680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 09:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe
Size 110KB
Sample260930-lv9resvtfx
SHA256 680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523
MD5 c047b8b62d27958b4254191f23d6bb6f
SHA1 2652b3d1f216d92b440fa2de14299084831c6c28
SHA512 7f17dd4f6d6ff9c1c61c0ba4c1f0fe3ea9a7d5f09cd8ec4e5e01df14739fba6d5e810f2c8a31526dba715bb11728a4ba3f865f34e792ebe6ac774b35a2d5641c
SSDEEP 3072:nZbeI76qLh6tPWnBx8vN5CHDNu3bdbV3uUSav+APyXi:Z7uDunBxQEwbzVSe+AqX
TLSH
T131B3CF76F590C4B6D3309AFCDC398229A72E3B212D7B56A76AED0E8D8D1D2D2571C043
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{3G4L2686-J4L1-X5MV-12RE-JFH5V38F5030}	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3G4L2686-J4L1-X5MV-12RE-JFH5V38F5030}\StubPath = "C:\\Windows\\system32\\Coffin Of Evil.exe Restart"	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\xdocx = "C:\\Windows\\system32\\Coffin Of Evil.exe"	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\xcrx = "C:\\Windows\\system32\\Coffin Of Evil.exe"	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Coffin Of Evil.exe	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4064-0-0x0000000010410000-0x0000000010443000-memory.dmp	upx
behavioral2/memory/4064-1-0x0000000010410000-0x0000000010443000-memory.dmp	upx
behavioral2/memory/4064-4-0x00000000008F0000-0x00000000008FD000-memory.dmp	upx
behavioral2/memory/4064-8-0x0000000000900000-0x000000000090D000-memory.dmp	upx
behavioral2/memory/4064-12-0x0000000000910000-0x000000000091D000-memory.dmp	upx
behavioral2/memory/4064-13-0x0000000000910000-0x000000000091D000-memory.dmp	upx
behavioral2/memory/4064-16-0x0000000000920000-0x000000000092D000-memory.dmp	upx
behavioral2/memory/4064-17-0x0000000000920000-0x000000000092D000-memory.dmp	upx
behavioral2/memory/4064-21-0x0000000000930000-0x000000000093D000-memory.dmp	upx
behavioral2/memory/4064-20-0x0000000000930000-0x000000000093D000-memory.dmp	upx
behavioral2/memory/4064-25-0x0000000000940000-0x000000000094D000-memory.dmp	upx
behavioral2/memory/4064-24-0x0000000000940000-0x000000000094D000-memory.dmp	upx
behavioral2/memory/4064-28-0x0000000000950000-0x000000000095D000-memory.dmp	upx
behavioral2/memory/4064-29-0x0000000000950000-0x000000000095D000-memory.dmp	upx
behavioral2/memory/4064-33-0x0000000010450000-0x000000001045D000-memory.dmp	upx
behavioral2/memory/4064-36-0x0000000002210000-0x000000000221D000-memory.dmp	upx
behavioral2/memory/4064-37-0x0000000002210000-0x000000000221D000-memory.dmp	upx
behavioral2/memory/4064-41-0x0000000002220000-0x000000000222D000-memory.dmp	upx
behavioral2/memory/4064-44-0x0000000010460000-0x000000001046D000-memory.dmp	upx
behavioral2/memory/4064-45-0x0000000010460000-0x000000001046D000-memory.dmp	upx
behavioral2/memory/4064-48-0x0000000010470000-0x000000001047D000-memory.dmp	upx
behavioral2/memory/4064-52-0x0000000010480000-0x000000001048D000-memory.dmp	upx
behavioral2/memory/4064-53-0x0000000010480000-0x000000001048D000-memory.dmp	upx
behavioral2/memory/4064-56-0x0000000010490000-0x000000001049D000-memory.dmp	upx
behavioral2/memory/4064-57-0x0000000010490000-0x000000001049D000-memory.dmp	upx
behavioral2/memory/4064-60-0x00000000104A0000-0x00000000104AD000-memory.dmp	upx
behavioral2/memory/4064-61-0x00000000104A0000-0x00000000104AD000-memory.dmp	upx
behavioral2/memory/4064-64-0x00000000104B0000-0x00000000104BD000-memory.dmp	upx
behavioral2/memory/4064-65-0x00000000104B0000-0x00000000104BD000-memory.dmp	upx
behavioral2/memory/4064-68-0x00000000104C0000-0x00000000104CD000-memory.dmp	upx
behavioral2/memory/4064-69-0x00000000104C0000-0x00000000104CD000-memory.dmp	upx
behavioral2/memory/4064-72-0x00000000104D0000-0x00000000104DD000-memory.dmp	upx
behavioral2/memory/4064-73-0x00000000104D0000-0x00000000104DD000-memory.dmp	upx
behavioral2/memory/4064-76-0x00000000104E0000-0x00000000104ED000-memory.dmp	upx
behavioral2/memory/4064-77-0x00000000104E0000-0x00000000104ED000-memory.dmp	upx
behavioral2/memory/4064-80-0x00000000104F0000-0x00000000104FD000-memory.dmp	upx
behavioral2/memory/4064-81-0x00000000104F0000-0x00000000104FD000-memory.dmp	upx
behavioral2/memory/4064-84-0x0000000010500000-0x000000001050D000-memory.dmp	upx
behavioral2/memory/4064-85-0x0000000010500000-0x000000001050D000-memory.dmp	upx
behavioral2/memory/4064-88-0x0000000010510000-0x000000001051D000-memory.dmp	upx
behavioral2/memory/4064-89-0x0000000010510000-0x000000001051D000-memory.dmp	upx
behavioral2/memory/4064-94-0x0000000002230000-0x000000000223D000-memory.dmp	upx
behavioral2/memory/4064-92-0x0000000002230000-0x000000000223D000-memory.dmp	upx
behavioral2/memory/4064-96-0x0000000010520000-0x000000001052D000-memory.dmp	upx
behavioral2/memory/4064-100-0x0000000010530000-0x000000001053D000-memory.dmp	upx
behavioral2/memory/4064-101-0x0000000010530000-0x000000001053D000-memory.dmp	upx
behavioral2/memory/4064-104-0x0000000010540000-0x000000001054D000-memory.dmp	upx
behavioral2/memory/4064-105-0x0000000010540000-0x000000001054D000-memory.dmp	upx
behavioral2/memory/4064-108-0x0000000010550000-0x000000001055D000-memory.dmp	upx
behavioral2/memory/4064-109-0x0000000010550000-0x000000001055D000-memory.dmp	upx
behavioral2/memory/4064-112-0x0000000010560000-0x000000001056D000-memory.dmp	upx
behavioral2/memory/4064-113-0x0000000010560000-0x000000001056D000-memory.dmp	upx
behavioral2/memory/4064-116-0x0000000010570000-0x000000001057D000-memory.dmp	upx
behavioral2/memory/4064-117-0x0000000010570000-0x000000001057D000-memory.dmp	upx
behavioral2/memory/4064-120-0x0000000010580000-0x000000001058D000-memory.dmp	upx
behavioral2/memory/4064-121-0x0000000010580000-0x000000001058D000-memory.dmp	upx
behavioral2/memory/4064-124-0x0000000010590000-0x000000001059D000-memory.dmp	upx
behavioral2/memory/4064-126-0x0000000010590000-0x000000001059D000-memory.dmp	upx
behavioral2/memory/4064-128-0x00000000105A0000-0x00000000105AD000-memory.dmp	upx
behavioral2/memory/4064-129-0x00000000105A0000-0x00000000105AD000-memory.dmp	upx
behavioral2/memory/4064-133-0x00000000105B0000-0x00000000105BD000-memory.dmp	upx
behavioral2/memory/4064-136-0x00000000105C0000-0x00000000105CD000-memory.dmp	upx
behavioral2/memory/4064-137-0x00000000105C0000-0x00000000105CD000-memory.dmp	upx
behavioral2/memory/4064-141-0x00000000105D0000-0x00000000105DD000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe
4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe
4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe
4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe
Token: SeDebugPrivilege	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe
Token: SeDebugPrivilege	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe
Token: SeDebugPrivilege	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 4092	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	89
PID 4064 wrote to memory of 4092	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	89
PID 4064 wrote to memory of 4092	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	89
PID 4064 wrote to memory of 740	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	5
PID 4064 wrote to memory of 740	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	5
PID 4064 wrote to memory of 940	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	8
PID 4064 wrote to memory of 940	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	8
PID 4064 wrote to memory of 984	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	9
PID 4064 wrote to memory of 984	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	9
PID 4064 wrote to memory of 992	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	10
PID 4064 wrote to memory of 992	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	10
PID 4064 wrote to memory of 1000	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	11
PID 4064 wrote to memory of 1000	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	11
PID 4064 wrote to memory of 428	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	12
PID 4064 wrote to memory of 428	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	12
PID 4064 wrote to memory of 1028	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	13
PID 4064 wrote to memory of 1028	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	13
PID 4064 wrote to memory of 1092	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	14
PID 4064 wrote to memory of 1092	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	14
PID 4064 wrote to memory of 1112	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	15
PID 4064 wrote to memory of 1112	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	15
PID 4064 wrote to memory of 1132	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	16
PID 4064 wrote to memory of 1132	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	16
PID 4064 wrote to memory of 1160	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	17
PID 4064 wrote to memory of 1160	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	17
PID 4064 wrote to memory of 1228	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	18
PID 4064 wrote to memory of 1228	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	18
PID 4064 wrote to memory of 1248	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	19
PID 4064 wrote to memory of 1248	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	19
PID 4064 wrote to memory of 1416	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	21
PID 4064 wrote to memory of 1416	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	21
PID 4064 wrote to memory of 1436	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	22
PID 4064 wrote to memory of 1436	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	22
PID 4064 wrote to memory of 1444	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	23
PID 4064 wrote to memory of 1444	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	23
PID 4064 wrote to memory of 1452	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	24
PID 4064 wrote to memory of 1452	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	24
PID 4064 wrote to memory of 1532	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	25
PID 4064 wrote to memory of 1532	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	25
PID 4064 wrote to memory of 1672	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	26
PID 4064 wrote to memory of 1672	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	26
PID 4064 wrote to memory of 1756	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	27
PID 4064 wrote to memory of 1756	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	27
PID 4064 wrote to memory of 1936	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	28
PID 4064 wrote to memory of 1936	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	28
PID 4064 wrote to memory of 1984	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	29
PID 4064 wrote to memory of 1984	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	29
PID 4064 wrote to memory of 1992	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	30
PID 4064 wrote to memory of 1992	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	30
PID 4064 wrote to memory of 2036	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	31
PID 4064 wrote to memory of 2036	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	31
PID 4064 wrote to memory of 2140	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	32
PID 4064 wrote to memory of 2140	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	32
PID 4064 wrote to memory of 2184	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	33
PID 4064 wrote to memory of 2184	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	33
PID 4064 wrote to memory of 2228	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	34
PID 4064 wrote to memory of 2228	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	34
PID 4064 wrote to memory of 2328	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	35
PID 4064 wrote to memory of 2328	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	35
PID 4064 wrote to memory of 2384	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	36
PID 4064 wrote to memory of 2384	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	36
PID 4064 wrote to memory of 2496	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	37
PID 4064 wrote to memory of 2496	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	37
PID 4064 wrote to memory of 2632	4064	jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe	38

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:740
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:984
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:940
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4360
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4416
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4200
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
  2⤵
  PID:5176
- C:\Windows\System32\smartscreen.exe
  C:\Windows\System32\smartscreen.exe -Embedding
  2⤵
  PID:5248
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
  2⤵
  PID:2172
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:4056

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:992

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-295afe24-1446-474a-a86b-5ec6355c67a9 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-306c9969-015d-4a55-a824-4c64ff8393c0 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-a70830f6-31df-4aaa-9b7b-3ab27b64b289 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-d31bf3d1-080f-4d70-9287-c75ef2d43748 -LifetimeId:d81457b1-8c88-45cf-87f7-420796d4f057 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:1000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1092

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1228

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1532

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:2036
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:5268
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    PID:1468
  - - C:\Users\Admin\AppData\Local\Temp\jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe
      "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_680c7da044f652271627138062d91209d6d795c8a63ba2c4a0fd88b5e0c81523.exe"
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2184

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2228

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2384

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2496
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000268;000000000000026C;
  2⤵
  PID:5032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2848

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2920

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:3032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:8

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3096

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:3324

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3584

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:3624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:1904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4568

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:5292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3680

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2080

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4064-0-0x0000000010410000-0x0000000010443000-memory.dmp

Download

memory/4064-1-0x0000000010410000-0x0000000010443000-memory.dmp

Download

memory/4064-4-0x00000000008F0000-0x00000000008FD000-memory.dmp

Download

memory/4064-8-0x0000000000900000-0x000000000090D000-memory.dmp

Download

memory/4064-12-0x0000000000910000-0x000000000091D000-memory.dmp

Download

memory/4064-13-0x0000000000910000-0x000000000091D000-memory.dmp

Download

memory/4064-16-0x0000000000920000-0x000000000092D000-memory.dmp

Download

memory/4064-17-0x0000000000920000-0x000000000092D000-memory.dmp

Download

memory/4064-21-0x0000000000930000-0x000000000093D000-memory.dmp

Download

memory/4064-20-0x0000000000930000-0x000000000093D000-memory.dmp

Download

memory/4064-25-0x0000000000940000-0x000000000094D000-memory.dmp

Download

memory/4064-24-0x0000000000940000-0x000000000094D000-memory.dmp

Download

memory/4064-28-0x0000000000950000-0x000000000095D000-memory.dmp

Download

memory/4064-29-0x0000000000950000-0x000000000095D000-memory.dmp

Download

memory/4064-33-0x0000000010450000-0x000000001045D000-memory.dmp

Download

memory/4064-36-0x0000000002210000-0x000000000221D000-memory.dmp

Download

memory/4064-37-0x0000000002210000-0x000000000221D000-memory.dmp

Download

memory/4064-41-0x0000000002220000-0x000000000222D000-memory.dmp

Download

memory/4064-44-0x0000000010460000-0x000000001046D000-memory.dmp

Download

memory/4064-45-0x0000000010460000-0x000000001046D000-memory.dmp

Download

memory/4064-48-0x0000000010470000-0x000000001047D000-memory.dmp

Download

memory/4064-52-0x0000000010480000-0x000000001048D000-memory.dmp

Download

memory/4064-53-0x0000000010480000-0x000000001048D000-memory.dmp

Download

memory/4064-56-0x0000000010490000-0x000000001049D000-memory.dmp

Download

memory/4064-57-0x0000000010490000-0x000000001049D000-memory.dmp

Download

memory/4064-60-0x00000000104A0000-0x00000000104AD000-memory.dmp

Download

memory/4064-61-0x00000000104A0000-0x00000000104AD000-memory.dmp

Download

memory/4064-64-0x00000000104B0000-0x00000000104BD000-memory.dmp

Download

memory/4064-65-0x00000000104B0000-0x00000000104BD000-memory.dmp

Download

memory/4064-68-0x00000000104C0000-0x00000000104CD000-memory.dmp

Download

memory/4064-69-0x00000000104C0000-0x00000000104CD000-memory.dmp

Download

memory/4064-72-0x00000000104D0000-0x00000000104DD000-memory.dmp

Download

memory/4064-73-0x00000000104D0000-0x00000000104DD000-memory.dmp

Download

memory/4064-76-0x00000000104E0000-0x00000000104ED000-memory.dmp

Download

memory/4064-77-0x00000000104E0000-0x00000000104ED000-memory.dmp

Download

memory/4064-80-0x00000000104F0000-0x00000000104FD000-memory.dmp

Download

memory/4064-81-0x00000000104F0000-0x00000000104FD000-memory.dmp

Download

memory/4064-84-0x0000000010500000-0x000000001050D000-memory.dmp

Download

memory/4064-85-0x0000000010500000-0x000000001050D000-memory.dmp

Download

memory/4064-88-0x0000000010510000-0x000000001051D000-memory.dmp

Download

memory/4064-89-0x0000000010510000-0x000000001051D000-memory.dmp

Download

memory/4064-94-0x0000000002230000-0x000000000223D000-memory.dmp

Download

memory/4064-92-0x0000000002230000-0x000000000223D000-memory.dmp

Download

memory/4064-96-0x0000000010520000-0x000000001052D000-memory.dmp

Download

memory/4064-100-0x0000000010530000-0x000000001053D000-memory.dmp

Download

memory/4064-101-0x0000000010530000-0x000000001053D000-memory.dmp

Download

memory/4064-104-0x0000000010540000-0x000000001054D000-memory.dmp

Download

memory/4064-105-0x0000000010540000-0x000000001054D000-memory.dmp

Download

memory/4064-108-0x0000000010550000-0x000000001055D000-memory.dmp

Download

memory/4064-109-0x0000000010550000-0x000000001055D000-memory.dmp

Download

memory/4064-112-0x0000000010560000-0x000000001056D000-memory.dmp

Download

memory/4064-113-0x0000000010560000-0x000000001056D000-memory.dmp

Download

memory/4064-116-0x0000000010570000-0x000000001057D000-memory.dmp

Download

memory/4064-117-0x0000000010570000-0x000000001057D000-memory.dmp

Download

memory/4064-120-0x0000000010580000-0x000000001058D000-memory.dmp

Download

memory/4064-121-0x0000000010580000-0x000000001058D000-memory.dmp

Download

memory/4064-124-0x0000000010590000-0x000000001059D000-memory.dmp

Download

memory/4064-126-0x0000000010590000-0x000000001059D000-memory.dmp

Download

memory/4064-128-0x00000000105A0000-0x00000000105AD000-memory.dmp

Download

memory/4064-129-0x00000000105A0000-0x00000000105AD000-memory.dmp

Download

memory/4064-133-0x00000000105B0000-0x00000000105BD000-memory.dmp

Download

memory/4064-136-0x00000000105C0000-0x00000000105CD000-memory.dmp

Download

memory/4064-137-0x00000000105C0000-0x00000000105CD000-memory.dmp

Download

memory/4064-141-0x00000000105D0000-0x00000000105DD000-memory.dmp

Download