3e96d42eaa9d21ccbbb570bfc72c0e2bda0597ea7c2f9772fdf61644934f387e

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Agent.bjromq.exe
Size 38KB
Sample261006-ssftwsfd48
SHA256 3e96d42eaa9d21ccbbb570bfc72c0e2bda0597ea7c2f9772fdf61644934f387e
MD5 395058aabed60b79d49c2107143a2fa8
SHA1 37f09cb35895d5e14427bb20a50421e6b230e657
SHA512 657352def13730e7a7e4b01b8829d0b137cf94c5fd80c2e9325000c5c5ca78f4f9f0ddd826147905235c3dcf67f15cef5079c10e28b53b20c12cdcb6a8f98bc0
SSDEEP 768:URGuY2P0Vo6r7SiAwyrMRjbaCIerkQffy3YqeEOpYvjoBqpnbcuyD7UvkR:yPcVo6r7S/rab0yi34lYvjNnouy8
TLSH
T13D03F1D7F3A4022CC12E55B681BBFB5E268CDB96860249A592DCBC365C73F510D0C5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation upx

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\swc1 = "C:\\Windows\\system\\serv¡ces.exe"	servíces.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sw1 = "C:\\Windows\\SYSTEM\\servíces"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	servíces.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2532	netsh.exe
2728	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
5892	servíces.exe

Loads dropped DLL 2 IoCs

pid	Process
1652	regsvr32.exe
2636	regsvr32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/6056-0-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral2/memory/6056-20-0x0000000000400000-0x0000000000424000-memory.dmp	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM\servíces.exe	cmd.exe
File opened for modification	C:\Windows\system\filelog.log:secret.txt	servíces.exe
File created	C:\Windows\SYSTEM\svchost.dll	cmd.exe
File opened for modification	C:\Windows\SYSTEM\svchost.dll	cmd.exe
File created	C:\Windows\SYSTEM\servíces.exe	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5772	cmd.exe
5620	cmd.exe
4304	cmd.exe
1192	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Agent.bjromq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	servíces.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{011A0B95-3A61-467A-862C-7543369C19C8}\VERSION	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\svchost.Class1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C9DEA40-4AFB-4C46-B990-D81DF51BAD72}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C9DEA40-4AFB-4C46-B990-D81DF51BAD72}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{011A0B95-3A61-467A-862C-7543369C19C8}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C9DEA40-4AFB-4C46-B990-D81DF51BAD72}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C9DEA40-4AFB-4C46-B990-D81DF51BAD72}\TypeLib\Version = "3.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{011A0B95-3A61-467A-862C-7543369C19C8}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{011A0B95-3A61-467A-862C-7543369C19C8}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\svchost.Class1\Clsid\ = "{011A0B95-3A61-467A-862C-7543369C19C8}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C9DEA40-4AFB-4C46-B990-D81DF51BAD72}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C9DEA40-4AFB-4C46-B990-D81DF51BAD72}\ = "_Class1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{011A0B95-3A61-467A-862C-7543369C19C8}\TypeLib\ = "{7A2617C0-0AE5-4FF8-B6EA-F0EFDF1A7CA2}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{011A0B95-3A61-467A-862C-7543369C19C8}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C9DEA40-4AFB-4C46-B990-D81DF51BAD72}\ = "_Class1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{011A0B95-3A61-467A-862C-7543369C19C8}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{011A0B95-3A61-467A-862C-7543369C19C8}\VERSION\ = "3.0"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\svchost.Class1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7A2617C0-0AE5-4FF8-B6EA-F0EFDF1A7CA2}\3.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{011A0B95-3A61-467A-862C-7543369C19C8}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{011A0B95-3A61-467A-862C-7543369C19C8}\InprocServer32\ = "C:\\Windows\\SYSTEM\\svchost.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{011A0B95-3A61-467A-862C-7543369C19C8}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{011A0B95-3A61-467A-862C-7543369C19C8}\TypeLib\ = "{7A2617C0-0AE5-4FF8-B6EA-F0EFDF1A7CA2}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C9DEA40-4AFB-4C46-B990-D81DF51BAD72}\ = "Class1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C9DEA40-4AFB-4C46-B990-D81DF51BAD72}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C9DEA40-4AFB-4C46-B990-D81DF51BAD72}\ = "_Class1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C9DEA40-4AFB-4C46-B990-D81DF51BAD72}\TypeLib\ = "{7A2617C0-0AE5-4FF8-B6EA-F0EFDF1A7CA2}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C9DEA40-4AFB-4C46-B990-D81DF51BAD72}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{011A0B95-3A61-467A-862C-7543369C19C8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{011A0B95-3A61-467A-862C-7543369C19C8}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7A2617C0-0AE5-4FF8-B6EA-F0EFDF1A7CA2}\3.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{011A0B95-3A61-467A-862C-7543369C19C8}\VERSION	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{011A0B95-3A61-467A-862C-7543369C19C8}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7A2617C0-0AE5-4FF8-B6EA-F0EFDF1A7CA2}\3.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7A2617C0-0AE5-4FF8-B6EA-F0EFDF1A7CA2}\3.0\HELPDIR\ = "C:\\Windows\\SYSTEM"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C9DEA40-4AFB-4C46-B990-D81DF51BAD72}\TypeLib\ = "{7A2617C0-0AE5-4FF8-B6EA-F0EFDF1A7CA2}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C9DEA40-4AFB-4C46-B990-D81DF51BAD72}\TypeLib\Version = "3.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{011A0B95-3A61-467A-862C-7543369C19C8}\InprocServer32\ = "C:\\Windows\\SYSTEM\\svchost.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C9DEA40-4AFB-4C46-B990-D81DF51BAD72}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{011A0B95-3A61-467A-862C-7543369C19C8}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{011A0B95-3A61-467A-862C-7543369C19C8}\ = "svchost.Class1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{011A0B95-3A61-467A-862C-7543369C19C8}\ProgID\ = "svchost.Class1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\svchost.Class1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C9DEA40-4AFB-4C46-B990-D81DF51BAD72}\ = "Class1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C9DEA40-4AFB-4C46-B990-D81DF51BAD72}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7A2617C0-0AE5-4FF8-B6EA-F0EFDF1A7CA2}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7A2617C0-0AE5-4FF8-B6EA-F0EFDF1A7CA2}\3.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7A2617C0-0AE5-4FF8-B6EA-F0EFDF1A7CA2}\3.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C9DEA40-4AFB-4C46-B990-D81DF51BAD72}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{011A0B95-3A61-467A-862C-7543369C19C8}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{011A0B95-3A61-467A-862C-7543369C19C8}\VERSION\ = "3.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{011A0B95-3A61-467A-862C-7543369C19C8}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{011A0B95-3A61-467A-862C-7543369C19C8}\ = "svchost.Class1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C9DEA40-4AFB-4C46-B990-D81DF51BAD72}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\svchost.Class1\ = "svchost.Class1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{011A0B95-3A61-467A-862C-7543369C19C8}\ProgID\ = "svchost.Class1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{011A0B95-3A61-467A-862C-7543369C19C8}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\svchost.Class1\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\svchost.Class1\Clsid\ = "{011A0B95-3A61-467A-862C-7543369C19C8}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7A2617C0-0AE5-4FF8-B6EA-F0EFDF1A7CA2}\3.0\0\win32\ = "C:\\Windows\\SYSTEM\\svchost.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C9DEA40-4AFB-4C46-B990-D81DF51BAD72}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C9DEA40-4AFB-4C46-B990-D81DF51BAD72}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{011A0B95-3A61-467A-862C-7543369C19C8}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\svchost.Class1\ = "svchost.Class1"	regsvr32.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\filelog.log:secret.txt	servíces.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5892	servíces.exe
5892	servíces.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 6056 wrote to memory of 5772	6056	jaffacakes118_Trojan-Dropper.Win32.Agent.bjromq.exe	89
PID 5772 wrote to memory of 1652	5772	cmd.exe	91
PID 5772 wrote to memory of 5112	5772	cmd.exe	92
PID 5772 wrote to memory of 5892	5772	cmd.exe	93
PID 5892 wrote to memory of 5620	5892	servíces.exe	94
PID 5892 wrote to memory of 4304	5892	servíces.exe	95
PID 5892 wrote to memory of 1192	5892	servíces.exe	96
PID 5620 wrote to memory of 2636	5620	cmd.exe	100
PID 1192 wrote to memory of 2728	1192	cmd.exe	101
PID 4304 wrote to memory of 2532	4304	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.bjromq.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.bjromq.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\C2AF.tmp\sc.bat" "
  2⤵
  - Drops file in Windows directory
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5772
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 C:\Windows\SYSTEM\svchost.dll /s-
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1652
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v sw1 /t REG_SZ /d C:\Windows\SYSTEM\servíces /f
    3⤵
    - Adds policy Run key to start application
    - System Location Discovery: System Language Discovery
    PID:5112
- - C:\Windows\SYSTEM\servíces.exe
    C:\Windows\SYSTEM\servíces.exe
    3⤵
    - Adds policy Run key to start application
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5892
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c regsvr32/s %SYSTEMROOT%\SYSTEM\svchost.dll
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5620
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s C:\Windows\SYSTEM\svchost.dll
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2636
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c netsh firewall add portopening protocol=TCP port=21 name="RPC (TCP/21)" mode=ENABLE scope=ALL
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4304
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add portopening protocol=TCP port=21 name="RPC (TCP/21)" mode=ENABLE scope=ALL
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:2532
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c netsh firewall add allowedprogram program="C:\Windows\system\serv¡ces.exe" name="Service" scope=ALL
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1192
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram program="C:\Windows\system\serv¡ces.exe" name="Service" scope=ALL
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:2728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

isa

Path C:\Users\Admin\AppData\Local\Temp\C2AF.tmp\isa
Size 28KB
SHA256 78ca880145faefe5c7cacbcc6fa8fed3dc53bd28d7e7266e45e9cbe324dec35c
MD5 b9942a1d6a3c881ec2039d92b536352d
SHA1 9f195ac58ddd383ca5c96d742bfd93557ee6d92a
SHA512 9e500d0fe7e46331f9ba86dac872f63f7463103059e2541584e21d27f8554c4773aa62b653442862308e2bf9ba74f5e87f1461a7f3e2d742a237d428d4cd40e6
SSDEEP 192:uKX+Xs5lsXGBkqjuHdqPTj+J3t+0TyoDH04XAG5Aevc9yRj9:Hks55Bkqju9c+RNDH04v52
TLSH
T1ABD25016B6E9D22DF19805B52A2396CF48587D710FC2C5AFBB6AF70C2E3065195B0F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

isa0

Path C:\Users\Admin\AppData\Local\Temp\C2AF.tmp\isa0
Size 40KB
SHA256 46e34ad58fe4ef4e68a75f94561b0ed5ef1c731acb729b5efa119c633be4ae03
MD5 3a6d069b4fa93ebcd7af93985350d99c
SHA1 fb2d7f23f7669f5951a9565ac5fb5e97d426a5a4
SHA512 71bf4514c719d4b9a34c0d52a57d75d118769da6d1bdf444b8b1e2755efcaf53fd041414a1394c1652ac75c9239f570d2bac2cc171347930410bcc8468b43721
SSDEEP 768:LOdxzKSk0kbmzTEgSBIsINJgwfK+hx+7r:a0CkbmcLYi+Hur
TLSH
T19B0374A2A53BD12AE184C6F51865424539273F305393DD1BAB4B6A1C2A337D3B4F331B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sc.bat

Path C:\Users\Admin\AppData\Local\Temp\C2AF.tmp\sc.bat
Size 310B
SHA256 3d205b665283b40eaf3e8257d525cb2c0202e82135af5339e968dc74f4d76fbb
MD5 a0f7c76e494764081f5d1d996bc52be0
SHA1 a1906a2686b6389ca6666efc17c6f713610d3fcb
SHA512 435041e5f59536e68ef754104d0f9114f136ffd86c28ceee147c1bdf9844a6c7d9cf91f205c14a7b8ddf94066536aed0710b898e9e85a32572f8d44c443141e9
TLSH
T19BE0863050C781715250508C8E07640F23ADF5B2E178C7D43286245431CDBC17D2F681
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6056-0-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/6056-20-0x0000000000400000-0x0000000000424000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads