2b516c8d78b9d46e92f9d5699965ff52a729918c546feb3db31c158dd7a2253336dcd909fffbf4b55ae3dd608d9c26289414cd25f9e637057ae50
TLSH
T188B09B7600AFA11681D159145255C44256326E750C150552D4E735544C5165914F85D6
MD5 SHA1 SHA512 TLSH

Submit Download

C68B7B09.TMP

Path C:\Users\Admin\AppData\Local\Temp\C68B7B09.TMP
Size 116B
SHA256 3c343d95d7c26d3a786fa1fe99548ca75e4d467f1fa027ebd08d222e5b84838d
MD5 2523ef3537e19f50e83c7db1574efccb
SHA1 25988736ad1c401112e8d20a8fbd6342437d7232
SHA512 2be0231043320cbed91235c184cf3a3a3f16a7ab9cbe41d161c6b09f0987609bbeb023ccac45cfad4ff2181fd50f42559ae1f25aa57c39835901417d4a705fa8
TLSH
T1BCB09B2A00FFB117C19169154164D84266666E750C190592D4E739444C4265535B84D6
MD5 SHA1 SHA512 TLSH

Submit Download

C68B7B09.TMP

Path C:\Users\Admin\AppData\Local\Temp\C68B7B09.TMP
Size 116B
SHA256 ca0c54096dfb446734882a78c47abee03e82660e2ee0493e0076ac15cf72807c
MD5 902086be902de74d8e3c0fa275371c8a
SHA1 d6be199fcc0d3e1d7b548952e2fcc4445c4e4358
SHA512 204b6d66ca75e7f5655bccea8d0c040b17277d7446f83b12594690e453833b2bc76c2dc2ba37e8eee67095d2dcf17e7f56ab0597af15c0e0547f06d6cdca371a
TLSH
T1CDB02B2640BBD016C1A15F140155C40113622E700C040087C8FF34040C0221414B80D2
MD5 SHA1 SHA512 TLSH

Submit Download

C68B7B09.TMP

Path C:\Users\Admin\AppData\Local\Temp\C68B7B09.TMP
Size 116B
SHA256 2918be42ea69e363f1b4fc902e4febadf214562ac4b9cc70c717e7d77aa14dd2
MD5 fdc903353bbd121ee17d89ebd3adc0a5
SHA1 7259ee8984b59df7e51da39be9273ab4558e9132
SHA512 52f9df654827eae04bec803a5005b27900f4763f41c4160d783c7515e98da93bafe0efc2e2a3fb84283ab361a2511cec15840d27607ef6e879ebb6d9c1662f79
TLSH
T11EB02B3A00BB911281906918015AD80223233E350C040883C8E724080C0120414BC0D7
MD5 SHA1 SHA512 TLSH

Submit Download

C68B7B09.TMP

Path C:\Users\Admin\AppData\Local\Temp\C68B7B09.TMP
Size 116B
SHA256 0f94702b20949b33d7a2e9459b8c5a7e415748b30938d1982040e559cf6da1d1
MD5 ade47dcfb2baa89c87c307cbe7ee3962
SHA1 0b59e6f3550c430f6262b08dafd8dbaa30439429
SHA512 220ae268696ef7909d2848262dd960a9ebdf0c978735e5319eab3a4c5375f9676017d32db48aeff0d15789a0eda271cd94cee7f9d1403ad1db5892daa094dcc1
TLSH
T138B09B6500ABA126C1D169684254C44156737E750D551586D4E735540C5569514B84DA
MD5 SHA1 SHA512 TLSH

Submit Download

C68B7B09.TMP

Path C:\Users\Admin\AppData\Local\Temp\C68B7B09.TMP
Size 116B
SHA256 61c26bbcc27edcab4893c1f88f467b12f495bc462f12c340904b14456b3775cf
MD5 92657b4df321cc917c6ce20b47ece289
SHA1 53f68bc717186c88b596860943052470147305df
SHA512 effcce0c377a18b6c9b30e19c728bdf52e661f83b09d88d710ef817fc9eeb7bc924cdf697d6933d5232b7d74c452e02dcea36b6fb6410733a598cf731ac4037f
TLSH
T188B09B2610BB91168191AD588158D45156767EB54C1505C2D8E735444C4175514BC4D7
MD5 SHA1 SHA512 TLSH

Submit Download

system32.exe

Path C:\Users\Admin\system32.exe
Size 836KB
SHA256 53b3aca10dfc6f7bf1c0349f0b98babf5d0d1a584ac6b10369e2b7ac054a99dd
MD5 1385219d6368deca2b4c8ffd47c7b612
SHA1 073faff2cc9d76b85c1339d9a308977b1d3bacf5
SHA512 e31cff07e9dfc3b7ee7a1b38066408826da17ffde23e363667f4de61bbcd99c000a346df7ae7bd3c4f19eddcc2fc029553f60f4858d2236afb7759729656a375
SSDEEP 24576:GSs2UOty0TrfVSDBeJjmHSMSICMWDbUdn:bTOexSYD0
TLSH
T18505CF66C640C86DF0BA40FAE3EA9B391FD93F63675A05E31DC4CC466AB08D6B474187
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vbzip10.dll

Path C:\Windows\SysWOW64\vbzip10.dll
Size 144KB
SHA256 cbe2e53f8602fe9b24583f366edf0f29f888efaef6ca9c03ed7c89b2c2bce263
MD5 5b25690cc2e55a6d4bc965068a7ba1ef
SHA1 58a5f2613df475b69e60b691215d5c60462cedb3
SHA512 e86e87e3b7b819be5ccb68c1b1fa9b01b4ac007451f73eb66f7b98a512514a9557a250b9a73e258eed751e0c9bec11335ffe0d604a45e7112f189cf9e48e8e7d
SSDEEP 3072:Hrp6swgjFDzLfu/m7UtaEC+3axH2R94ymG8ZRoLrOMjo:HV/f37Uta/ua8cTs
TLSH
T18BE39E8274A2C073E6D8413C05B2AF378F7FA4755A51DE93C795CDE20C650A1EA2E38B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winis.exe

Path C:\Windows\SysWOW64\winis.exe
Size 1.1MB
SHA256 376ab440e867e921baedd4596cc095d69a5c3d8153eac450a577e3ee9f75416b
MD5 e9d5e96391ccca649bc90f7e92048323
SHA1 f1a208d03f93ef875e8b432da46e8ef626fcce03
SHA512 bc5221f3020a17d9836bce009ad2e3d9309a6888c8b365b1fdee851cb090eef72aa1feff849d89f885cadfa5912fe82c81d79ab1439fa2f46dc6598cec01c8e1
SSDEEP 24576:l5xSs2UOty0TrfVSDBeJjmHSMSICMWDbUdnkq:KTOexSYD0n
TLSH
T1B835CF22D640C47EE0B680FAD6B58B3A1F9A7F72174509D76BC4CD466AB08D3F47824B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/464-478-0x0000000000700000-0x000000000078D000-memory.dmp

Download

memory/464-473-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/464-470-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/464-459-0x0000000000700000-0x000000000078D000-memory.dmp

Download

memory/464-475-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/464-451-0x0000000000700000-0x000000000078D000-memory.dmp

Download

memory/464-446-0x0000000000700000-0x000000000078D000-memory.dmp

Download

memory/464-474-0x0000000002E80000-0x0000000002EA0000-memory.dmp

Download

memory/464-472-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/464-471-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/464-477-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/464-525-0x0000000000700000-0x000000000078D000-memory.dmp

Download

memory/464-713-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/464-875-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/548-1502-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/548-1517-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/968-20-0x000000000054D000-0x000000000054E000-memory.dmp

Download

memory/968-48-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/968-17-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/968-63-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/1524-707-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/1524-686-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/2072-3667-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/2420-2815-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/2420-2972-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/2616-3639-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/2616-3678-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/2980-0-0x0000000000400000-0x0000000000510000-memory.dmp

Download

memory/3180-2787-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3180-2826-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3448-1681-0x0000000000800000-0x000000000088D000-memory.dmp

Download

memory/3448-1961-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3448-2120-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3500-58-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3500-65-0x0000000000610000-0x000000000069D000-memory.dmp

Download

memory/3500-57-0x0000000000610000-0x000000000069D000-memory.dmp

Download

memory/3500-238-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3500-105-0x0000000000610000-0x000000000069D000-memory.dmp

Download

memory/3500-82-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3500-80-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3500-81-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3500-83-0x0000000003110000-0x0000000003130000-memory.dmp

Download

memory/3500-86-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3500-87-0x0000000000610000-0x000000000069D000-memory.dmp

Download

memory/3500-52-0x0000000000610000-0x000000000069D000-memory.dmp

Download

memory/3500-84-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3500-79-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3500-457-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3832-3239-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3832-3398-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4000-1082-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4000-1101-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4384-49-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4384-241-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4628-1935-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4628-1970-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4736-1287-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4736-1690-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4736-1526-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4736-1341-0x0000000000840000-0x00000000008CD000-memory.dmp

Download

memory/4736-1264-0x0000000000840000-0x00000000008CD000-memory.dmp

Download

memory/4736-1265-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4736-1259-0x0000000000840000-0x00000000008CD000-memory.dmp

Download

memory/4736-1289-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4736-1275-0x0000000000840000-0x00000000008CD000-memory.dmp

Download

memory/4736-1285-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4736-1284-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4736-1288-0x0000000003850000-0x0000000003870000-memory.dmp

Download

memory/4736-1292-0x0000000000840000-0x00000000008CD000-memory.dmp

Download

memory/4736-1291-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4736-1286-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4804-34-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4804-37-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4804-28-0x0000000002140000-0x00000000021CD000-memory.dmp

Download

memory/4804-23-0x0000000002140000-0x00000000021CD000-memory.dmp

Download

memory/4804-31-0x0000000002140000-0x00000000021CD000-memory.dmp

Download

memory/4804-33-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4804-62-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4804-40-0x0000000002140000-0x00000000021CD000-memory.dmp

Download

memory/4804-29-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4804-32-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4804-39-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4804-36-0x0000000003BC0000-0x0000000003BE0000-memory.dmp

Download

memory/4804-59-0x0000000002140000-0x00000000021CD000-memory.dmp

Download

memory/4804-35-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4808-2361-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4808-2400-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4896-3213-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4896-3250-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4936-2387-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4936-2548-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4940-889-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4940-871-0x0000000000610000-0x000000000069D000-memory.dmp

Download

memory/4940-881-0x0000000000610000-0x000000000069D000-memory.dmp

Download

memory/4940-888-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4940-893-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4940-935-0x0000000000610000-0x000000000069D000-memory.dmp

Download

memory/4940-895-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4940-890-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4940-896-0x0000000000610000-0x000000000069D000-memory.dmp

Download

memory/4940-892-0x00000000033A0000-0x00000000033C0000-memory.dmp

Download

memory/4940-1106-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4940-891-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4940-1269-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads