921cc929e7ae4f06c12288b306c43d19794c457ef821c031a396d746624034b5

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Agent.le.exe
Size 124KB
Sample261006-thephsds6m
SHA256 921cc929e7ae4f06c12288b306c43d19794c457ef821c031a396d746624034b5
MD5 c6069a6227dd6d055c97a386e7bbb8d4
SHA1 1a3ebc016590cfd194f6b821c7c72ebf5bd93e8a
SHA512 5bc7300d6deccc53d708706f205c8308960a7a5b8dd011e329c5ebfb6a8a1d8cb7e6d4b5d81fceee38ed13605abde625a0e45e23bd18100bc9dcd0ca74190dd9
SSDEEP 3072:NzeeL3QS/IASHHVK0271pRQzkfqDWslirVB9GvnDiS2dj8:x3RbSn0f7Gztdkz9y8
TLSH
T13EC31241D478C5B2E5A576798615B8401A607444B3BBA348CF4EF5CB3C3F2427EBCAAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2116	rs.exe
1376	rotr.exe

Loads dropped DLL 3 IoCs

pid	Process
3252	regsvr32.exe
780	jaffacakes118_Trojan-Dropper.Win32.Agent.le.exe
5508	regsvr32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ieuu = "C:\\Users\\Admin\\AppData\\Roaming\\rotr.exe"	rs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ieuu = "C:\\Users\\Admin\\AppData\\Roaming\\rotr.exe"	rotr.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/780-0-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral2/files/0x000d00000001c5bc-21.dat	upx
behavioral2/memory/2116-22-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/2116-31-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/780-43-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral2/memory/780-45-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral2/memory/1376-46-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/1376-47-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/780-48-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral2/memory/1376-49-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/1376-50-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/1376-51-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/1376-52-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/1376-53-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/1376-54-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/1376-55-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/1376-56-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/1376-57-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/1376-58-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/1376-59-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/1376-60-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/1376-61-0x0000000000400000-0x0000000000433000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1152	780	WerFault.exe	87

