metasploit | 376ab440e867e921baedd4596cc095d69a5c3d8153eac450a577e3ee9f75416b

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 22:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_376ab440e867e921baedd4596cc095d69a5c3d8153eac450a577e3ee9f75416b.exe
Size 1.1MB
Sample260924-1zppdataqb
SHA256 376ab440e867e921baedd4596cc095d69a5c3d8153eac450a577e3ee9f75416b
MD5 e9d5e96391ccca649bc90f7e92048323
SHA1 f1a208d03f93ef875e8b432da46e8ef626fcce03
SHA512 bc5221f3020a17d9836bce009ad2e3d9309a6888c8b365b1fdee851cb090eef72aa1feff849d89f885cadfa5912fe82c81d79ab1439fa2f46dc6598cec01c8e1
SSDEEP 24576:l5xSs2UOty0TrfVSDBeJjmHSMSICMWDbUdnkq:KTOexSYD0n
TLSH
T1B835CF22D640C47EE0B680FAD6B58B3A1F9A7F72174509D76BC4CD466AB08D3F47824B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery metasploit persistence trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Checks BIOS information in registry 2 TTPs 20 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	system32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	system32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mrtmoons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mrtmoons.exe

Executes dropped EXE 21 IoCs

pid	Process
1172	winis.exe
3328	system32.exe
2120	system32.exe
3736	mrtmoons.exe
4616	mrtmoons.exe
2192	mrtmoons.exe
3764	mrtmoons.exe
3424	mrtmoons.exe
5996	mrtmoons.exe
4228	mrtmoons.exe
4156	mrtmoons.exe
2464	mrtmoons.exe
1912	mrtmoons.exe
4276	mrtmoons.exe
3396	mrtmoons.exe
3568	mrtmoons.exe
5532	mrtmoons.exe
5212	mrtmoons.exe
2828	mrtmoons.exe
2384	mrtmoons.exe
4736	mrtmoons.exe

Loads dropped DLL 1 IoCs

pid	Process
1172	winis.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winis = "C:\\Windows\\system32\\winis.exe"	jaffacakes118_376ab440e867e921baedd4596cc095d69a5c3d8153eac450a577e3ee9f75416b.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File opened for modification	C:\Windows\SysWOW64\vbzip10.dll	winis.exe
File created	C:\Windows\SysWOW64\mrtmoons.exe	system32.exe
File opened for modification	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File created	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File opened for modification	C:\Windows\SysWOW64\vbzip10.dll	jaffacakes118_376ab440e867e921baedd4596cc095d69a5c3d8153eac450a577e3ee9f75416b.exe
File opened for modification	C:\Windows\SysWOW64\winis.exe	jaffacakes118_376ab440e867e921baedd4596cc095d69a5c3d8153eac450a577e3ee9f75416b.exe
File opened for modification	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File created	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File created	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File opened for modification	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File created	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File opened for modification	C:\Windows\SysWOW64\set.exe	jaffacakes118_376ab440e867e921baedd4596cc095d69a5c3d8153eac450a577e3ee9f75416b.exe
File opened for modification	C:\Windows\SysWOW64\mrtmoons.exe	system32.exe
File created	C:\Windows\SysWOW64\check	winis.exe
File opened for modification	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File opened for modification	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File created	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File opened for modification	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File created	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File created	C:\Windows\SysWOW64\winis.exe	jaffacakes118_376ab440e867e921baedd4596cc095d69a5c3d8153eac450a577e3ee9f75416b.exe
File created	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File opened for modification	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File created	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File opened for modification	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe
File opened for modification	C:\Windows\SysWOW64\mrtmoons.exe	mrtmoons.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Ares\My Shared Folder\share\	winis.exe
File created	C:\Program Files (x86)\Ares\My Shared Folder\share\.zip	winis.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winis.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_376ab440e867e921baedd4596cc095d69a5c3d8153eac450a577e3ee9f75416b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtmoons.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{50D98E86-D0F3-B2A3-9E11-F8FAFA8862C6}	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{50D98E86-D0F3-B2A3-9E11-F8FAFA8862C6}\ = "Provides IPortableDevicePropVariantCollection helper methods for portable devices applications and drivers"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{50D98E86-D0F3-B2A3-9E11-F8FAFA8862C6}\InprocServer32	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{50D98E86-D0F3-B2A3-9E11-F8FAFA8862C6}\InprocServer32\ = "C:\\Windows\\SysWOW64\\PortableDeviceTypes.dll"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{50D98E86-D0F3-B2A3-9E11-F8FAFA8862C6}\InprocServer32\ThreadingModel = "Both"	system32.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: 33	2120	system32.exe
Token: SeIncBasePriorityPrivilege	2120	system32.exe
Token: 33	4616	mrtmoons.exe
Token: SeIncBasePriorityPrivilege	4616	mrtmoons.exe
Token: 33	3764	mrtmoons.exe
Token: SeIncBasePriorityPrivilege	3764	mrtmoons.exe
Token: 33	5996	mrtmoons.exe
Token: SeIncBasePriorityPrivilege	5996	mrtmoons.exe
Token: 33	4156	mrtmoons.exe
Token: SeIncBasePriorityPrivilege	4156	mrtmoons.exe
Token: 33	1912	mrtmoons.exe
Token: SeIncBasePriorityPrivilege	1912	mrtmoons.exe
Token: 33	3396	mrtmoons.exe
Token: SeIncBasePriorityPrivilege	3396	mrtmoons.exe
Token: 33	5532	mrtmoons.exe
Token: SeIncBasePriorityPrivilege	5532	mrtmoons.exe
Token: 33	2828	mrtmoons.exe
Token: SeIncBasePriorityPrivilege	2828	mrtmoons.exe
Token: 33	4736	mrtmoons.exe
Token: SeIncBasePriorityPrivilege	4736	mrtmoons.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1104	jaffacakes118_376ab440e867e921baedd4596cc095d69a5c3d8153eac450a577e3ee9f75416b.exe
1172	winis.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1172	1104	jaffacakes118_376ab440e867e921baedd4596cc095d69a5c3d8153eac450a577e3ee9f75416b.exe	89
PID 1172 wrote to memory of 3328	1172	winis.exe	90
PID 3328 wrote to memory of 2120	3328	system32.exe	91
PID 2120 wrote to memory of 3736	2120	system32.exe	94
PID 3736 wrote to memory of 4616	3736	mrtmoons.exe	95
PID 4616 wrote to memory of 2192	4616	mrtmoons.exe	97
PID 2192 wrote to memory of 3764	2192	mrtmoons.exe	98
PID 3764 wrote to memory of 3424	3764	mrtmoons.exe	100
PID 3424 wrote to memory of 5996	3424	mrtmoons.exe	101
PID 5996 wrote to memory of 4228	5996	mrtmoons.exe	102
PID 4228 wrote to memory of 4156	4228	mrtmoons.exe	103
PID 4156 wrote to memory of 2464	4156	mrtmoons.exe	104
PID 2464 wrote to memory of 1912	2464	mrtmoons.exe	105
PID 1912 wrote to memory of 4276	1912	mrtmoons.exe	106
PID 4276 wrote to memory of 3396	4276	mrtmoons.exe	107
PID 3396 wrote to memory of 3568	3396	mrtmoons.exe	108
PID 3568 wrote to memory of 5532	3568	mrtmoons.exe	109
PID 5532 wrote to memory of 5212	5532	mrtmoons.exe	110
PID 5212 wrote to memory of 2828	5212	mrtmoons.exe	111
PID 2828 wrote to memory of 2384	2828	mrtmoons.exe	112
PID 2384 wrote to memory of 4736	2384	mrtmoons.exe	113

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_376ab440e867e921baedd4596cc095d69a5c3d8153eac450a577e3ee9f75416b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_376ab440e867e921baedd4596cc095d69a5c3d8153eac450a577e3ee9f75416b.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\winis.exe
  C:\Windows\system32\winis.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Users\Admin\system32.exe
    C:\Users\Admin\system32.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3328
  - - C:\Users\Admin\system32.exe
      C:\Users\Admin\system32.exe
      4⤵
      Checks BIOS information in registry
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2120
    - - C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 1508 "C:\Users\Admin\system32.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3736
      - C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 1508 "C:\Users\Admin\system32.exe"
        6⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 892 "C:\Windows\SysWOW64\mrtmoons.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2192
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 892 "C:\Windows\SysWOW64\mrtmoons.exe"
        8⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3764
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 992 "C:\Windows\SysWOW64\mrtmoons.exe"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3424
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 992 "C:\Windows\SysWOW64\mrtmoons.exe"
        10⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5996
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 888 "C:\Windows\SysWOW64\mrtmoons.exe"
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4228
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 888 "C:\Windows\SysWOW64\mrtmoons.exe"
        12⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4156
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 1444 "C:\Windows\SysWOW64\mrtmoons.exe"
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2464
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 1444 "C:\Windows\SysWOW64\mrtmoons.exe"
        14⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 888 "C:\Windows\SysWOW64\mrtmoons.exe"
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4276
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 888 "C:\Windows\SysWOW64\mrtmoons.exe"
        16⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3396
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 888 "C:\Windows\SysWOW64\mrtmoons.exe"
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3568
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 888 "C:\Windows\SysWOW64\mrtmoons.exe"
        18⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5532
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 1448 "C:\Windows\SysWOW64\mrtmoons.exe"
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5212
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 1448 "C:\Windows\SysWOW64\mrtmoons.exe"
        20⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2828
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 1444 "C:\Windows\SysWOW64\mrtmoons.exe"
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2384
        
        C:\Windows\SysWOW64\mrtmoons.exe
        
        C:\Windows\system32\mrtmoons.exe 1444 "C:\Windows\SysWOW64\mrtmoons.exe"
        22⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C68B7B09.TMP

Path C:\Users\Admin\AppData\Local\Temp\C68B7B09.TMP
Size 116B
SHA256 c7919f81aeceabb6db36d6a1c4572ce3091c709d63e3a6787f00b2509e836425
MD5 300889b9c7f8826f3e53b083fafafe47
SHA1 37a1dd6384c2cc8e12443f712c0fe2d9af4cd781
SHA512 197e244db069c72e63b0374ef41b01127586421e12a211b5105542899e0ea77f51e86bbad5f7c63ee3a738bb4c8f0fcea4a7dc81af52e797b9d8b6ac810df0b1
TLSH
T11FB02B2500ABA01A81B068144764C80123226F700C050082C8E729040CC166010B87E3
MD5 SHA1 SHA512 TLSH

Submit Download

C68B7B09.TMP

Path C:\Users\Admin\AppData\Local\Temp\C68B7B09.TMP
Size 116B
SHA256 db7b789bc22f8934129c86bcd99f4b2734c9d657fc8d77bddb8973f48c1ecf6c
MD5 3832311e302808f08919b4cb51d30cd8
SHA1 70d7f36768088bb215e3bdc9ec211da8f2638c2e
SHA512 fa47b10d6079981335d34d1fab189bd1b36d9e5095ee522a69d37b71fb305f7df9c62f8e77bc6dbf0c3d75e554c3e24ba2344d0ad0e5d68d85a96bcff1e8e3cd
TLSH
T1F5B09B3700AFA116C1E159545554C45256236E750D150552D8E725440C51A5614B85D7
MD5 SHA1 SHA512 TLSH

Submit Download

C68B7B09.TMP

Path C:\Users\Admin\AppData\Local\Temp\C68B7B09.TMP
Size 116B
SHA256 19009ec93be1701a13dc8265e52482462eaf742e0d23c0a1808dd4a18e3fd456
MD5 2bbdc83dc94302991306faa0a23d60e9
SHA1 eee1efa5c3d103847fe298a9cb9cb133579a7bbb
SHA512 f3d0d408bcb1d5982cb6059b83b9046e4cb8f959c9fbe2023015ca8d80265e00b0dc0cee657f6ac88d7349761671f805f05a12e785317b7ed7e7bb70bf1edb83
TLSH
T1C5B09B3640AFA11685D259145154C44257326E790D250592D4E725480C5275924BC5D7
MD5 SHA1 SHA512 TLSH

Submit Download

C68B7B09.TMP

Path C:\Users\Admin\AppData\Local\Temp\C68B7B09.TMP
Size 116B
SHA256 8e277dfde1d69c56fd0aba305130c4cb6d6aaec7f2cc9f52a8df784f4dba1689
MD5 803d542fb941ad32a0f5e78507e5ad8a
SHA1 c1003eab94cbbffdd0f9a1504032e2dc7ec9c06c
SHA512 afea28991ae95d575ee20a5ad06b9c1c1e7332f5b02ce22ee25640344f581fcb76cd2499c05b6ba60cb88de1d0785d7d06ce5303cda0070a2702188713972c05
TLSH
T1CDB09B2900EFB116D19159248164C44366666E751C590942D4E735444C4265536B84E6
MD5 SHA1 SHA512 TLSH

Submit Download

C68B7B09.TMP

Path C:\Users\Admin\AppData\Local\Temp\C68B7B09.TMP
Size 116B
SHA256 08fa30ae73901567b0eeea3b8c3904642d8a0b9f860d339a1ba04180cb9d0d09
MD5 0b05db14dbd1af2df0b5c497654cab7a
SHA1 7fe42bc00ea9fa8413b1390f828897ae1870a3d8
SHA512 705fd82698a0afebf3b34f4e178890d5d94a80a17d4e6d843fde3dceb36bc96907f4b94a733974cd9d8d0a729ce3f479c7c6fa687218cfbf76f9b480e8609963
TLSH
T1A7B02B3500BBD01AC1917E140114CC0163222E310C040043C4F734440C0661424B80D2
MD5 SHA1 SHA512 TLSH

Submit Download

C68B7B09.TMP

Path C:\Users\Admin\AppData\Local\Temp\C68B7B09.TMP
Size 116B
SHA256 cec0f89ec5da579d19f034c6e742bdf3de59725533731b32138fe78cb0a18961
MD5 55aff02c34699dcc5390eefc1dddcf53
SHA1 9df87b14b6050ae63216abdf335560968d6a77be
SHA512 47e489bf9b0959d28cc6be1bb2ddd3372bbdd2a65f05ebd8ce48afafa938c59b5530ae418a93a949170a59cbd9b7cde2b5b19cdf558aa86e463f76e8718fb9ee
TLSH
T10FB09B2600FF911685A16D155259DC4256227E751C154542D4E725440D4565924FC4E6
MD5 SHA1 SHA512 TLSH

Submit Download

C68B7B09.TMP

Path C:\Users\Admin\AppData\Local\Temp\C68B7B09.TMP
Size 116B
SHA256 bedb52be59c01433705079c6325a01d7ccf6c36780da7813ccd57e7a0630599e
MD5 41c4b78d45d33579dc5d0ee95627dfcb
SHA1 c488664ed475b8eb4bcc956974306028a7f5f6f0
SHA512 7205dfbe22cb355bd2914f9921548f458b260369b6871af825d2a50602a97bee282bbe4b7dd2cce1d57cbd27ab66e73b705dbf1258d48839772342f0773ef07e
TLSH
T1E2B09B6900ABA116C1D169284264C44166727E750D5515C2D4EB29450C5565514B84D7
MD5 SHA1 SHA512 TLSH

Submit Download

C68B7B09.TMP

Path C:\Users\Admin\AppData\Local\Temp\C68B7B09.TMP
Size 116B
SHA256 4fefbbe2cea1b488070b52105ae437be76bbf56c308ea936a9d943c440f9af17
MD5 1406ae9050930c48445392848731b25c
SHA1 221701c447d37d1385a31639ec88a945c308bd77
SHA512 2caaf4b119f500d2fdeff56a2b6aa88db5445c23fa51a89988c48420423ef9ab3a968c6c300a71ceff944fd4d48da2bd6f3166482d3b0e7adf0e6424b5cacc86
TLSH
T1D8B02B2500BB905785A058144134CC0122222F700C041042C4FB3C040CC120524B81E2
MD5 SHA1 SHA512 TLSH

Submit Download

system32.exe

Path C:\Users\Admin\system32.exe
Size 836KB
SHA256 53b3aca10dfc6f7bf1c0349f0b98babf5d0d1a584ac6b10369e2b7ac054a99dd
MD5 1385219d6368deca2b4c8ffd47c7b612
SHA1 073faff2cc9d76b85c1339d9a308977b1d3bacf5
SHA512 e31cff07e9dfc3b7ee7a1b38066408826da17ffde23e363667f4de61bbcd99c000a346df7ae7bd3c4f19eddcc2fc029553f60f4858d2236afb7759729656a375
SSDEEP 24576:GSs2UOty0TrfVSDBeJjmHSMSICMWDbUdn:bTOexSYD0
TLSH
T18505CF66C640C86DF0BA40FAE3EA9B391FD93F63675A05E31DC4CC466AB08D6B474187
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vbzip10.dll

Path C:\Windows\SysWOW64\vbzip10.dll
Size 144KB
SHA256 cbe2e53f8602fe9b24583f366edf0f29f888efaef6ca9c03ed7c89b2c2bce263
MD5 5b25690cc2e55a6d4bc965068a7ba1ef
SHA1 58a5f2613df475b69e60b691215d5c60462cedb3
SHA512 e86e87e3b7b819be5ccb68c1b1fa9b01b4ac007451f73eb66f7b98a512514a9557a250b9a73e258eed751e0c9bec11335ffe0d604a45e7112f189cf9e48e8e7d
SSDEEP 3072:Hrp6swgjFDzLfu/m7UtaEC+3axH2R94ymG8ZRoLrOMjo:HV/f37Uta/ua8cTs
TLSH
T18BE39E8274A2C073E6D8413C05B2AF378F7FA4755A51DE93C795CDE20C650A1EA2E38B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winis.exe

Path C:\Windows\SysWOW64\winis.exe
Size 1.1MB
SHA256 376ab440e867e921baedd4596cc095d69a5c3d8153eac450a577e3ee9f75416b
MD5 e9d5e96391ccca649bc90f7e92048323
SHA1 f1a208d03f93ef875e8b432da46e8ef626fcce03
SHA512 bc5221f3020a17d9836bce009ad2e3d9309a6888c8b365b1fdee851cb090eef72aa1feff849d89f885cadfa5912fe82c81d79ab1439fa2f46dc6598cec01c8e1
SSDEEP 24576:l5xSs2UOty0TrfVSDBeJjmHSMSICMWDbUdnkq:KTOexSYD0n
TLSH
T1B835CF22D640C47EE0B680FAD6B58B3A1F9A7F72174509D76BC4CD466AB08D3F47824B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1104-0-0x0000000000400000-0x0000000000510000-memory.dmp

Download

memory/1912-2096-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/1912-1939-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/2120-38-0x0000000003BC0000-0x0000000003BE0000-memory.dmp

Download

memory/2120-56-0x0000000000AC0000-0x0000000000B4D000-memory.dmp

Download

memory/2120-42-0x0000000000AC0000-0x0000000000B4D000-memory.dmp

Download

memory/2120-34-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/2120-37-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/2120-48-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/2120-40-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/2120-36-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/2120-35-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/2120-41-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/2120-57-0x0000000000AC0000-0x0000000000B4D000-memory.dmp

Download

memory/2120-58-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/2120-25-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/2120-33-0x0000000000AC0000-0x0000000000B4D000-memory.dmp

Download

memory/2120-26-0x0000000000AC0000-0x0000000000B4D000-memory.dmp

Download

memory/2120-31-0x0000000000AC0000-0x0000000000B4D000-memory.dmp

Download

memory/2192-678-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/2192-709-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/2384-3648-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/2384-3613-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/2464-1911-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/2464-1950-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/2828-3373-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/2828-3217-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3328-44-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3328-22-0x000000000054D000-0x000000000054E000-memory.dmp

Download

memory/3328-20-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3328-59-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3396-2367-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3396-2522-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3424-1109-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3424-1073-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3568-2761-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3568-2800-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3736-238-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3736-46-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3764-464-0x0000000002E80000-0x0000000002EA0000-memory.dmp

Download

memory/3764-437-0x0000000002380000-0x000000000240D000-memory.dmp

Download

memory/3764-521-0x0000000002380000-0x000000000240D000-memory.dmp

Download

memory/3764-468-0x0000000002380000-0x000000000240D000-memory.dmp

Download

memory/3764-704-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3764-460-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3764-462-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3764-463-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3764-467-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3764-852-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3764-461-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3764-466-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/3764-451-0x0000000002380000-0x000000000240D000-memory.dmp

Download

memory/3764-442-0x0000000002380000-0x000000000240D000-memory.dmp

Download

memory/4156-1267-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4156-1265-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4156-1507-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4156-1668-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4156-1266-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4156-1269-0x0000000003290000-0x00000000032B0000-memory.dmp

Download

memory/4156-1256-0x0000000002370000-0x00000000023FD000-memory.dmp

Download

memory/4156-1273-0x0000000002370000-0x00000000023FD000-memory.dmp

Download

memory/4156-1268-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4156-1247-0x0000000002370000-0x00000000023FD000-memory.dmp

Download

memory/4156-1242-0x0000000002370000-0x00000000023FD000-memory.dmp

Download

memory/4228-1479-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4228-1518-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4276-2339-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4276-2378-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4616-68-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4616-75-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4616-55-0x00000000023A0000-0x000000000242D000-memory.dmp

Download

memory/4616-244-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4616-50-0x00000000023A0000-0x000000000242D000-memory.dmp

Download

memory/4616-61-0x00000000023A0000-0x000000000242D000-memory.dmp

Download

memory/4616-69-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4616-445-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4616-73-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4616-70-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4616-76-0x00000000023A0000-0x000000000242D000-memory.dmp

Download

memory/4616-71-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/4616-72-0x0000000003F90000-0x0000000003FB0000-memory.dmp

Download

memory/4616-111-0x00000000023A0000-0x000000000242D000-memory.dmp

Download

memory/4736-3639-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/5212-3189-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/5212-3226-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/5532-2791-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/5532-2948-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/5996-862-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/5996-860-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/5996-861-0x0000000002FE0000-0x0000000003000000-memory.dmp

Download

memory/5996-864-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/5996-849-0x0000000002390000-0x000000000241D000-memory.dmp

Download

memory/5996-842-0x0000000002390000-0x000000000241D000-memory.dmp

Download

memory/5996-1250-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/5996-865-0x0000000002390000-0x000000000241D000-memory.dmp

Download

memory/5996-847-0x0000000002390000-0x000000000241D000-memory.dmp

Download

memory/5996-859-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/5996-858-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/5996-857-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

memory/5996-916-0x0000000002390000-0x000000000241D000-memory.dmp

Download

memory/5996-1100-0x0000000000400000-0x00000000005ED000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads