Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 18:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe
- Size 3.1MB
- Sample260925-w8l8dsxtet
- SHA256 fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e
- MD5 638420a5aaf7e2cc497433678fe2f528
- SHA1 d007f7ff9febaa6e094d30e43a0ceafe8e5727e3
- SHA512 d29138689660fd960554318981d77ec2ab9031ee87d4c09d1e903563978a1fcbeebf0fa16785dc39f5ac61ca0f1c329512b4c4cd452dfed72b57ab1cda9e20ee
- SSDEEP 49152:BXzhfk0PK0gg4tV7eUFnpD5mQcY/3kkruyJHxXO+wqZMG:Rhc0PRg1VaUFpt7JkonJdJ
- TLSH T179E5D102F65180B5D78D113205BB2779EAB85F5107389EC39364FD79EE332E1AA3621B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000300000001b897-22.dat acprotect - Executes dropped EXE 1 IoCs
pid Process 5764 2020.exe - Loads dropped DLL 2 IoCs
pid Process 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1028 rundll32.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\SkinH_EL.dll jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe File created C:\Windows\SysWOW64\Pnamsnqs.dat 2020.exe File created C:\Windows\SysWOW64\4535757.ime 2020.exe -
resource yara_rule behavioral2/files/0x0007000000016b3a-11.dat upx behavioral2/memory/5764-15-0x0000000000400000-0x0000000000411000-memory.dmp upx behavioral2/memory/5764-21-0x0000000000400000-0x0000000000411000-memory.dmp upx behavioral2/files/0x000300000001b897-22.dat upx behavioral2/memory/1028-24-0x0000000010000000-0x0000000010109000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\2020.exe jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe File created C:\Windows\lvTes32.bmp 2020.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2020.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1028 rundll32.exe 1028 rundll32.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: 33 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe Token: SeIncBasePriorityPrivilege 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1808 wrote to memory of 5764 1808 jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe 89 PID 5764 wrote to memory of 1028 5764 2020.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fd88af85c0976a8e0fa8fa11990f62d1a8264cea572591ef502bb388a0bbac7e.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\2020.exe"C:\Windows\2020.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" 4535757.ime,init C:\Windows\2020.exe3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1028
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\2020.exe
- Size 40KB
- SHA256 5accc50fb23c702a4efc24aec69354ecc7681d6fe553be9699662a2880e2fb44
- MD5 63dbd6af1d80941a85d0661e1604687a
- SHA1 2cfb4c14f68a6f31a9029313861affc478f25b18
- SHA512 fa6550314ac1ececb2529efd2fbe1a1c7755db08c11d243c0c794fc06f92e62192efdb68f4f9c047cfeb72ce49a2383ccd2130b9032adac77008b3529416971a
- SSDEEP 768:HjOb/scCTNtNLKxN50AB4kI22uCZxul/FqzYMtswhxWrhl3:iwtNgN5jBxIXuiAl/8zYMtnWz
- TLSH T1180302FF0FA05B64CE1DA63D865FBD8407001AAD1984E072299B6DA2C8F36F84E25D14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\4535757.ime
- Size 30KB
- SHA256 adf4c83f76399b1dd0117df952635a52bc216f9c13970c6a42420cffeb3aef1f
- MD5 6000d897312ae68dbba9f248f7ee89d2
- SHA1 d6840ef26f8e19d0112f7cb52d72e55e7d24742f
- SHA512 d15b0f79f16f7ca7144eb8cc7ec1cd21273b339127023ad5f1df24892d7ae1cf6cfa1ae37fc024780b9be073a8efd01dc5e479447ba53e8e5f28791253625671
- SSDEEP 768:je/SbPGRd0LLLZMG6Zm+j+sM2gDVW2OkQXNCfbBqe6JLi/:XjrMVZm+ZgDE2OkQdCMJG/
- TLSH T109E2E1FA9DE41849FF36277E7E5B07679215A28C6628C73506BF0192ECB02F44E16F50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Pnamsnqs.dat
- Size 256B
- SHA256 d9e9afd10348a592aeacb4627d1884355b9c434062702320b0d9212eeb9fe9c6
- MD5 753742b1d85a46acf3313a45dbf6df2f
- SHA1 8103e27c820a359f153469947dd6e33681d92aed
- SHA512 ba5d1e5ab76ac318c1da5b90da86a4567c178510f9f1b6dc141302b7e2faa993c139b7325f24aa8aff4fb7d629f6aad3502f9c49e0a7b2fed5cab7999820519c
- TLSH T126D08C6949293AAEF4AAF63C442AA0B90E92ABD6C2D08431336844A439864B15A07A06
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\SkinH_EL.dll
- Size 688KB
- SHA256 573cf4e4dfa8fe51fc8b80b79cd626cb861260d26b6e4f627841e11b4dce2f48
- MD5 bd42ef63fc0f79fdaaeca95d62a96bbb
- SHA1 97ca8ccb0e6f7ffeb05dc441b2427feb0b634033
- SHA512 431b5487003add16865538de428bf518046ee97ab6423d88f92cda4ff263f971c0cf3827049465b9288a219cc32698fd687939c7c648870dd7d8d6776735c93c
- SSDEEP 12288:AuOtG9rMIfLpoTp2/WFH8bW7INLtK4dRjKCHd:9z9OIu4d1KCHd
- TLSH T127E40810E101C12EE4D601BA96FB16ECE8F86BF2537C28DB5194E4B6E3537F2693075A
- MD5 SHA1 SHA512 SSDEEP TLSH