e6b60affd7ccd5f64a1cb9f524179337ed3460b750934e2d29597bb40e7828f9

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 592KB
Sample261014-cd65jaez3j
SHA256 e6b60affd7ccd5f64a1cb9f524179337ed3460b750934e2d29597bb40e7828f9
MD5 3c910671fd3b2579a8ea851193294cd8
SHA1 169d3e64cfad292926c3a9193aa6668991299c7f
SHA512 4f3d4e8e82e5d54630b2812ec649ac3c88d5a64c09f506da5f5def8148d5d6dbc498e7d7e317e9f2691c2812156881afa239d1f97de766d134a1b772a58c707e
SSDEEP 12288:fvoOqYdOtHrWWqvdbhKjJWZYMhHizolcrA7+9T16ScAk24gNSDOvuCQZLyYGM:oXOMB4Zy
TLSH
T138D46B343DEA501AF273EFB99BE475AADA6FB3733B07A45A105003464713A81DDC163A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 40 IoCs

pid	Process
252	drvhost596.exe
2280	drvhost860.exe
804	drvhost210.exe
4968	drvhost423.exe
2920	drvhost959.exe
900	drvhost367.exe
4560	drvhost134.exe
5264	drvhost96.exe
5512	drvhost448.exe
3244	drvhost378.exe
2236	drvhost893.exe
1752	drvhost246.exe
6092	drvhost371.exe
4440	drvhost831.exe
780	drvhost957.exe
1432	drvhost473.exe
4552	drvhost738.exe
2936	drvhost341.exe
3864	drvhost216.exe
3452	drvhost178.exe
2408	drvhost32.exe
1940	drvhost602.exe
2324	drvhost369.exe
2796	drvhost526.exe
5632	drvhost401.exe
3164	drvhost4.exe
2556	drvhost934.exe
3136	drvhost36.exe
4432	drvhost802.exe
5488	drvhost819.exe
3280	drvhost33.exe
1084	drvhost994.exe
2016	drvhost956.exe
2756	drvhost615.exe
3784	drvhost381.exe
1832	drvhost507.exe
3132	drvhost611.exe
1688	drvhost465.exe
6136	drvhost232.exe
4660	syshost.exe

Adds Run key to start application 2 TTPs 39 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost959.exe\""	drvhost423.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost246.exe\""	drvhost893.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost341.exe\""	drvhost738.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost33.exe\""	drvhost819.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost611.exe\""	drvhost507.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost423.exe\""	drvhost210.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost957.exe\""	drvhost831.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost802.exe\""	drvhost36.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost994.exe\""	drvhost33.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost956.exe\""	drvhost994.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost232.exe\""	drvhost465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost134.exe\""	drvhost367.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost96.exe\""	drvhost134.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost831.exe\""	drvhost371.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost602.exe\""	drvhost32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost367.exe\""	drvhost959.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost473.exe\""	drvhost957.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost738.exe\""	drvhost473.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost178.exe\""	drvhost216.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost36.exe\""	drvhost934.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost819.exe\""	drvhost802.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost216.exe\""	drvhost341.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost4.exe\""	drvhost401.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost381.exe\""	drvhost615.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost507.exe\""	drvhost381.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost465.exe\""	drvhost611.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost596.exe\""	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost860.exe\""	drvhost596.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost378.exe\""	drvhost448.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost526.exe\""	drvhost369.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost401.exe\""	drvhost526.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost615.exe\""	drvhost956.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost210.exe\""	drvhost860.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost448.exe\""	drvhost96.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost893.exe\""	drvhost378.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost371.exe\""	drvhost246.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost32.exe\""	drvhost178.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost369.exe\""	drvhost602.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Driver Component = "\"C:\\Windows\\system32\\drvhost934.exe\""	drvhost4.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drvhost216.exe	drvhost341.exe
File created	C:\Windows\SysWOW64\drvhost831.exe	drvhost371.exe
File opened for modification	C:\Windows\SysWOW64\drvhost341.exe	drvhost738.exe
File created	C:\Windows\SysWOW64\drvhost819.exe	drvhost802.exe
File created	C:\Windows\SysWOW64\drvhost956.exe	drvhost994.exe
File opened for modification	C:\Windows\SysWOW64\drvhost401.exe	drvhost526.exe
File opened for modification	C:\Windows\SysWOW64\drvhost956.exe	drvhost994.exe
File opened for modification	C:\Windows\SysWOW64\drvhost134.exe	drvhost367.exe
File created	C:\Windows\SysWOW64\drvhost860.exe	drvhost596.exe
File created	C:\Windows\SysWOW64\drvhost134.exe	drvhost367.exe
File opened for modification	C:\Windows\SysWOW64\drvhost473.exe	drvhost957.exe
File opened for modification	C:\Windows\SysWOW64\drvhost611.exe	drvhost507.exe
File opened for modification	C:\Windows\SysWOW64\drvhost465.exe	drvhost611.exe
File created	C:\Windows\SysWOW64\drvhost893.exe	drvhost378.exe
File created	C:\Windows\SysWOW64\drvhost341.exe	drvhost738.exe
File opened for modification	C:\Windows\SysWOW64\drvhost32.exe	drvhost178.exe
File created	C:\Windows\SysWOW64\drvhost934.exe	drvhost4.exe
File opened for modification	C:\Windows\SysWOW64\drvhost615.exe	drvhost956.exe
File created	C:\Windows\SysWOW64\drvhost611.exe	drvhost507.exe
File created	C:\Windows\SysWOW64\drvhost96.exe	drvhost134.exe
File opened for modification	C:\Windows\SysWOW64\drvhost934.exe	drvhost4.exe
File opened for modification	C:\Windows\SysWOW64\drvhost232.exe	drvhost465.exe
File opened for modification	C:\Windows\SysWOW64\drvhost371.exe	drvhost246.exe
File created	C:\Windows\SysWOW64\drvhost32.exe	drvhost178.exe
File opened for modification	C:\Windows\SysWOW64\drvhost36.exe	drvhost934.exe
File opened for modification	C:\Windows\SysWOW64\drvhost819.exe	drvhost802.exe
File created	C:\Windows\SysWOW64\drvhost994.exe	drvhost33.exe
File created	C:\Windows\SysWOW64\drvhost602.exe	drvhost32.exe
File created	C:\Windows\SysWOW64\drvhost4.exe	drvhost401.exe
File opened for modification	C:\Windows\SysWOW64\drvhost802.exe	drvhost36.exe
File created	C:\Windows\SysWOW64\drvhost232.exe	drvhost465.exe
File opened for modification	C:\Windows\SysWOW64\drvhost210.exe	drvhost860.exe
File opened for modification	C:\Windows\SysWOW64\drvhost246.exe	drvhost893.exe
File opened for modification	C:\Windows\SysWOW64\drvhost957.exe	drvhost831.exe
File opened for modification	C:\Windows\SysWOW64\drvhost178.exe	drvhost216.exe
File opened for modification	C:\Windows\SysWOW64\drvhost602.exe	drvhost32.exe
File opened for modification	C:\Windows\SysWOW64\drvhost33.exe	drvhost819.exe
File created	C:\Windows\SysWOW64\drvhost381.exe	drvhost615.exe
File opened for modification	C:\Windows\SysWOW64\drvhost381.exe	drvhost615.exe
File opened for modification	C:\Windows\SysWOW64\drvhost4.exe	drvhost401.exe
File created	C:\Windows\SysWOW64\drvhost423.exe	drvhost210.exe
File created	C:\Windows\SysWOW64\drvhost959.exe	drvhost423.exe
File opened for modification	C:\Windows\SysWOW64\drvhost367.exe	drvhost959.exe
File created	C:\Windows\SysWOW64\drvhost957.exe	drvhost831.exe
File created	C:\Windows\SysWOW64\drvhost473.exe	drvhost957.exe
File created	C:\Windows\SysWOW64\drvhost738.exe	drvhost473.exe
File created	C:\Windows\SysWOW64\drvhost615.exe	drvhost956.exe
File opened for modification	C:\Windows\SysWOW64\drvhost596.exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File created	C:\Windows\SysWOW64\drvhost210.exe	drvhost860.exe
File opened for modification	C:\Windows\SysWOW64\drvhost378.exe	drvhost448.exe
File opened for modification	C:\Windows\SysWOW64\drvhost831.exe	drvhost371.exe
File opened for modification	C:\Windows\SysWOW64\drvhost738.exe	drvhost473.exe
File opened for modification	C:\Windows\SysWOW64\drvhost507.exe	drvhost381.exe
File opened for modification	C:\Windows\SysWOW64\drvhost448.exe	drvhost96.exe
File created	C:\Windows\SysWOW64\drvhost378.exe	drvhost448.exe
File created	C:\Windows\SysWOW64\drvhost802.exe	drvhost36.exe
File created	C:\Windows\SysWOW64\drvhost178.exe	drvhost216.exe
File opened for modification	C:\Windows\SysWOW64\drvhost526.exe	drvhost369.exe
File created	C:\Windows\SysWOW64\drvhost33.exe	drvhost819.exe
File opened for modification	C:\Windows\SysWOW64\drvhost860.exe	drvhost596.exe
File opened for modification	C:\Windows\SysWOW64\drvhost893.exe	drvhost378.exe
File created	C:\Windows\SysWOW64\drvhost246.exe	drvhost893.exe
File opened for modification	C:\Windows\SysWOW64\drvhost369.exe	drvhost602.exe
File created	C:\Windows\SysWOW64\drvhost401.exe	drvhost526.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 6136 set thread context of 4660	6136	drvhost232.exe	135

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1344	4660	WerFault.exe	135

Reads the TCP/IP host and domain name from the registry 1 TTPs 64 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost994.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost611.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost423.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost378.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost473.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost216.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost802.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost33.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost615.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost959.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost957.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost956.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost959.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost369.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost526.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost802.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost33.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost367.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost134.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost96.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost371.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost831.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost738.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost341.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost210.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost893.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost602.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost819.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost596.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost860.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost210.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost956.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost381.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost860.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost96.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost378.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost507.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost507.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost465.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost232.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost246.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost957.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost526.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost232.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost448.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost473.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost341.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost369.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost934.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost994.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost381.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost367.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost448.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost934.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost371.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost36.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drvhost611.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost465.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drvhost401.exe

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost134.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost738.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost96.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost819.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost33.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost216.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost934.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost957.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost473.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost36.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost615.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost210.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost465.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drvhost367.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4712	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
4712	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
4712	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
4712	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
4712	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
4712	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
4712	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
4712	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
252	drvhost596.exe
252	drvhost596.exe
252	drvhost596.exe
252	drvhost596.exe
252	drvhost596.exe
252	drvhost596.exe
252	drvhost596.exe
252	drvhost596.exe
2280	drvhost860.exe
2280	drvhost860.exe
2280	drvhost860.exe
2280	drvhost860.exe
2280	drvhost860.exe
2280	drvhost860.exe
2280	drvhost860.exe
2280	drvhost860.exe
804	drvhost210.exe
804	drvhost210.exe
804	drvhost210.exe
804	drvhost210.exe
804	drvhost210.exe
804	drvhost210.exe
804	drvhost210.exe
804	drvhost210.exe
4968	drvhost423.exe
4968	drvhost423.exe
4968	drvhost423.exe
4968	drvhost423.exe
4968	drvhost423.exe
4968	drvhost423.exe
4968	drvhost423.exe
4968	drvhost423.exe
2920	drvhost959.exe
2920	drvhost959.exe
2920	drvhost959.exe
2920	drvhost959.exe
2920	drvhost959.exe
2920	drvhost959.exe
2920	drvhost959.exe
2920	drvhost959.exe
900	drvhost367.exe
900	drvhost367.exe
900	drvhost367.exe
900	drvhost367.exe
900	drvhost367.exe
900	drvhost367.exe
900	drvhost367.exe
900	drvhost367.exe
4560	drvhost134.exe
4560	drvhost134.exe
4560	drvhost134.exe
4560	drvhost134.exe
4560	drvhost134.exe
4560	drvhost134.exe
4560	drvhost134.exe
4560	drvhost134.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeDebugPrivilege	4712	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: SeDebugPrivilege	252	drvhost596.exe
Token: SeDebugPrivilege	2280	drvhost860.exe
Token: SeDebugPrivilege	804	drvhost210.exe
Token: SeDebugPrivilege	4968	drvhost423.exe
Token: SeDebugPrivilege	2920	drvhost959.exe
Token: SeDebugPrivilege	900	drvhost367.exe
Token: SeDebugPrivilege	4560	drvhost134.exe
Token: SeDebugPrivilege	5264	drvhost96.exe
Token: SeDebugPrivilege	5512	drvhost448.exe
Token: SeDebugPrivilege	3244	drvhost378.exe
Token: SeDebugPrivilege	2236	drvhost893.exe
Token: SeDebugPrivilege	1752	drvhost246.exe
Token: SeDebugPrivilege	6092	drvhost371.exe
Token: SeDebugPrivilege	4440	drvhost831.exe
Token: SeDebugPrivilege	780	drvhost957.exe
Token: SeDebugPrivilege	1432	drvhost473.exe
Token: SeDebugPrivilege	4552	drvhost738.exe
Token: SeDebugPrivilege	2936	drvhost341.exe
Token: SeDebugPrivilege	3864	drvhost216.exe
Token: SeDebugPrivilege	3452	drvhost178.exe
Token: SeDebugPrivilege	2408	drvhost32.exe
Token: SeDebugPrivilege	1940	drvhost602.exe
Token: SeDebugPrivilege	2324	drvhost369.exe
Token: SeDebugPrivilege	2796	drvhost526.exe
Token: SeDebugPrivilege	5632	drvhost401.exe
Token: SeDebugPrivilege	3164	drvhost4.exe
Token: SeDebugPrivilege	2556	drvhost934.exe
Token: SeDebugPrivilege	3136	drvhost36.exe
Token: SeDebugPrivilege	4432	drvhost802.exe
Token: SeDebugPrivilege	5488	drvhost819.exe
Token: SeDebugPrivilege	3280	drvhost33.exe
Token: SeDebugPrivilege	1084	drvhost994.exe
Token: SeDebugPrivilege	2016	drvhost956.exe
Token: SeDebugPrivilege	2756	drvhost615.exe
Token: SeDebugPrivilege	3784	drvhost381.exe
Token: SeDebugPrivilege	1832	drvhost507.exe
Token: SeDebugPrivilege	3132	drvhost611.exe
Token: SeDebugPrivilege	1688	drvhost465.exe
Token: SeDebugPrivilege	6136	drvhost232.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 252	4712	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	91
PID 252 wrote to memory of 2280	252	drvhost596.exe	93
PID 2280 wrote to memory of 804	2280	drvhost860.exe	94
PID 804 wrote to memory of 4968	804	drvhost210.exe	95
PID 4968 wrote to memory of 2920	4968	drvhost423.exe	96
PID 2920 wrote to memory of 900	2920	drvhost959.exe	97
PID 900 wrote to memory of 4560	900	drvhost367.exe	98
PID 4560 wrote to memory of 5264	4560	drvhost134.exe	100
PID 5264 wrote to memory of 5512	5264	drvhost96.exe	101
PID 5512 wrote to memory of 3244	5512	drvhost448.exe	102
PID 3244 wrote to memory of 2236	3244	drvhost378.exe	103
PID 2236 wrote to memory of 1752	2236	drvhost893.exe	104
PID 1752 wrote to memory of 6092	1752	drvhost246.exe	106
PID 6092 wrote to memory of 4440	6092	drvhost371.exe	107
PID 4440 wrote to memory of 780	4440	drvhost831.exe	108
PID 780 wrote to memory of 1432	780	drvhost957.exe	109
PID 1432 wrote to memory of 4552	1432	drvhost473.exe	110
PID 4552 wrote to memory of 2936	4552	drvhost738.exe	111
PID 2936 wrote to memory of 3864	2936	drvhost341.exe	112
PID 3864 wrote to memory of 3452	3864	drvhost216.exe	113
PID 3452 wrote to memory of 2408	3452	drvhost178.exe	114
PID 2408 wrote to memory of 1940	2408	drvhost32.exe	115
PID 1940 wrote to memory of 2324	1940	drvhost602.exe	116
PID 2324 wrote to memory of 2796	2324	drvhost369.exe	117
PID 2796 wrote to memory of 5632	2796	drvhost526.exe	118
PID 5632 wrote to memory of 3164	5632	drvhost401.exe	119
PID 3164 wrote to memory of 2556	3164	drvhost4.exe	120
PID 2556 wrote to memory of 3136	2556	drvhost934.exe	121
PID 3136 wrote to memory of 4432	3136	drvhost36.exe	122
PID 4432 wrote to memory of 5488	4432	drvhost802.exe	123
PID 5488 wrote to memory of 3280	5488	drvhost819.exe	124
PID 3280 wrote to memory of 1084	3280	drvhost33.exe	126
PID 1084 wrote to memory of 2016	1084	drvhost994.exe	127
PID 2016 wrote to memory of 2756	2016	drvhost956.exe	129
PID 2756 wrote to memory of 3784	2756	drvhost615.exe	130
PID 3784 wrote to memory of 1832	3784	drvhost381.exe	131
PID 1832 wrote to memory of 3132	1832	drvhost507.exe	132
PID 3132 wrote to memory of 1688	3132	drvhost611.exe	133
PID 1688 wrote to memory of 6136	1688	drvhost465.exe	134
PID 6136 wrote to memory of 4660	6136	drvhost232.exe	135

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\SysWOW64\drvhost596.exe
  "C:\Windows\system32\drvhost596.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:252
- - C:\Windows\SysWOW64\drvhost860.exe
    "C:\Windows\system32\drvhost860.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2280
  - - C:\Windows\SysWOW64\drvhost210.exe
      "C:\Windows\system32\drvhost210.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:804
    - - C:\Windows\SysWOW64\drvhost423.exe
        
        "C:\Windows\system32\drvhost423.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4968
      - C:\Windows\SysWOW64\drvhost959.exe
        
        "C:\Windows\system32\drvhost959.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2920
        
        C:\Windows\SysWOW64\drvhost367.exe
        
        "C:\Windows\system32\drvhost367.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:900
        
        C:\Windows\SysWOW64\drvhost134.exe
        
        "C:\Windows\system32\drvhost134.exe"
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4560
        
        C:\Windows\SysWOW64\drvhost96.exe
        
        "C:\Windows\system32\drvhost96.exe"
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5264
        
        C:\Windows\SysWOW64\drvhost448.exe
        
        "C:\Windows\system32\drvhost448.exe"
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5512
        
        C:\Windows\SysWOW64\drvhost378.exe
        
        "C:\Windows\system32\drvhost378.exe"
        11⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3244
        
        C:\Windows\SysWOW64\drvhost893.exe
        
        "C:\Windows\system32\drvhost893.exe"
        12⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Windows\SysWOW64\drvhost246.exe
        
        "C:\Windows\system32\drvhost246.exe"
        13⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1752
        
        C:\Windows\SysWOW64\drvhost371.exe
        
        "C:\Windows\system32\drvhost371.exe"
        14⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6092
        
        C:\Windows\SysWOW64\drvhost831.exe
        
        "C:\Windows\system32\drvhost831.exe"
        15⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4440
        
        C:\Windows\SysWOW64\drvhost957.exe
        
        "C:\Windows\system32\drvhost957.exe"
        16⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:780
        
        C:\Windows\SysWOW64\drvhost473.exe
        
        "C:\Windows\system32\drvhost473.exe"
        17⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1432
        
        C:\Windows\SysWOW64\drvhost738.exe
        
        "C:\Windows\system32\drvhost738.exe"
        18⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\SysWOW64\drvhost341.exe
        
        "C:\Windows\system32\drvhost341.exe"
        19⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2936
        
        C:\Windows\SysWOW64\drvhost216.exe
        
        "C:\Windows\system32\drvhost216.exe"
        20⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3864
        
        C:\Windows\SysWOW64\drvhost178.exe
        
        "C:\Windows\system32\drvhost178.exe"
        21⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3452
        
        C:\Windows\SysWOW64\drvhost32.exe
        
        "C:\Windows\system32\drvhost32.exe"
        22⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2408
        
        C:\Windows\SysWOW64\drvhost602.exe
        
        "C:\Windows\system32\drvhost602.exe"
        23⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\SysWOW64\drvhost369.exe
        
        "C:\Windows\system32\drvhost369.exe"
        24⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2324
        
        C:\Windows\SysWOW64\drvhost526.exe
        
        "C:\Windows\system32\drvhost526.exe"
        25⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2796
        
        C:\Windows\SysWOW64\drvhost401.exe
        
        "C:\Windows\system32\drvhost401.exe"
        26⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5632
        
        C:\Windows\SysWOW64\drvhost4.exe
        
        "C:\Windows\system32\drvhost4.exe"
        27⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3164
        
        C:\Windows\SysWOW64\drvhost934.exe
        
        "C:\Windows\system32\drvhost934.exe"
        28⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2556
        
        C:\Windows\SysWOW64\drvhost36.exe
        
        "C:\Windows\system32\drvhost36.exe"
        29⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3136
        
        C:\Windows\SysWOW64\drvhost802.exe
        
        "C:\Windows\system32\drvhost802.exe"
        30⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4432
        
        C:\Windows\SysWOW64\drvhost819.exe
        
        "C:\Windows\system32\drvhost819.exe"
        31⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5488
        
        C:\Windows\SysWOW64\drvhost33.exe
        
        "C:\Windows\system32\drvhost33.exe"
        32⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3280
        
        C:\Windows\SysWOW64\drvhost994.exe
        
        "C:\Windows\system32\drvhost994.exe"
        33⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1084
        
        C:\Windows\SysWOW64\drvhost956.exe
        
        "C:\Windows\system32\drvhost956.exe"
        34⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2016
        
        C:\Windows\SysWOW64\drvhost615.exe
        
        "C:\Windows\system32\drvhost615.exe"
        35⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2756
        
        C:\Windows\SysWOW64\drvhost381.exe
        
        "C:\Windows\system32\drvhost381.exe"
        36⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3784
        
        C:\Windows\SysWOW64\drvhost507.exe
        
        "C:\Windows\system32\drvhost507.exe"
        37⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1832
        
        C:\Windows\SysWOW64\drvhost611.exe
        
        "C:\Windows\system32\drvhost611.exe"
        38⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3132
        
        C:\Windows\SysWOW64\drvhost465.exe
        
        "C:\Windows\system32\drvhost465.exe"
        39⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1688
        
        C:\Windows\SysWOW64\drvhost232.exe
        
        "C:\Windows\system32\drvhost232.exe"
        40⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6136
        
        C:\ProgramData\syshost.exe
        
        C:\ProgramData\syshost.exe
        41⤵
        Executes dropped EXE
        
        PID:4660
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 16
        42⤵
        Program crash
        
        PID:1344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4660 -ip 4660
1⤵
PID:1788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

syshost.exe

Path C:\ProgramData\syshost.exe
Size 6KB
SHA256 a2158014ecd471868954d0e97397f9df43e310c48d56fa0b5a6ef908dc654adf
MD5 36c689700adbb227867e409938607270
SHA1 6123e236f73faa37600a60107a5b167980b83a61
SHA512 c75728ed30135032a6755e33b9034b98c871554c33a4b8ba1586e0b3282dbc65e3b61571d407365b24289dae2de56b514ef0db744f85e6648dc6432a33b85fef
SSDEEP 96:byQAFBvGCGwz+ScaCoqCu0iGdhpgdhsFfhnxGdfhnxGfH:OQAFMYvcaCZH0ioifs1W6H
TLSH
T1CEC1B576D9A31EB2F985A6B010DBEA3EB361F1355D91426BD78034382A25C303C7C7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drvhost596.exe

Path C:\Windows\SysWOW64\drvhost596.exe
Size 592KB
SHA256 e6b60affd7ccd5f64a1cb9f524179337ed3460b750934e2d29597bb40e7828f9
MD5 3c910671fd3b2579a8ea851193294cd8
SHA1 169d3e64cfad292926c3a9193aa6668991299c7f
SHA512 4f3d4e8e82e5d54630b2812ec649ac3c88d5a64c09f506da5f5def8148d5d6dbc498e7d7e317e9f2691c2812156881afa239d1f97de766d134a1b772a58c707e
SSDEEP 12288:fvoOqYdOtHrWWqvdbhKjJWZYMhHizolcrA7+9T16ScAk24gNSDOvuCQZLyYGM:oXOMB4Zy
TLSH
T138D46B343DEA501AF273EFB99BE475AADA6FB3733B07A45A105003464713A81DDC163A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-4-0x0000000074570000-0x0000000074B91000-memory.dmp

Download

memory/252-5-0x0000000074570000-0x0000000074B91000-memory.dmp

Download

memory/252-9-0x0000000074570000-0x0000000074B91000-memory.dmp

Download

memory/2280-10-0x0000000074570000-0x0000000074B91000-memory.dmp

Download

memory/2280-11-0x0000000074570000-0x0000000074B91000-memory.dmp

Download

memory/2280-15-0x0000000074570000-0x0000000074B91000-memory.dmp

Download

memory/4712-0-0x0000000001730000-0x0000000001740000-memory.dmp

Download

memory/4712-1-0x0000000074572000-0x0000000074574000-memory.dmp

Download