817ee992b58dd818e520add5e18fd987c73c923cd88fa9278ccb215ed23769c4

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Small.cl.exe
Size 37KB
Sample261009-ylssrsszet
SHA256 817ee992b58dd818e520add5e18fd987c73c923cd88fa9278ccb215ed23769c4
MD5 7b6df98a0e14209e7bfa6bf7167c1b28
SHA1 89fba0683d85223b7ae3ef3e70b81608c079cfd2
SHA512 f378e46d7305943edbfaf53f9cbf0dbc330a9019b6f6ac7e98eb9710945c61b43419f9b9523856c2ed93d6eccd0a7daff89ed6078f6471b2aa01fa08bf1f1d6a
SSDEEP 768:BF+w4WOjxS2azBKRsR/WcWcWn6MrjRUJxUZffox6TvKH87L4z7e:Hx4WO1SXKRsRtblk9U6fFyH87UG
TLSH
T15B03F18E6B23E426D184403AA305EB3BB71EB3A5C6F7F159065E885530F2DB374985E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5980	system.exe
3720	svchosts.exe
4460	svchostc.exe
4932	wingua.exe
5928	mserv.exe
4924	svchostc.exe
1664	wingua.exe
2460	mserv.exe
2156	svchostc.exe
4624	wingua.exe
4268	mserv.exe
4672	svchostc.exe
4472	wingua.exe
4996	mserv.exe
672	svchostc.exe
2652	wingua.exe
5532	mserv.exe
5784	svchostc.exe
3776	wingua.exe
720	mserv.exe
1724	svchostc.exe
2544	wingua.exe
1476	mserv.exe
4400	svchostc.exe
5132	wingua.exe
1420	mserv.exe
5740	svchostc.exe
1460	wingua.exe
2104	mserv.exe
1140	svchostc.exe
3428	wingua.exe
5780	mserv.exe
2984	svchostc.exe
1136	wingua.exe
5468	mserv.exe
1080	svchostc.exe
5296	wingua.exe
2876	mserv.exe
3124	svchostc.exe
2760	wingua.exe
5056	mserv.exe
5380	svchostc.exe
2688	wingua.exe
4636	mserv.exe
2720	svchostc.exe
4916	wingua.exe
1176	mserv.exe
5440	svchostc.exe
2840	wingua.exe
3580	mserv.exe
2392	svchostc.exe
2516	wingua.exe
5868	mserv.exe
3280	svchostc.exe
4624	wingua.exe
4552	mserv.exe
208	svchostc.exe
2472	wingua.exe
3416	mserv.exe
5272	svchostc.exe
4172	wingua.exe
5596	mserv.exe
1360	svchostc.exe
200	wingua.exe

Loads dropped DLL 1 IoCs

pid	Process
5980	system.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Online Service = "C:\\Windows\\system.exe"	jaffacakes118_Trojan-Dropper.Win32.Small.cl.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\svchosts.exe	jaffacakes118_Trojan-Dropper.Win32.Small.cl.exe
File created	C:\Windows\SysWOW64\svchostc.exe	jaffacakes118_Trojan-Dropper.Win32.Small.cl.exe
File created	C:\Windows\SysWOW64\wingua.exe	jaffacakes118_Trojan-Dropper.Win32.Small.cl.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/984-0-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/984-11-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/files/0x000d00000001c45e-15.dat	upx
behavioral2/files/0x000d00000001c45f-17.dat	upx
behavioral2/memory/3720-18-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral2/memory/4460-20-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/files/0x000d00000001c460-22.dat	upx
behavioral2/memory/4932-24-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4932-29-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4460-30-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/3720-33-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral2/memory/1664-37-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4924-38-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/4624-46-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2156-47-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/4472-54-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4672-55-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/2652-63-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/672-64-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/3776-70-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5784-71-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/2544-79-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1724-80-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/5132-87-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4400-88-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/1460-96-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5740-97-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/3428-104-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1140-105-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/1136-113-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2984-114-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/1080-121-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/2760-129-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3124-130-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/2688-137-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5380-138-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/4916-142-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2720-143-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/2840-146-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5440-148-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/2516-151-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2392-152-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/4624-156-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3280-157-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/2472-159-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/208-160-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/4172-163-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5272-164-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/2508-174-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4388-175-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/3932-179-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/6040-180-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/3916-183-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3824-187-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3312-188-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/5004-191-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1008-192-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/4104-195-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5316-196-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Drops file in Windows directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\mserv.exe	wingua.exe
File created	C:\Windows\msin32.dll	jaffacakes118_Trojan-Dropper.Win32.Small.cl.exe
File opened for modification	C:\Windows\mserv.exe	wingua.exe
File opened for modification	C:\Windows\mserv.exe	wingua.exe
File opened for modification	C:\Windows\mserv.exe	wingua.exe
File opened for modification	C:\Windows\mserv.exe	wingua.exe
File opened for modification	C:\Windows\mserv.exe	wingua.exe
File opened for modification	C:\Windows\mserv.exe	wingua.exe
File opened for modification	C:\Windows\sysini.ini	jaffacakes118_Trojan-Dropper.Win32.Small.cl.exe
File created	C:\Windows\mserv.exe	wingua.exe
File opened for modification	C:\Windows\mserv.exe	wingua.exe
File opened for modification	C:\Windows\mserv.exe	wingua.exe
File opened for modification	C:\Windows\mserv.exe	wingua.exe
File opened for modification	C:\Windows\mserv.exe	wingua.exe
File opened for modification	C:\Windows\mserv.exe	wingua.exe
File opened for modification	C:\Windows\mserv.exe	wingua.exe
File opened for modification	C:\Windows\mserv.exe	wingua.exe
File opened for modification	C:\Windows\mserv.exe	wingua.exe
File opened for modification	C:\Windows\mserv.exe	wingua.exe
File opened for modification	C:\Windows\mserv.exe	wingua.exe
File opened for modification	C:\Windows\mserv.exe	wingua.exe
File created	C:\Windows\system.exe	jaffacakes118_Trojan-Dropper.Win32.Small.cl.exe
File opened for modification	C:\Windows\sysini.ini	system.exe
File opened for modification	C:\Windows\mserv.exe	wingua.exe
File opened for modification	C:\Windows\mserv.exe	wingua.exe
File opened for modification	C:\Windows\mserv.exe	wingua.exe
File opened for modification	C:\Windows\mserv.exe	wingua.exe
File opened for modification	C:\Windows\mserv.exe	wingua.exe
File opened for modification	C:\Windows\mserv.exe	wingua.exe
File opened for modification	C:\Windows\mserv.exe	wingua.exe
File opened for modification	C:\Windows\mserv.exe	wingua.exe
File opened for modification	C:\Windows\mserv.exe	wingua.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	system.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	system.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchostc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wingua.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Small.cl.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
984	jaffacakes118_Trojan-Dropper.Win32.Small.cl.exe
984	jaffacakes118_Trojan-Dropper.Win32.Small.cl.exe
5980	system.exe
5980	system.exe
5980	system.exe
5980	system.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe
5928	mserv.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5980	system.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 5980	984	jaffacakes118_Trojan-Dropper.Win32.Small.cl.exe	89
PID 5980 wrote to memory of 3720	5980	system.exe	90
PID 5980 wrote to memory of 4460	5980	system.exe	91
PID 5980 wrote to memory of 4932	5980	system.exe	94
PID 5980 wrote to memory of 4924	5980	system.exe	96
PID 5980 wrote to memory of 1664	5980	system.exe	97
PID 5980 wrote to memory of 2156	5980	system.exe	100
PID 5980 wrote to memory of 4624	5980	system.exe	101
PID 5980 wrote to memory of 4672	5980	system.exe	104
PID 5980 wrote to memory of 4472	5980	system.exe	105
PID 5980 wrote to memory of 672	5980	system.exe	108
PID 5980 wrote to memory of 2652	5980	system.exe	109
PID 5980 wrote to memory of 5784	5980	system.exe	113
PID 5980 wrote to memory of 3776	5980	system.exe	114
PID 5980 wrote to memory of 1724	5980	system.exe	117
PID 5980 wrote to memory of 2544	5980	system.exe	118
PID 5980 wrote to memory of 4400	5980	system.exe	121
PID 5980 wrote to memory of 5132	5980	system.exe	122
PID 5980 wrote to memory of 5740	5980	system.exe	125
PID 5980 wrote to memory of 1460	5980	system.exe	126
PID 5980 wrote to memory of 1140	5980	system.exe	129
PID 5980 wrote to memory of 3428	5980	system.exe	130
PID 5980 wrote to memory of 2984	5980	system.exe	133
PID 5980 wrote to memory of 1136	5980	system.exe	134
PID 5980 wrote to memory of 1080	5980	system.exe	137
PID 5980 wrote to memory of 5296	5980	system.exe	138
PID 5980 wrote to memory of 3124	5980	system.exe	141
PID 5980 wrote to memory of 2760	5980	system.exe	142
PID 5980 wrote to memory of 5380	5980	system.exe	145
PID 5980 wrote to memory of 2688	5980	system.exe	146
PID 5980 wrote to memory of 2720	5980	system.exe	149
PID 5980 wrote to memory of 4916	5980	system.exe	150
PID 5980 wrote to memory of 5440	5980	system.exe	153
PID 5980 wrote to memory of 2840	5980	system.exe	154
PID 5980 wrote to memory of 2392	5980	system.exe	157
PID 5980 wrote to memory of 2516	5980	system.exe	158
PID 5980 wrote to memory of 3280	5980	system.exe	161
PID 5980 wrote to memory of 4624	5980	system.exe	162
PID 5980 wrote to memory of 208	5980	system.exe	165
PID 5980 wrote to memory of 2472	5980	system.exe	166
PID 5980 wrote to memory of 5272	5980	system.exe	169
PID 5980 wrote to memory of 4172	5980	system.exe	170
PID 5980 wrote to memory of 1360	5980	system.exe	173
PID 5980 wrote to memory of 200	5980	system.exe	174
PID 5980 wrote to memory of 3776	5980	system.exe	177
PID 5980 wrote to memory of 5952	5980	system.exe	178
PID 5980 wrote to memory of 4388	5980	system.exe	181
PID 5980 wrote to memory of 2508	5980	system.exe	182
PID 5980 wrote to memory of 6040	5980	system.exe	185
PID 5980 wrote to memory of 3932	5980	system.exe	186
PID 5980 wrote to memory of 1420	5980	system.exe	189
PID 5980 wrote to memory of 3916	5980	system.exe	190
PID 5980 wrote to memory of 3312	5980	system.exe	193
PID 5980 wrote to memory of 3824	5980	system.exe	194
PID 5980 wrote to memory of 1008	5980	system.exe	197
PID 5980 wrote to memory of 5004	5980	system.exe	198
PID 5980 wrote to memory of 5316	5980	system.exe	201
PID 5980 wrote to memory of 4104	5980	system.exe	202

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Small.cl.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Small.cl.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:984
- C:\Windows\system.exe
  C:\Windows\system.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5980
- - C:\Windows\SysWOW64\svchosts.exe
    svchosts.exe -p1200
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3720
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p1202
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4460
- - C:\Windows\SysWOW64\wingua.exe
    wingua.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4932
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p1202
    3⤵
    - Executes dropped EXE
    PID:4924
- - C:\Windows\SysWOW64\wingua.exe
    wingua.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1664
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p1202
    3⤵
    - Executes dropped EXE
    PID:2156
- - C:\Windows\SysWOW64\wingua.exe
    wingua.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:4624
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p1202
    3⤵
    - Executes dropped EXE
    PID:4672
- - C:\Windows\SysWOW64\wingua.exe
    wingua.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:4472
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p1202
    3⤵
    - Executes dropped EXE
    PID:672
- - C:\Windows\SysWOW64\wingua.exe
    wingua.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2652
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p1202
    3⤵
    - Executes dropped EXE
    PID:5784
- - C:\Windows\SysWOW64\wingua.exe
    wingua.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:3776
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p1202
    3⤵
    - Executes dropped EXE
    PID:1724
- - C:\Windows\SysWOW64\wingua.exe
    wingua.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2544
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p1202
    3⤵
    - Executes dropped EXE
    PID:4400
- - C:\Windows\SysWOW64\wingua.exe
    wingua.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:5132
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p1202
    3⤵
    - Executes dropped EXE
    PID:5740
- - C:\Windows\SysWOW64\wingua.exe
    wingua.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1460
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p1202
    3⤵
    - Executes dropped EXE
    PID:1140
- - C:\Windows\SysWOW64\wingua.exe
    wingua.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:3428
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p1202
    3⤵
    - Executes dropped EXE
    PID:2984
- - C:\Windows\SysWOW64\wingua.exe
    wingua.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1136
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p1202
    3⤵
    - Executes dropped EXE
    PID:1080
- - C:\Windows\SysWOW64\wingua.exe
    wingua.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:5296
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p1202
    3⤵
    - Executes dropped EXE
    PID:3124
- - C:\Windows\SysWOW64\wingua.exe
    wingua.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2760
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p1202
    3⤵
    - Executes dropped EXE
    PID:5380
- - C:\Windows\SysWOW64\wingua.exe
    wingua.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2688
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p1202
    3⤵
    - Executes dropped EXE
    PID:2720
- - C:\Windows\SysWOW64\wingua.exe
    wingua.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:4916
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p1202
    3⤵
    - Executes dropped EXE
    PID:5440
- - C:\Windows\SysWOW64\wingua.exe
    wingua.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2840
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p1202
    3⤵
    - Executes dropped EXE
    PID:2392
- - C:\Windows\SysWOW64\wingua.exe
    wingua.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2516
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p1202
    3⤵
    - Executes dropped EXE
    PID:3280
- - C:\Windows\SysWOW64\wingua.exe
    wingua.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:4624
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p1202
    3⤵
    - Executes dropped EXE
    PID:208
- - C:\Windows\SysWOW64\wingua.exe
    wingua.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2472
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p1202
    3⤵
    - Executes dropped EXE
    PID:5272
- - C:\Windows\SysWOW64\wingua.exe
    wingua.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:4172
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p1202
    3⤵
    - Executes dropped EXE
    PID:1360
- - C:\Windows\SysWOW64\wingua.exe
    wingua.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:200
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p1202
    3⤵
    PID:3776
- - C:\Windows\SysWOW64\wingua.exe
    wingua.exe
    3⤵
    - Drops file in Windows directory
    PID:5952
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p1202
    3⤵
    PID:4388
- - C:\Windows\SysWOW64\wingua.exe
    wingua.exe
    3⤵
    - Drops file in Windows directory
    PID:2508
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p1202
    3⤵
    PID:6040
- - C:\Windows\SysWOW64\wingua.exe
    wingua.exe
    3⤵
    - Drops file in Windows directory
    PID:3932
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p1202
    3⤵
    PID:1420
- - C:\Windows\SysWOW64\wingua.exe
    wingua.exe
    3⤵
    - Drops file in Windows directory
    PID:3916
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p1202
    3⤵
    PID:3312
- - C:\Windows\SysWOW64\wingua.exe
    wingua.exe
    3⤵
    - Drops file in Windows directory
    PID:3824
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p1202
    3⤵
    PID:1008
- - C:\Windows\SysWOW64\wingua.exe
    wingua.exe
    3⤵
    - Drops file in Windows directory
    PID:5004
- - C:\Windows\SysWOW64\svchostc.exe
    svchostc.exe -p1202
    3⤵
    PID:5316
- - C:\Windows\SysWOW64\wingua.exe
    wingua.exe
    3⤵
    - Drops file in Windows directory
    PID:4104

C:\Windows\mserv.exe
C:\Windows\mserv.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5928

C:\Windows\mserv.exe
C:\Windows\mserv.exe
1⤵
- Executes dropped EXE
PID:2460

C:\Windows\mserv.exe
C:\Windows\mserv.exe
1⤵
- Executes dropped EXE
PID:4268

C:\Windows\mserv.exe
C:\Windows\mserv.exe
1⤵
- Executes dropped EXE
PID:4996

C:\Windows\mserv.exe
C:\Windows\mserv.exe
1⤵
- Executes dropped EXE
PID:5532

C:\Windows\mserv.exe
C:\Windows\mserv.exe
1⤵
- Executes dropped EXE
PID:720

C:\Windows\mserv.exe
C:\Windows\mserv.exe
1⤵
- Executes dropped EXE
PID:1476

C:\Windows\mserv.exe
C:\Windows\mserv.exe
1⤵
- Executes dropped EXE
PID:1420

C:\Windows\mserv.exe
C:\Windows\mserv.exe
1⤵
- Executes dropped EXE
PID:2104

C:\Windows\mserv.exe
C:\Windows\mserv.exe
1⤵
- Executes dropped EXE
PID:5780

C:\Windows\mserv.exe
C:\Windows\mserv.exe
1⤵
- Executes dropped EXE
PID:5468

C:\Windows\mserv.exe
C:\Windows\mserv.exe
1⤵
- Executes dropped EXE
PID:2876

C:\Windows\mserv.exe
C:\Windows\mserv.exe
1⤵
- Executes dropped EXE
PID:5056

C:\Windows\mserv.exe
C:\Windows\mserv.exe
1⤵
- Executes dropped EXE
PID:4636

C:\Windows\mserv.exe
C:\Windows\mserv.exe
1⤵
- Executes dropped EXE
PID:1176

C:\Windows\mserv.exe
C:\Windows\mserv.exe
1⤵
- Executes dropped EXE
PID:3580

C:\Windows\mserv.exe
C:\Windows\mserv.exe
1⤵
- Executes dropped EXE
PID:5868

C:\Windows\mserv.exe
C:\Windows\mserv.exe
1⤵
- Executes dropped EXE
PID:4552

C:\Windows\mserv.exe
C:\Windows\mserv.exe
1⤵
- Executes dropped EXE
PID:3416

C:\Windows\mserv.exe
C:\Windows\mserv.exe
1⤵
- Executes dropped EXE
PID:5596

C:\Windows\mserv.exe
C:\Windows\mserv.exe
1⤵
PID:6076

C:\Windows\mserv.exe
C:\Windows\mserv.exe
1⤵
PID:3048

C:\Windows\mserv.exe
C:\Windows\mserv.exe
1⤵
PID:1496

C:\Windows\mserv.exe
C:\Windows\mserv.exe
1⤵
PID:3504

C:\Windows\mserv.exe
C:\Windows\mserv.exe
1⤵
PID:1288

C:\Windows\mserv.exe
C:\Windows\mserv.exe
1⤵
PID:1592

C:\Windows\mserv.exe
C:\Windows\mserv.exe
1⤵
PID:5404

C:\Windows\mserv.exe
C:\Windows\mserv.exe
1⤵
PID:3560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchostc.exe

Path C:\Windows\SysWOW64\svchostc.exe
Size 12KB
SHA256 aba46e456aed21aeb55231090a16953b73547bb4f6480e49893c8eb5f03303df
MD5 b74c5ca856c19bcbe7de6399d7752e8f
SHA1 4849b055528c955808c1a7e1a34d742d294d9a87
SHA512 6de484d15d092191cd6a0152c00425406a43d2ba8dcc51d1a8f8077adf4c287402f918a0d2831a0789c298904df40c044456c842ac77c9239638a71ee4da649d
SSDEEP 192:TPKe4nVUJeD3dL3UD3bjzj4VRtg4NOGEkjsGG7+py+NpxCaI2H4Y02Gp23:TPKe4nVU0D3KD3b3j4VTg4NOZqQIy+9B
TLSH
T16C429DDBF379F7B6D40A44BA638D4E728E2807B04EB2A740CF58459B7C32592590C68A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchosts.exe

Path C:\Windows\SysWOW64\svchosts.exe
Size 17KB
SHA256 215fab38da71c674f1734ee2fbe74117b996bb3faf44dc7dd27a636532737be1
MD5 af408edfc5c6a656f93727912b9023df
SHA1 321e1e7838f8f39a2c6bf63c9f72586048228796
SHA512 e732234631bad6d71509311203e64205702c981d0477bba26275b411afe52603cbd0631768a95199ed2ae415e2ae17e62c21c8886fbae995974a6cc4ec7f8b18
SSDEEP 384:4CwtcCjeFQyk0JvB/ZbZC9Gum+sKiMWn6N02HBH72VWwNnzVBHBciN7yg:48CGQyk0VJf45WM1h6AIM
TLSH
T13082B083681BFD5AC05E853DC733A2595A0EFBB055C0759D1CAA8CAE30E3D66306C7E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wingua.exe

Path C:\Windows\SysWOW64\wingua.exe
Size 4KB
SHA256 49238f9aa93dedf6efd47db3e92dc637b0bde1219aaa1d7f6dcb7dcc87c56797
MD5 956ac4a814f3aef3c80a84d973b03a69
SHA1 0a9ac5ed86879519435954191c190408536bf3ec
SHA512 1f9a690f1eace55f827d3c30f0b967383d2fd01200f5a978a5d5337fb801acee5050e945cf50c0ca5d3a269f1247c43d4b0869fe68659ef9d577d9b8610acde2
SSDEEP 96:zk9ol/ujTOSC70XpRSoa+9E76OlpJI/iMY:zzhujyf8p4oa+O6O2Y
TLSH
T125912BABFB6B53F6D395023B4747CA153524A510B3FAD6033C1D03DE34975B82991690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mserv.exe

Path C:\Windows\mserv.exe
Size 5KB
SHA256 db962f513acbbab09f979250119e4e284a5371e0c048040caef030d3684379a4
MD5 19eb5721c98263cccab94d3ae29fcb45
SHA1 038046315546ccc3ba2f01015da08ebc6842f9df
SHA512 2678359982ecabe69fcb47c2466f17f8204f34941c2533c1aa7feb8df0808141675e34d0589b0dd7fd2f34d029ba4215be2eec8ff103a17f749312ebc3cb6b6e
SSDEEP 48:yttDvoudF7Kw2BIHt1+taBemJq8XDbXiS+arXd6VnmLncmOr7y1ZmeFxaHNFe/j:6VbF7tPhFXXUViOr7y1ZpiNFo
TLSH
T1EAC1B75392B044F5C61C4EF31C1169E99D77702856EDC06522A3EAEF25B36631CAC487
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msin32.dll

Path C:\Windows\msin32.dll
Size 3KB
SHA256 d642e5fe3852516af1427941c6cb13116b051f3be4e484b8701090930242b570
MD5 110efc35e9ed33d47874d6fb8191fd62
SHA1 6cccd8fa729db07e7c26f2ab5f2d63ac4b92c726
SHA512 0db71ced67905c5c0ff62c56343c7ac5c1c6b4e0729cdbf549149045b143bcc2b6534a25cb2486522366ff6d717cdc259bf875d37059c91cd093da26d9619453
TLSH
T1BB51C003E36559B2C65D077057DB462BFE34142413F392020B36054B3D722636E3EE19
MD5 SHA1 SHA512 TLSH

Submit Download

sysini.ini

Path C:\Windows\sysini.ini
Size 42B
SHA256 95edd82a58e7338cbfc267f71614f48ef7a2434f5f635e8d622f5de1a5a0f6f3
MD5 01f5641239c88d486028c4fecab2169d
SHA1 98b737ba0e731c1bc804900d34598e0a00b9faaa
SHA512 7fe732228ae1dfdfc2eca0febd2bf389606f078449a872fde97996befe628216f13bcbc673592fd185360485894ed5befb9bcf8d278eb1fe399367d0e5d480b2
MD5 SHA1 SHA512

Submit Download

system.exe

Path C:\Windows\system.exe
Size 14KB
SHA256 996496d1b92a215db9de0209e57663581b7220a0d9287150ab98633580df4f31
MD5 2512a55b3fc9f4cf8043ad8308b72567
SHA1 50be7103e85b385eacdc2c1abd81b75c942404ec
SHA512 a6580ba753726fbd94b172c8720fd9b865214b367503aef9ef9c8c13f872a47f7baabf44e6a6e0311d2d1e5821ce58aa49b2ac119ecce578dfa17b84ebb525df
SSDEEP 192:YBXbmR8EmbOJuRFOtwOO0D5chBwk1KAgkFKAgkpPcu9qbiQK:YhbmR8EmbiuRFOtwOp8fMAsAdcu9K
TLSH
T17D52C66F5794C8A3C16281F326989ED4C2AC51775639B922DBB03C2139BA1F1DB4723E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/208-160-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/672-64-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/984-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/984-11-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1008-192-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1080-121-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1136-113-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1140-105-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1460-96-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1664-37-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1724-80-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2156-47-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2392-152-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2472-159-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2508-174-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2516-151-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2544-79-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2652-63-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2688-137-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2720-143-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2760-129-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2840-146-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2984-114-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3124-130-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3280-157-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3312-188-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3428-104-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3720-18-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/3720-33-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/3776-70-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3824-187-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3916-183-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3932-179-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4104-195-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4172-163-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4388-175-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4400-88-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4460-20-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4460-30-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4472-54-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4624-46-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4624-156-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4672-55-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4916-142-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4924-38-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4932-29-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4932-24-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/5004-191-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/5132-87-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/5272-164-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5316-196-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5380-138-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5440-148-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5740-97-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5784-71-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/6040-180-0x0000000000400000-0x000000000040D000-memory.dmp

Download