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rotr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Trojan-Dropper.Win32.Agent.le.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_Trojan-Dropper.Win32.Agent.le.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rotr.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Agent.le.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rotr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46605C8C-D306-4E2D-B367-9B53690CB867}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{81EB72D7-3949-450F-B035-DE599959814F}\TypeLib\ = "{46605C8C-D306-4E2D-B367-9B53690CB867}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EB320CE-BE1D-4304-A081-4B4665414BEF}\MiscStatus	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46605C8C-D306-4E2D-B367-9B53690CB867}\1.0	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EB320CE-BE1D-4304-A081-4B4665414BEF}\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EB320CE-BE1D-4304-A081-4B4665414BEF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EB320CE-BE1D-4304-A081-4B4665414BEF}\ProgID\ = "MEDIATICKETSINSTALLER.MediaTicketsInstallerCtrl.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{81EB72D7-3949-450F-B035-DE599959814F}\ = "_DMediaTicketsInstaller"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E4C3E0B-6BBE-4C94-86CA-6F055A989693}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MEDIATICKETSINSTALLER.MediaTicketsInstallerCtrl.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EB320CE-BE1D-4304-A081-4B4665414BEF}\TypeLib\ = "{46605C8C-D306-4E2D-B367-9B53690CB867}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46605C8C-D306-4E2D-B367-9B53690CB867}\1.0\HELPDIR	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46605C8C-D306-4E2D-B367-9B53690CB867}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46605C8C-D306-4E2D-B367-9B53690CB867}\1.0\FLAGS\ = "2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{81EB72D7-3949-450F-B035-DE599959814F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{81EB72D7-3949-450F-B035-DE599959814F}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{81EB72D7-3949-450F-B035-DE599959814F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E4C3E0B-6BBE-4C94-86CA-6F055A989693}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E4C3E0B-6BBE-4C94-86CA-6F055A989693}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EB320CE-BE1D-4304-A081-4B4665414BEF}\ToolboxBitmap32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46605C8C-D306-4E2D-B367-9B53690CB867}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46605C8C-D306-4E2D-B367-9B53690CB867}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EB320CE-BE1D-4304-A081-4B4665414BEF}\ = "MediaTicketsInstaller Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EB320CE-BE1D-4304-A081-4B4665414BEF}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EB320CE-BE1D-4304-A081-4B4665414BEF}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{81EB72D7-3949-450F-B035-DE599959814F}\ProxyStubClsid32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39DA2444-065F-47CB-B27C-CCB1A39C06B7}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EB320CE-BE1D-4304-A081-4B4665414BEF}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46605C8C-D306-4E2D-B367-9B53690CB867}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MediaTicketsInstaller.ocx"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E4C3E0B-6BBE-4C94-86CA-6F055A989693}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EB320CE-BE1D-4304-A081-4B4665414BEF}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EB320CE-BE1D-4304-A081-4B4665414BEF}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MEDIAT~1.OCX"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EB320CE-BE1D-4304-A081-4B4665414BEF}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46605C8C-D306-4E2D-B367-9B53690CB867}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46605C8C-D306-4E2D-B367-9B53690CB867}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{81EB72D7-3949-450F-B035-DE599959814F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{81EB72D7-3949-450F-B035-DE599959814F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EB320CE-BE1D-4304-A081-4B4665414BEF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46605C8C-D306-4E2D-B367-9B53690CB867}\1.0\ = "MediaTicketsInstaller ActiveX Control module"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{81EB72D7-3949-450F-B035-DE599959814F}\ = "_DMediaTicketsInstaller"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EB320CE-BE1D-4304-A081-4B4665414BEF}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E4C3E0B-6BBE-4C94-86CA-6F055A989693}\ProxyStubClsid32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E4C3E0B-6BBE-4C94-86CA-6F055A989693}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E4C3E0B-6BBE-4C94-86CA-6F055A989693}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39DA2444-065F-47CB-B27C-CCB1A39C06B7}\ = "MediaTicketsInstaller Property Page"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EB320CE-BE1D-4304-A081-4B4665414BEF}\Version\ = "1.0"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46605C8C-D306-4E2D-B367-9B53690CB867}\1.0\0	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EB320CE-BE1D-4304-A081-4B4665414BEF}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{81EB72D7-3949-450F-B035-DE599959814F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{81EB72D7-3949-450F-B035-DE599959814F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E4C3E0B-6BBE-4C94-86CA-6F055A989693}\ = "_DMediaTicketsInstallerEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E4C3E0B-6BBE-4C94-86CA-6F055A989693}\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EB320CE-BE1D-4304-A081-4B4665414BEF}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{46605C8C-D306-4E2D-B367-9B53690CB867}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{81EB72D7-3949-450F-B035-DE599959814F}\TypeLib\ = "{46605C8C-D306-4E2D-B367-9B53690CB867}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39DA2444-065F-47CB-B27C-CCB1A39C06B7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MEDIAT~1.OCX"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MEDIATICKETSINSTALLER.MediaTicketsInstallerCtrl.1\ = "MediaTicketsInstaller Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EB320CE-BE1D-4304-A081-4B4665414BEF}\ToolboxBitmap32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EB320CE-BE1D-4304-A081-4B4665414BEF}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MEDIAT~1.OCX, 1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EB320CE-BE1D-4304-A081-4B4665414BEF}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EB320CE-BE1D-4304-A081-4B4665414BEF}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EB320CE-BE1D-4304-A081-4B4665414BEF}\MiscStatus\1	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	780	jaffacakes118_Trojan-Dropper.Win32.Agent.le.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 3252	780	jaffacakes118_Trojan-Dropper.Win32.Agent.le.exe	89
PID 780 wrote to memory of 2116	780	jaffacakes118_Trojan-Dropper.Win32.Agent.le.exe	90
PID 2116 wrote to memory of 1376	2116	rs.exe	92
PID 780 wrote to memory of 5508	780	jaffacakes118_Trojan-Dropper.Win32.Agent.le.exe	93
PID 780 wrote to memory of 1388	780	jaffacakes118_Trojan-Dropper.Win32.Agent.le.exe	94

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.le.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.le.exe"
1⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s C:\Users\Admin\AppData\Local\Temp\MediaTicketsInstaller.ocx
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:3252
- C:\Users\Admin\AppData\Local\Temp\rs.exe
  C:\Users\Admin\AppData\Local\Temp\rs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Users\Admin\AppData\Roaming\rotr.exe
    C:\Users\Admin\AppData\Roaming\rotr.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:1376
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s /u C:\Users\Admin\AppData\Local\Temp\MediaTicketsInstaller.ocx
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:5508
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE C:\Users\Admin\AppData\Local\Temp\MediaTicketsInstaller.ocx > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 1372
  2⤵
  - Program crash
  PID:1152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 780 -ip 780
1⤵
PID:2260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MediaTicketsInstaller.ocx

Path C:\Users\Admin\AppData\Local\Temp\MediaTicketsInstaller.ocx
Size 132KB
SHA256 05ac09d1c109aaaf7b43e2258218c6d52dd66c09598f1202a9b3b56c8acae965
MD5 955ad151107bba1f54d7540003d334d6
SHA1 485d38d43a7300ed395015b65fc134c6587fa303
SHA512 3efc7e81894750f8b18fe1dedc0c6008be20449a52d528fc889b84739c2d890cb25c9f45bd8fc730d59cf71b687bfc3a6446f1c2d4f01e3badea9a2005d2510b
SSDEEP 3072:pnWHSNTfr8Yv6tiXIkvxTAJP98xh+QnRGzclQzeQ2Vj0+YXx4:IHSNDr8c6t4pMsxVGgQ4Ax
TLSH
T12AD3D012F37189A1C2BE013C693B4B681674BC23DDE5958B1F69768E1C32553EE3832E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axldeb.txt

Path C:\Users\Admin\AppData\Local\Temp\axldeb.txt
Size 177B
SHA256 e5c7014b3082c6c455ab551f808573c2ca99bc22f73a1ebb24ea8d51ccc8abf7
MD5 65ab0082882e4a63d004598d1945476c
SHA1 c7571b20f17ad250de2aa1da7e76c2beb8e88f8e
SHA512 3cf7f3a2c2e0093684c40725d4f0aef8cd0f8d1536a72e1177734085413bcc645c17a1fc4c4dc8304e372776f80af056fd2b05122dee6764d314f87d20eba605
TLSH
T167C08C157F0809A08A82CBB0E2603B25E291A025AA29C03E0283BEA020AC16F600E03A
MD5 SHA1 SHA512 TLSH

Submit Download

rs.exe

Path C:\Users\Admin\AppData\Local\Temp\rs.exe
Size 78KB
SHA256 c303c57d8e1a3460aa24f62dce32171b6c6ee7d59db4133c22b9eb96f8024f4e
MD5 f47cdd71f583450ae2530c7cb047b334
SHA1 152fbe9f9896e352856527ef7da94ea156469c24
SHA512 c9449b7bc4f15569e390fc8168d614612c2096d5f67b52b831940a4d38c4a70cc7455c1a22c7dd309e4b059c7dd654ef25ade315e51fc3312ccd365b31337324
SSDEEP 1536:WYv6USiwCIkvxbPAJPp78g6PAa+mLnCDlFOGzdWlpSzsxxSjaVj0+fQiLq:WYv6tiXIkvxTAJP98xh+QnRGzclQzeQv
TLSH
T1957312A3A564DD73D87680751235301A2EA0E835E3FE7B851F6CE18F7C381955C7CA8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/780-45-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/780-0-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/780-48-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/780-43-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/1376-50-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1376-58-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1376-47-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1376-61-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1376-49-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1376-60-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1376-51-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1376-52-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1376-53-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1376-54-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1376-55-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1376-56-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1376-57-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1376-46-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1376-59-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2116-22-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2116-31-0x0000000000400000-0x0000000000433000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads