b1bc1550aba87dbd056448a5f62f1a22c0a8fb7a4d2b42549b7acbe157027275

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 13:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Worm.Win32.AutoRun.edrh.exe
Size 230KB
Sample261014-p91c3sgc65
SHA256 b1bc1550aba87dbd056448a5f62f1a22c0a8fb7a4d2b42549b7acbe157027275
MD5 d23b534cf2c6065bf5bd8f878d9b528a
SHA1 0f8cce1c6bb2f5503e286da3b4707442b7a479f4
SHA512 ac5cdeb773596706b75351bb73b1708abf788320e8176bd79465885185ae3e2cae52110025450ae1a945e120b5d966f7adcf5cfc0f170b039d82ae04b376f768
SSDEEP 1536:yZYd5QJc/vaSybs4M0rQQ87eHe3soW7CCDJ85AB0RlAh6:s1c/2b5Qf7857CKJ8AB0RlT
TLSH
T16B34ADA3BD4408B6D0561930064BA7B9B53A75A11A5778C77F15CDB88CBB383BBB9303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access discovery execution persistence spyware stealer

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{fb877665-9527-2067-6F6F-a96d20643179}	COMM32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{fb877665-9527-2067-6F6F-a96d20643179}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\COMM32.exe"	COMM32.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 6 IoCs

pid	Process
3348	wmimgmt.exe
4672	avp.exe
4564	avp.exe
3828	COMM32.exe
6140	COMM32.exe
4172	COMM32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	wmimgmt.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
5796	ARP.EXE

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2032	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2480	cmd.exe
1776	cmd.exe
4112	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmimgmt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmimgmt.exe

System Location Discovery: System Language Discovery 1 TTPs 51 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmimgmt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ROUTE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	COMM32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	COMM32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	COMM32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ARP.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Worm.Win32.AutoRun.edrh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
1136	NETSTAT.EXE

Discovers systems in the same network 1 TTPs 1 IoCs

discovery

Remote System Discovery

T1018

pid	Process
4644	net.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1136	NETSTAT.EXE
5168	NETSTAT.EXE
1948	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5904	systeminfo.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4172	COMM32.exe
4172	COMM32.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeBackupPrivilege	4188	jaffacakes118_Worm.Win32.AutoRun.edrh.exe
Token: SeBackupPrivilege	4188	jaffacakes118_Worm.Win32.AutoRun.edrh.exe
Token: SeRestorePrivilege	4188	jaffacakes118_Worm.Win32.AutoRun.edrh.exe
Token: SeBackupPrivilege	4188	jaffacakes118_Worm.Win32.AutoRun.edrh.exe
Token: SeRestorePrivilege	4188	jaffacakes118_Worm.Win32.AutoRun.edrh.exe
Token: SeBackupPrivilege	4188	jaffacakes118_Worm.Win32.AutoRun.edrh.exe
Token: SeRestorePrivilege	4188	jaffacakes118_Worm.Win32.AutoRun.edrh.exe
Token: SeIncBasePriorityPrivilege	4564	avp.exe
Token: SeDebugPrivilege	4172	COMM32.exe
Token: SeDebugPrivilege	2032	tasklist.exe
Token: SeDebugPrivilege	1136	NETSTAT.EXE
Token: SeBackupPrivilege	3348	wmimgmt.exe
Token: SeBackupPrivilege	3348	wmimgmt.exe
Token: SeBackupPrivilege	3348	wmimgmt.exe
Token: SeBackupPrivilege	3348	wmimgmt.exe
Token: SeBackupPrivilege	3348	wmimgmt.exe
Token: SeBackupPrivilege	3348	wmimgmt.exe
Token: SeRestorePrivilege	3348	wmimgmt.exe
Token: SeBackupPrivilege	3348	wmimgmt.exe
Token: SeBackupPrivilege	3348	wmimgmt.exe
Token: SeBackupPrivilege	3348	wmimgmt.exe
Token: SeBackupPrivilege	3348	wmimgmt.exe
Token: SeBackupPrivilege	3348	wmimgmt.exe
Token: SeBackupPrivilege	3348	wmimgmt.exe
Token: SeBackupPrivilege	3348	wmimgmt.exe
Token: SeBackupPrivilege	3348	wmimgmt.exe
Token: SeBackupPrivilege	3348	wmimgmt.exe
Token: SeBackupPrivilege	3348	wmimgmt.exe
Token: SeBackupPrivilege	3348	wmimgmt.exe
Token: SeBackupPrivilege	3348	wmimgmt.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 3348	4188	jaffacakes118_Worm.Win32.AutoRun.edrh.exe	89
PID 3348 wrote to memory of 4672	3348	wmimgmt.exe	90
PID 4672 wrote to memory of 4564	4672	avp.exe	91
PID 3348 wrote to memory of 1776	3348	wmimgmt.exe	92
PID 4564 wrote to memory of 3828	4564	avp.exe	94
PID 4564 wrote to memory of 4112	4564	avp.exe	95
PID 3828 wrote to memory of 6140	3828	COMM32.exe	96
PID 6140 wrote to memory of 4172	6140	COMM32.exe	97
PID 1776 wrote to memory of 3680	1776	cmd.exe	98
PID 1776 wrote to memory of 4648	1776	cmd.exe	99
PID 1776 wrote to memory of 2720	1776	cmd.exe	100
PID 2720 wrote to memory of 4616	2720	net.exe	101
PID 1776 wrote to memory of 4660	1776	cmd.exe	102
PID 4660 wrote to memory of 4264	4660	net.exe	103
PID 1776 wrote to memory of 2032	1776	cmd.exe	104
PID 1776 wrote to memory of 5904	1776	cmd.exe	106
PID 1776 wrote to memory of 5752	1776	cmd.exe	108
PID 1776 wrote to memory of 416	1776	cmd.exe	109
PID 1776 wrote to memory of 5664	1776	cmd.exe	110
PID 1776 wrote to memory of 548	1776	cmd.exe	111
PID 1776 wrote to memory of 4364	1776	cmd.exe	112
PID 1776 wrote to memory of 1380	1776	cmd.exe	113
PID 1776 wrote to memory of 6048	1776	cmd.exe	114
PID 1776 wrote to memory of 5420	1776	cmd.exe	115
PID 1776 wrote to memory of 3300	1776	cmd.exe	116
PID 1776 wrote to memory of 1948	1776	cmd.exe	117
PID 1776 wrote to memory of 1136	1776	cmd.exe	118
PID 1776 wrote to memory of 5796	1776	cmd.exe	119
PID 1776 wrote to memory of 5168	1776	cmd.exe	120
PID 5168 wrote to memory of 2480	5168	NETSTAT.EXE	121
PID 2480 wrote to memory of 4896	2480	cmd.exe	122
PID 1776 wrote to memory of 5164	1776	cmd.exe	123
PID 5164 wrote to memory of 472	5164	net.exe	124
PID 1776 wrote to memory of 3400	1776	cmd.exe	125
PID 1776 wrote to memory of 5024	1776	cmd.exe	126
PID 1776 wrote to memory of 4496	1776	cmd.exe	127
PID 4496 wrote to memory of 2188	4496	net.exe	128
PID 1776 wrote to memory of 4644	1776	cmd.exe	129
PID 1776 wrote to memory of 2492	1776	cmd.exe	130
PID 1776 wrote to memory of 3456	1776	cmd.exe	131
PID 1776 wrote to memory of 3940	1776	cmd.exe	132
PID 1776 wrote to memory of 1532	1776	cmd.exe	133
PID 1776 wrote to memory of 2356	1776	cmd.exe	134
PID 1776 wrote to memory of 5632	1776	cmd.exe	135
PID 1776 wrote to memory of 3480	1776	cmd.exe	136
PID 1776 wrote to memory of 612	1776	cmd.exe	137
PID 1776 wrote to memory of 3052	1776	cmd.exe	138
PID 1776 wrote to memory of 3128	1776	cmd.exe	139
PID 1776 wrote to memory of 1132	1776	cmd.exe	140
PID 1776 wrote to memory of 2076	1776	cmd.exe	141

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Worm.Win32.AutoRun.edrh.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Worm.Win32.AutoRun.edrh.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4188
- C:\ProgramData\Application Data\wmimgmt.exe
  "C:\ProgramData\Application Data\wmimgmt.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Users\Admin\AppData\Local\Temp\avp.exe
    C:\Users\Admin\AppData\Local\Temp\avp.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\avp.exe
      "C:\Users\Admin\AppData\Local\Temp\avp.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\COMM32.exe
        
        C:\Users\Admin\AppData\Local\Temp\COMM32.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3828
      - C:\Users\Admin\AppData\Local\Temp\COMM32.exe
        
        "C:\Users\Admin\AppData\Local\Temp\COMM32.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\COMM32.exe
        
        "C:\Users\Admin\AppData\Local\Temp\COMM32.exe"
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4172
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\avp.exe > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4112
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /v:on /c C:\Users\Admin\AppData\Local\Temp\ghi.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1776
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /s "YM.CGP_" "C:\Users\Admin"\..\*.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:3680
  - - C:\Windows\SysWOW64\chcp.com
      chcp
      4⤵
      System Location Discovery: System Language Discovery
      PID:4648
  - - C:\Windows\SysWOW64\net.exe
      net user
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2720
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4616
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4660
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4264
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2032
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:5904
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5752
  - - C:\Windows\SysWOW64\find.exe
      find "REG_"
      4⤵
      System Location Discovery: System Language Discovery
      PID:416
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office
      4⤵
      System Location Discovery: System Language Discovery
      PID:5664
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Common\UserInfo
      4⤵
      System Location Discovery: System Language Discovery
      PID:548
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Common\UserInfo
      4⤵
      System Location Discovery: System Language Discovery
      PID:4364
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Common\UserInfo
      4⤵
      System Location Discovery: System Language Discovery
      PID:1380
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Common\UserInfo
      4⤵
      System Location Discovery: System Language Discovery
      PID:6048
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\UserInfo
      4⤵
      System Location Discovery: System Language Discovery
      PID:5420
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Common\UserInfo
      4⤵
      System Location Discovery: System Language Discovery
      PID:3300
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /all
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      PID:1948
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      netstat -ano
      4⤵
      System Location Discovery: System Language Discovery
      System Network Connections Discovery
      Gathers network information
      Suspicious use of AdjustPrivilegeToken
      PID:1136
  - - C:\Windows\SysWOW64\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      System Location Discovery: System Language Discovery
      PID:5796
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      netstat -r
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      Suspicious use of WriteProcessMemory
      PID:5168
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2480
      - C:\Windows\SysWOW64\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4896
  - - C:\Windows\SysWOW64\net.exe
      net start
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5164
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:472
  - - C:\Windows\SysWOW64\net.exe
      net use
      4⤵
      System Location Discovery: System Language Discovery
      PID:3400
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo n"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5024
  - - C:\Windows\SysWOW64\net.exe
      net share
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4496
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 share
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2188
  - - C:\Windows\SysWOW64\net.exe
      net view /domain
      4⤵
      System Location Discovery: System Language Discovery
      Discovers systems in the same network
      PID:4644
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "
      4⤵
      System Location Discovery: System Language Discovery
      PID:2492
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "------"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3456
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "
      4⤵
      System Location Discovery: System Language Discovery
      PID:3940
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "domain"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1532
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "
      4⤵
      System Location Discovery: System Language Discovery
      PID:2356
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "¬A╛╣"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5632
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "
      4⤵
      System Location Discovery: System Language Discovery
      PID:3480
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "░⌡ªµª¿"
      4⤵
      System Location Discovery: System Language Discovery
      PID:612
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "
      4⤵
      System Location Discovery: System Language Discovery
      PID:3052
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "├ⁿ┴ε"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3128
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "
      4⤵
      System Location Discovery: System Language Discovery
      PID:1132
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "completed successfully"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wmimgmt.exe

Path C:\ProgramData\wmimgmt.exe
Size 230KB
SHA256 b1bc1550aba87dbd056448a5f62f1a22c0a8fb7a4d2b42549b7acbe157027275
MD5 d23b534cf2c6065bf5bd8f878d9b528a
SHA1 0f8cce1c6bb2f5503e286da3b4707442b7a479f4
SHA512 ac5cdeb773596706b75351bb73b1708abf788320e8176bd79465885185ae3e2cae52110025450ae1a945e120b5d966f7adcf5cfc0f170b039d82ae04b376f768
SSDEEP 1536:yZYd5QJc/vaSybs4M0rQQ87eHe3soW7CCDJ85AB0RlAh6:s1c/2b5Qf7857CKJ8AB0RlT
TLSH
T16B34ADA3BD4408B6D0561930064BA7B9B53A75A11A5778C77F15CDB88CBB383BBB9303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

COMM32.dll

Path C:\Users\Admin\AppData\Local\Temp\COMM32.dll
Size 64KB
SHA256 316ee1688411fdea58afb51e0867c26d5d895c74ac6781c91f18038bbe9b133f
MD5 a19af24e6cdb93e41df55a08668b7aeb
SHA1 ae0e9672ecd9621a0338236885f63d9f89e49d82
SHA512 2824a3d24d79db7b86acdfcfec2015927460a7f8e034e185b48e777c635a89990f68097aa91c20c7e96e2b70e30677868edae4f32204b9fcdfdc2ae9860b9685
SSDEEP 768:kZDh8xmX9EM9qmBKZtXodlkkcsTBhC78Z/GGu8NS84Aieoo/MH++k:kqQS5KT6kHTBhHZ/GGKoobC
TLSH
T145538C12769280F7E2A6477060A35B7B5B7AE91007EA85838F26DDE90C725B0F53F347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INFO.TXT

Path C:\Users\Admin\AppData\Local\Temp\INFO.TXT
Size 43B
SHA256 51b6f31f9e498693661cd9b1dc2c91169e5e73b5dc732c2813ca074724df75e4
MD5 d9d1c0d327bed2975e136b3d60dd60ea
SHA1 898054a6a4675b941c9ee8eff36940902363f590
SHA512 3fdbe7d416f960682cd69500d5e86ff6a2e953ccfde0dba230c52608b191c88bd28beaa82df99909811f7b4ed8ebdd951b22c6396516e2634319dd7812c45ae3
MD5 SHA1 SHA512

Submit Download

INFO.TXT

Path C:\Users\Admin\AppData\Local\Temp\INFO.TXT
Size 12KB
SHA256 1f5ee83586edd76d432f1afa59ea39db4498874efc158c4bcf4f55c96876fe68
MD5 53c1d6ee072814eedb833b16e1f9c2e7
SHA1 7bd0532a709e260d2bfe3d4980d648eaa9da4370
SHA512 e2587ce934542275ffa4f61e0ae4e429b918d7e18c1db00ab5be181e6bfb207bdc874f7a5a08776221ca5bc554ce0f69df48bda56aa7bcf8774d5de6498db5fe
SSDEEP 384:SmVwBPr475GJ/S60hwYh9v12uYXTL1/intSbMldLj5Isicr5n5mmp/qc9xxaSmab:RYr47UJ/S60hwYh9v12uYXTL1/intSbA
TLSH
T15F52CE408C9F81FCA51DE3983A134002F79A654631A9AEE936CD45987BE4F1CD3EF9B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INFO.TXT

Path C:\Users\Admin\AppData\Local\Temp\INFO.TXT
Size 34.2MB
SHA256 b03eb779103e3986b48b7903fa90c7e6ccbd4712420c0fd4fa8f9ecf23ad14d1
MD5 db38c949ee05adb81b74436cd9ca4ca1
SHA1 80432e3b0df890c66ce4f8e91cb98290819caeca
SHA512 83f92b4f2e23b9584352670583e59698d6f780ab50aa4002eb1684cc38fb47d89aae6f60d2c117738eaabde4374f67a488daa2ccd3159a1b2678477c83020a51
SSDEEP 49152:NgJqL41ioZgNgW27LHo+dnPrYTZgHOwklzRmLwkboAexmzk5RS/jByeOWkByGQof:mjBw
TLSH
T11177110BCEE6C6D58993F61122790F92D26E2A43760A8D1833EE43464BF3577379E538
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avp.exe

Path C:\Users\Admin\AppData\Local\Temp\avp.exe
Size 112KB
SHA256 9deacad2c8d46c8161e2285deeb88ac5340ef2ac39c1a0957fd4552a03438db9
MD5 54fbee1d935afedc1e8ffeab3b9e674f
SHA1 c645bc7cef4b69b5db7ca92c4533b73347a4d9a6
SHA512 064012fc20e18ac50593e5d46b6987db481313c5bbfadaed8170a35fc8ea967b868fc24f875debb834fae915ab267bbc8f47c5ad7c99d0b09040c494f41a1798
SSDEEP 1536:3E7RYqC/cONoHqQS5KT6kHTBhHZ/GGKoobC:34p+5NoKQSM6kFaGKoob
TLSH
T109B38D2279D280F7D6D6467110F24B7B6F7BA52007E685C38F649DA65C315F0EA3A383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.p

Path C:\Users\Admin\AppData\Local\Temp\drivers.p
Size 15B
SHA256 d8a21e76d208e48198b4afa4a54157044255e074acd5c25f99d9894ad70fbde2
MD5 48290ef0f324cf793b4f7ef936ddf34a
SHA1 ff77d5f263909066a61c89ead0764f6167dc3b16
SHA512 e32bd98f8ca5ceb6d90fde670c8a8a02d841745083040ced0dc5492ed0cdb7eb0bda3cd0a0a101e374a25ba0227991e545be7d41a114c591a7c5f6025d2f6eac
MD5 SHA1 SHA512

Submit Download

ghi.bat

Path C:\Users\Admin\AppData\Local\Temp\ghi.bat
Size 3KB
SHA256 e369c7e2e7ac0280882693038b213be0309c910df62f35a5159a125ecd18fb9a
MD5 b98e8fcde49a1caee295a6bd3d264e56
SHA1 71c82391a8617212ad48c8d79755e71be2e20be9
SHA512 fb5fa414449e7dd4ce1fedcb92487f59ed18d7fbd3146eb59ec8f7256d68551adebb7d35e859fe7b6bce5a0b042b0de1e9ee56369a8686976dd121b44ff46742
TLSH
T18561EEC7B85C8C1B09650571DB09E4C533B7C2C3D34236A6BC6A5AB0B4AD75943B6ACE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3348-36-0x0000000000400000-0x000000000044F000-memory.dmp

Download

memory/4188-0-0x0000000000400000-0x000000000044F000-memory.dmp

Download

memory/4188-2-0x0000000000400000-0x000000000044F000-memory.dmp

Download