1389e32845d01e3b48e741471e2a9da4227a7d5c11ebe7649cd5041c23b6ee39

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_1389e32845d01e3b48e741471e2a9da4227a7d5c11ebe7649cd5041c23b6ee39.exe
Size 1.6MB
Sample260925-fp6vpayv6n
SHA256 1389e32845d01e3b48e741471e2a9da4227a7d5c11ebe7649cd5041c23b6ee39
MD5 cf16612de485152f18ec70e234703db5
SHA1 638726d2efe28b29bf07ea38dbaa35e4c1906c91
SHA512 1e1edf4f8475b7c37c49f09c5a5d128207830a45484a55225fa0f3b2e42687d091016dd6bca877dcb352442162c74e1176f0bb867f7d6d5e2d12a93b2f3558ec
SSDEEP 49152:fOg41yH0+JTf+bPTqqY3AVwShHTbgvR5FN:fON+JbQ2qY3AuShzbER1
TLSH
T16B75330DA9C1F4F9CF56157890A79B332A34AB110326D987EB44DE6BE8312541B2B1FF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery persistence spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
832	Hit.exe
2752	csrss.exe
1892	winlogon.exe
2080	tv.exe
1340	winpro.exe
5952	smss.exe
3360	csrss.exe
4200	saglik.exe
3168	svchots.exe
1576	winlogon.exe

Loads dropped DLL 7 IoCs

pid	Process
1892	winlogon.exe
1892	winlogon.exe
4200	saglik.exe
3168	svchots.exe
3168	svchots.exe
3168	svchots.exe
1576	winlogon.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\csrss = "C:\\Windows\\csrss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\Windows\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\csrss = "C:\\Windows\\csrss.exe"	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mirc.ini	svchots.exe
File opened for modification	C:\Windows\SysWOW64\aliases.ini	svchots.exe
File opened for modification	C:\Windows\SysWOW64\system32\botconf.FAT32	svchots.exe
File opened for modification	C:\Windows\SysWOW64\kayit.dll	svchots.exe
File created	C:\Windows\SysWOW64\0313.INS	smss.exe
File created	C:\Windows\SysWOW64\27296716.INS	smss.exe
File created	C:\Windows\SysWOW64\31861617.INS	smss.exe
File created	C:\Windows\SysWOW64\37224256.INS	smss.exe
File created	C:\Windows\SysWOW64\8204747.INS	smss.exe
File created	C:\Windows\SysWOW64\7058408.INS	smss.exe
File created	C:\Windows\SysWOW64\system32\5972932.INS	smss.exe
File opened for modification	C:\Windows\SysWOW64\system32\Systemx.dll	svchots.exe
File created	C:\Windows\SysWOW64\86102025.INS	smss.exe
File created	C:\Windows\SysWOW64\system32\91723679.INS	smss.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c439-36.dat	upx
behavioral2/memory/2080-39-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral2/memory/2080-56-0x0000000000400000-0x0000000000432000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\browserconfig.$$A	tv.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\csrss.$$A	jaffacakes118_1389e32845d01e3b48e741471e2a9da4227a7d5c11ebe7649cd5041c23b6ee39.exe
File created	C:\Windows\MSWINSCK.$$A	jaffacakes118_1389e32845d01e3b48e741471e2a9da4227a7d5c11ebe7649cd5041c23b6ee39.exe
File created	C:\Windows\saglik.$$A	jaffacakes118_1389e32845d01e3b48e741471e2a9da4227a7d5c11ebe7649cd5041c23b6ee39.exe
File created	C:\Windows\smss.$$A	jaffacakes118_1389e32845d01e3b48e741471e2a9da4227a7d5c11ebe7649cd5041c23b6ee39.exe
File created	C:\Windows\tv.$$A	jaffacakes118_1389e32845d01e3b48e741471e2a9da4227a7d5c11ebe7649cd5041c23b6ee39.exe
File created	C:\Windows\winlogon.$$A	jaffacakes118_1389e32845d01e3b48e741471e2a9da4227a7d5c11ebe7649cd5041c23b6ee39.exe
File created	C:\WINDOWS\winpro.$$A	tv.exe
File opened for modification	C:\WINDOWS\go.txt	winpro.exe
File created	C:\Windows\Hit.$$A	jaffacakes118_1389e32845d01e3b48e741471e2a9da4227a7d5c11ebe7649cd5041c23b6ee39.exe
File created	C:\Windows\MSINET.$$A	jaffacakes118_1389e32845d01e3b48e741471e2a9da4227a7d5c11ebe7649cd5041c23b6ee39.exe
File created	C:\Windows\rastgele.$$A	jaffacakes118_1389e32845d01e3b48e741471e2a9da4227a7d5c11ebe7649cd5041c23b6ee39.exe
File created	C:\WINDOWS\go.$$A	tv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winpro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_1389e32845d01e3b48e741471e2a9da4227a7d5c11ebe7649cd5041c23b6ee39.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	saglik.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchots.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main	csrss.exe

Modifies Internet Explorer start page 1 TTPs 4 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Start Page	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.cnnarama.com"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.cnnarama.com"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Start Page	csrss.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories	saglik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\FLAGS\ = "2"	saglik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\command	svchots.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\DefaultIcon\ = "\"C:\\Windows\\SysWOW64\\svchots.exe\""	svchots.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec\Application\ = "mIRC"	svchots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet	saglik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus\1\ = "132497"	saglik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	saglik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\Application\ = "mIRC"	svchots.exe
Key created	\REGISTRY\MACHINE\Software\Classes\irc	svchots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}	saglik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	saglik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\ = "C:\\Windows\\MSWINSCK.OCX"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1\CLSID\ = "{48E59293-9880-11CF-9754-00AA00C00908}"	saglik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\ = "Microsoft Internet Transfer Control 6.0"	saglik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}"	saglik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\ = "C:\\Windows\\MSWINSCK.OCX, 1"	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}	saglik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32	saglik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	saglik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\ = "Microsoft WinSock Control, version 6.0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Version	saglik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus\ = "0"	saglik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}	saglik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}	saglik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\ = "Internet Control URL Property Page Object"	saglik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32	saglik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile	svchots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open	svchots.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\EditFlags = 02000000	svchots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\ = "Internet Control General Property Page Object"	saglik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib\Version = "1.0"	saglik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.chat\ = "ChatFile"	svchots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell	svchots.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\MSWINSCK.OCX"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Programmable	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ToolboxBitmap32	saglik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\InprocServer32\ = "C:\\Windows\\MSINET.OCX"	saglik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib\Version = "1.0"	saglik.exe
Key created	\REGISTRY\MACHINE\Software\Classes\irc\Shell\open\ddeexec\Application	svchots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\InprocServer32	saglik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\0\win32\ = "C:\\Windows\\MSINET.OCX"	saglik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\ = "URL:IRC Protocol"	svchots.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell	svchots.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ = "Microsoft WinSock Control, version 6.0"	winlogon.exe

Runs regedit.exe 1 IoCs

pid	Process
3324	regedit.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
832	Hit.exe
2752	csrss.exe
1892	winlogon.exe
1892	winlogon.exe
1892	winlogon.exe
1892	winlogon.exe
1340	winpro.exe
3360	csrss.exe
4200	saglik.exe
3168	svchots.exe
3168	svchots.exe
1576	winlogon.exe
1576	winlogon.exe
1576	winlogon.exe
1576	winlogon.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 6008 wrote to memory of 832	6008	jaffacakes118_1389e32845d01e3b48e741471e2a9da4227a7d5c11ebe7649cd5041c23b6ee39.exe	89
PID 832 wrote to memory of 2752	832	Hit.exe	90
PID 832 wrote to memory of 1892	832	Hit.exe	91
PID 1892 wrote to memory of 2080	1892	winlogon.exe	92
PID 2080 wrote to memory of 1340	2080	tv.exe	93
PID 832 wrote to memory of 5952	832	Hit.exe	95
PID 832 wrote to memory of 4200	832	Hit.exe	97
PID 5952 wrote to memory of 3168	5952	smss.exe	98
PID 3168 wrote to memory of 3324	3168	svchots.exe	99

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1389e32845d01e3b48e741471e2a9da4227a7d5c11ebe7649cd5041c23b6ee39.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1389e32845d01e3b48e741471e2a9da4227a7d5c11ebe7649cd5041c23b6ee39.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6008
- C:\Windows\Hit.exe
  "C:\Windows\Hit.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:832
- - C:\Windows\csrss.exe
    C:\Windows\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Suspicious use of SetWindowsHookEx
    PID:2752
- - C:\Windows\winlogon.exe
    C:\Windows\winlogon.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1892
  - - C:\Windows\tv.exe
      C:\Windows\tv.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2080
    - - C:\WINDOWS\winpro.exe
        
        "C:\WINDOWS\winpro.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1340
- - C:\Windows\smss.exe
    C:\Windows\smss.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5952
  - - C:\Windows\SysWOW64\svchots.exe
      "C:\Windows\system32\svchots.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3168
    - - C:\Windows\SysWOW64\regedit.exe
        
        "C:\Windows\SysWOW64\regedit.exe" /S kayit.dll
        5⤵
        System Location Discovery: System Language Discovery
        Runs regedit.exe
        
        PID:3324
- - C:\Windows\saglik.exe
    C:\Windows\saglik.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:4200

C:\Windows\csrss.exe
C:\Windows\csrss.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of SetWindowsHookEx
PID:3360

C:\Windows\winlogon.exe
C:\Windows\winlogon.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Preferences.$$A

Path C:\Users\Default\AppData\Local\Google\Chrome\User Data\Default\Preferences.$$A
Size 13KB
SHA256 e52df672aa2ca7712d3ac12de209dcf0c756970011a4cfe4dba822883f5e81d3
MD5 59b9c07d395e1c268c498166eda12b6a
SHA1 b6bb0b6eca8a6a38c8b64223bb67ecc771edf8a6
SHA512 5ea613e36d6afde83a1f0176649447357d6ea8f2ebf45c2bb05444901f44aa689c25cf8da18cbff74044544c0568037e833651a6784f3c40c064cb8edc1f9b18
SSDEEP 192:ec7hGJnZgfeh5T+TjOWH2WYLuTCBTlT7TjT+aW7oTATDRDxDa6v38bqHRyBbxnr:J7AbiVRUr
TLSH
T12D52209BC0F5C80DEC37AD08FEB1E39E6842585699C8D4D2FC3D8E6AC65424D359932D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

go.txt

Path C:\WINDOWS\go.txt
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

Hit.exe

Path C:\Windows\Hit.exe
Size 68KB
SHA256 f56d7ba1900b4df1f2a6b2cba0aef0513d35794d8dc0bffa240875edd30de937
MD5 36270ecb9de73a4de716151843a0ded4
SHA1 8a5875a5117f025e3968a35c24f5e2f020f71953
SHA512 8de01990b10b74ad2db0fc879289d75c8a0b3cd767b3f70846c0ad7fe5e7523643286955404d6d737149a5ef7965d193e37398510707cddf5268ec62da7bcb30
SSDEEP 1536:/flTJHzOnKU/w/qiVNziew3pnVNZKU/w/q8xzHlTJ:VTJTO+qiV52pnV6q8tFTJ
TLSH
T1CF633B51BE488665E8ECCA31F06F29B20737AD36DC851D6B35C47B2B0CA1623432797E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSINET.OCX

Path C:\Windows\MSINET.OCX
Size 112KB
SHA256 73da54b69911bdd08ea8bbbd508f815ef7cfa59c4684d75c1c602252ec88ee31
MD5 7bec181a21753498b6bd001c42a42722
SHA1 3249f233657dc66632c0539c47895bfcee5770cc
SHA512 d671e25ae5e02a55f444d253f0e4a42af6a5362d9759fb243ad6d2c333976ab3e98669621ec0850ad915ee06acbe8e70d77b084128fc275462223f4f5ab401bc
SSDEEP 3072:i4QYXpLZaH+kCp1RCaSCF/6UMiySQYPfrj:i4rBfL1RCaSC0ej
TLSH
T1E3B33802B7E2417FF7A627346AF65BA95EF77D153C26984F9300328D5A32B40DA24327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWINSCK.OCX

Path C:\Windows\MSWINSCK.OCX
Size 105KB
SHA256 bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
MD5 9484c04258830aa3c2f2a70eb041414c
SHA1 b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA512 9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
SSDEEP 3072:R7ZSBYfkVoFdRrqo0aRaA/HF673+UWHIfrb:RNkVsuaRaU6mHGb
TLSH
T1A8B35C02B3E58171E5F22B300A361B61AFBEBD25AD31864BC354765D1E31B95EE3831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KCA.dll

Path C:\Windows\SysWOW64\KCA.dll
Size 4KB
SHA256 c1602aa533fb2a4261fa6174ef32d66e91e325bf8b6ee8d7487e74e2982d1183
MD5 bfe2cf7876a8d40e43557694ec1d3f6e
SHA1 784634fb52be39de93c363626823c28a88bad56e
SHA512 65dad85242b2fa6fc720062ab4ae8c6539bad779326f264aa841b3941abd471f9720a6b0a1c59a1824214b783eefbb7bbb3cbe3b9fd0aa731287af5d87cf57ea
SSDEEP 48:SPWzS0AA0BfNRfC4XtMZ6159JzUjbl42vVaE/pbn/P0lwGQdN5u25h:ugS0Z05e49w6X9JQbl42NP9vdG2P
TLSH
T1ED91A4B362E4E472F9D8137A3EA306A325A6DB70B76580484D5364062E77A0BED1CB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dmu.dll

Path C:\Windows\SysWOW64\dmu.dll
Size 30KB
SHA256 445d74478a92117eb400ea0c41e8a90f91e44401b1b28536cd5bb8087572ed3f
MD5 62456b6cbdb93b6f1458469d90c57e2c
SHA1 aee316ef1f6e14e839dd3ce4ef6e4dcd0dacc4c9
SHA512 29331e7da090c9824d67db0a7c62099f3ca97e927d7ffda51237d785dadaf6c21875e98c6e404bb1f9a91382857fcd3ca57c504dc5fb5e5f6f9019cf3fcc732f
SSDEEP 384:klI3/3KtV9iTPyYpdj0MzM9vhI9o0dXVFxcnLsL4lVWHJ78eQVHuGkV3sh2XjtCo:0IStEp+qlXdca4lUJ74u1VcsXRnZuK
TLSH
T1EFD2A84C8A40D9A8D7BF25307E62233FA979CEF210C25043952359E69DF55F3E62B24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kayit.dll

Path C:\Windows\SysWOW64\kayit.dll
Size 352B
SHA256 430140fde00a77891f5cfe04fecab4ab9c991bd35a4e46f453e83eecf164f1f1
MD5 e298d00dec86881ca9076177a33c4e28
SHA1 dc9b9a14f1c22fac2a906db8e7661a085d3e6f9b
SHA512 e92282fd6252bf3f10a0d4479e3d56d841c144e2f8ae9b27f469f9446ead4c2412f657c588e8172a2131880a54674b7fda58f75c00e2b2b3f6d7ce5a4477a17f
TLSH
T1A2E0B621F97A22216DC022000924C1C727FCA2DC71CB4CD0E5ADA3182E728939F5E2AA
MD5 SHA1 SHA512 TLSH

Submit Download

mirc.ini

Path C:\Windows\SysWOW64\mirc.ini
Size 4KB
SHA256 572ba4fbf2a0e60a66b299d0054e146dcff902e85b0e12ece7f41a825ee4715f
MD5 ee25b059a3817825b764873968b706e4
SHA1 1cf6c34c3d4a75bd1101a4b2197a8c5147c29919
SHA512 d09684f1abb8b0dc2827b63b1ebef1af0aa4d9c2e1ea2879815438afdad73ff5333c6cca5cf02b2322896a294acddac4c78696aebccb5ec7cc132bea44e5fd7b
SSDEEP 48:z2Xdp3OU1mtsrdwrsf6sybmDus2WU4w6TA5p5M3FSgSu7MEv5WrDoqVG2G9pG4Gd:sHe1qusPTvSmL/jz7i63eEgGk3Gu
TLSH
T17DA121FF8642596FC0A8F3A1603005A451FAD0DEB5133918BB2D2FD6BF40857A17D936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mirc.ini

Path C:\Windows\SysWOW64\mirc.ini
Size 4KB
SHA256 ed18e4fa587fbf54c2720fd26fd586bdce685c02677b761820ff5eb39bae8326
MD5 8cf63ca732d1aec8ae35123513f0c42e
SHA1 96b4b5d0480501c5b5bba0d4a72a03861ec63799
SHA512 363826e04006db703dbe86a3a607ae3ed4c191bbb52a73e63d7d6dd4fb1ad0f6dce205de39f1ed5b2a4ed93fadaa856a72e34a64a8a1d0acbeb874b7a8d9e0bb
SSDEEP 48:z2Xdp3OU1mtsrdwrsf6sybmDus2WU4w6TA5p5M3FSgSu7MEv5WrDoqVG2G9pG4GA:sHe1qusPTvSmL/Sz7i63eEgGk3Gu
TLSH
T1D0A130FF8642556FC0A8F3A1A03005A491FAE0CEB4137918BB2D2FD6BF40857A17D936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mirc.ini

Path C:\Windows\SysWOW64\mirc.ini
Size 4KB
SHA256 740c8da34e5ba90676e0c434119ce51152555b35e88e949d28af04432ae0a171
MD5 fd9cd8096a09ea1f5166285f398bbf91
SHA1 a1464f1d095e8e8cc47ef455a36ac762cffaf10f
SHA512 94f2825ac0013309e4a578b8b7799eecddca1bc7407867f54d6d296a1ef3489a3552ebc123a557c4a42a7021f795513b36ad57cdc494fb47cffe3c96dcfeefca
SSDEEP 48:z2Xdp3OU1mtsrdwrsf6sybmDus2WU4w6TA5p5M3FSgSu7MEv5WrDoqVG2G9pG4GR:sHe1qusPTvSmL/ez7i63eEgGKGNV
TLSH
T1B3A120FF8642596FC0A8E3A1A03045A491FAE0CEB5137918BB2D2FD67F40857A13D936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchots.exe

Path C:\Windows\SysWOW64\svchots.exe
Size 1.7MB
SHA256 22bdb2606020b82349a629248b599b64235c91e8b450e355a245ef09ece57e1d
MD5 b766003f431cad186bd115f5761592d1
SHA1 33cdfe6f7fa6b321f9a51cc051c32ba924164b10
SHA512 d03cabf713c14a40588ec3d5d7c89be91a0bc2e7b472464ed058b2cce0afe58eaaf7386ce5e6297218b3e677e290625506760ad883412b7f94c3330aa9b9f834
SSDEEP 24576:dt+PGXJIYJgv8E32bpXnKKLA3FEQTdHUOD0/WkdmKaMaOhhpt:LJXJQ32l3tLtIHXAOkdmY
TLSH
T107856C02E2D14433F8A2033119611B716AF9BF24273AE6DB96607D652EF1B51DF2932F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

botconf.FAT32

Path C:\Windows\SysWOW64\system32\botconf.FAT32
Size 4KB
SHA256 ad1044a6a54f10d6ca1ae437e3195816216b4ff9c12116b918bb6cc44b10f472
MD5 d9f790c49fd7f2f8dc1ba365b13a6058
SHA1 8ac99f272adcf30f2474466d602fdcf8e184fed1
SHA512 87617285637b414e26724f5bf8a6d327c4d9b8728e74f9bb84808f6d71b0f78520c6294bb0e7b92cc6739491f691e2f9eedebb2967df598be96ce8dec01fe84c
SSDEEP 48:lAoKlTJUFHFyD0e9cPvy2FSSJCgjqr63iGjhVnzzGjVKm2UkXTuL32:lKlTJUNFg0TPvFASJCg2IVVSE
TLSH
T1B3A10DADB61C8A171A773F37E1C2B459EB136063A692894CB91D0309BFF542752F4EE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Windows\csrss.exe
Size 236KB
SHA256 5eb50fcc3e19594b89748a7a80f6e3e77495f92c239f09921f137bc0e207cab7
MD5 c7cd9409d75f779d09f76d9f1c9a88ce
SHA1 0b4f375d752b72b155937718de136dfd99546fa0
SHA512 33281453b8e2ab2662fa9e77051b1f593eec6f8cb733cb80ba8e4a96b8ca1c69473d0c90c7953195c08a90a58f5bdff795bc8b2a5d1cab9b2e548b94609a7340
SSDEEP 3072:AM5Zt8+BMiNoBlC/XQ0vd8h8C5m152y8IvI8ay03G5:AMXaRzyXdd8p5S52y8Ig86G
TLSH
T12634E82FA95DB252DD890D71141A507C2E21AC1DE014EE0375C1FE2A5973D87BEEA33E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rastgele.txt

Path C:\Windows\rastgele.txt
Size 123B
SHA256 77ae606a02c5600a143cecdd2f07abdfd6e63aebddb372526874a5d2a2807c6d
MD5 b93ecbe99a78a5255601811cf375ffef
SHA1 1bdd64ed97fc9293b26a62330853c034c97d1885
SHA512 2125ffe14e33f9c208de76923378bf4e2c76219e9d3efa5a8c2ea1ed7b89bf6c1d791f242b1de1f5c6f8f5a7fad2cf4b15c76bb94e64d8164271eb332dfbc91c
TLSH
T1F5B008CF241292D69808E81872F1C294841231E0D5D588D5EAC68CF703649603209AA7
MD5 SHA1 SHA512 TLSH

Submit Download

saglik.exe

Path C:\Windows\saglik.exe
Size 356KB
SHA256 e0bf12d90d9941c8a183b9d79521fb8f8f6732140d4d673b45801cbc1e06af61
MD5 3fd0fa1d4d58329330dbc059784d018c
SHA1 2c3cfda9aee811b410918202ec2ef13938b2babf
SHA512 ce492b8c06ef9e37829a7d9782deedd21e25873e6e9816cdf72e33ff68b79f8dc79ea8dca37dc2ceb55bf01c7b0b3293885115cb2c2833e8cc0d2855cbaa993b
SSDEEP 6144:1QAHe8fAIwgw4lAAx9BhmroAiHGqHlEPkJiQHe8fAIwgw4lAAx9Bhmrok9:1QAHe8fAIwgw4lAAx9BhmroAimqkAiQW
TLSH
T1697418279E7CA8C2C0480931943F91683471BC25A029DE83F6D5BD6919B79C3BDFB627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smss.exe

Path C:\Windows\smss.exe
Size 1.1MB
SHA256 bcdb6aa7211843362ee62296e60831dba0db71845d2795b3d2b9b41483394c34
MD5 d73db810bd43019a50450ab82f795564
SHA1 d53978f77ac92298c94f748b3737be7fa26e033d
SHA512 74383c760dd3d1ab1be2f6a372d20cf7581147de7e184b8bf8ead3d0274b4eee3169bd3512d2174e1f07c2ca32be6ec4d2809abf7b7e1f74a7bdf49e8dfe9437
SSDEEP 24576:Y3QUbAfL2+hHMhVB4gEtljNCo2gF5OWO70S7raEHVYiWCdk+I:YAU0fSxhj4gEZafoSnvHBk+I
TLSH
T15C350263F7D08836D1331B389C5B86A45E36FE113D39E98A37F91D4C5E382817A252A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tv.exe

Path C:\Windows\tv.exe
Size 154KB
SHA256 af6da64220e45531611a9bccf0700e723902ffcd07d58808b5b9a6ce3f7bf1ee
MD5 f80dd1cec835a5dcbb3e80f937543dab
SHA1 0132d1fccb8590b7783d3306da52132257e61ea0
SHA512 400bea0990a00203e3548c350dd93594b6bb5290cb1196e705cf74c25c35b300885ac5522d4f4935347f9db24e2e97bf67b065c3f5369cd8c04d6ccbe6a67c1f
SSDEEP 3072:LTof+8cUfY9eQUtjeY8ZfNyAM4DoV/Z8J8AxZd3obyHvFljHJA9U:Po2U8hUtA9BMNZ8JRxg2dBqU
TLSH
T10EF3231C8662E45DCB719336A311DAFA06B45D3993D0A34A2B5C75CE6FB0D842F2C2B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlogon.exe

Path C:\Windows\winlogon.exe
Size 340KB
SHA256 c023da051ea517ffca5aa939921ccae180d4b0b0735f1a37e20a59b2ac530f33
MD5 cec5205f98e484a578ecd53f4c378cbb
SHA1 e6ece751795ab6271dcfc01bf0f6461a315b2e29
SHA512 846f1489c8c34421e29ea20c50c945f53f1c613899a5d7050934e41a93397b2d4c5eb261f09f1d2235640489e33500f75cded746006fc07b3c84247a1b088098
SSDEEP 6144:VQAHe8fAIwgw4lAAx9BhmroAiHr0pxovCLOcJiQHe8fAIwgw4lAAx9Bhmrok9:VQAHe8fAIwgw4lAAx9BhmroAi9vwiQH2
TLSH
T1F9741917AA6AE482D1181D31585FC1782471AC26A02ECE47ABD4FDE41C37AC3BEF9537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winpro.exe

Path C:\Windows\winpro.exe
Size 200KB
SHA256 736a339794d7c0e58c0bddb72077493e337b22c87ec225cbe176466ea8d07f2e
MD5 d25ce853f8a7ac67a3021bec824d7e56
SHA1 f1a6f3252bf0c14fb797b2a28596f8a441a499cc
SHA512 c9a19e531b5199bbce441e388a1c0d05c047c27dd8db0fcaa6435e1d439846119bdb8c0ae030d1d4bd178ab43c25bd4f4262a42cff851a9ba59e76c8d8df86c7
SSDEEP 6144:iQAHe8fAIwgw4lAAx9BhmroAiHHcgI/5DMx9pAIDRpFJiQHe8fAIwgw4lAAx9BhG:iQAHe8fAIwgw4lAAx9BhmroAi3iQHe88
TLSH
T1AB144A46BF58ACDAE10C0A30C57BC72452B9FD1658BA6FC669CCFD850C726C19CA981F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2080-56-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/2080-39-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/3168-316-0x0000000000400000-0x00000000005CE000-memory.dmp

Download

memory/3168-320-0x0000000000400000-0x00000000005CE000-memory.dmp

Download

memory/3168-309-0x0000000000400000-0x00000000005CE000-memory.dmp

Download

memory/3168-310-0x0000000000400000-0x00000000005CE000-memory.dmp

Download

memory/3168-312-0x0000000000400000-0x00000000005CE000-memory.dmp

Download

memory/3168-313-0x0000000000400000-0x00000000005CE000-memory.dmp

Download

memory/3168-307-0x0000000000400000-0x00000000005CE000-memory.dmp

Download

memory/3168-317-0x0000000000400000-0x00000000005CE000-memory.dmp

Download

memory/3168-314-0x0000000000400000-0x00000000005CE000-memory.dmp

Download

memory/3168-319-0x0000000000400000-0x00000000005CE000-memory.dmp

Download

memory/3168-324-0x0000000000400000-0x00000000005CE000-memory.dmp

Download

memory/3168-321-0x0000000000400000-0x00000000005CE000-memory.dmp

Download

memory/3168-306-0x0000000000400000-0x00000000005CE000-memory.dmp

Download

memory/3168-323-0x0000000000400000-0x00000000005CE000-memory.dmp

Download

memory/5952-230-0x0000000000400000-0x000000000044E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads