29bf37c3f56ae676b4824ef8d51396897fe8734949b2e6d9358c9779c8c22c30

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 13:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Worm.Win32.AutoRun.edrh.exe
Size 58KB
Sample261014-p9tkjasv2r
SHA256 29bf37c3f56ae676b4824ef8d51396897fe8734949b2e6d9358c9779c8c22c30
MD5 68aacf8f7bdff8d5e6427ad912a8841b
SHA1 b7083c2a25d6737ac3ba2b8dd38cd4e565250589
SHA512 50854f2c75d352b9fe5ae74a396cdc6c6a64bc8462439d29acd50a694205796d2e57d60f093f359b00023bf46fff731675d609e4cbd75f56a74259e0d2e04b1c
SSDEEP 768:4dICxZk/89MpVT7woQJcW/bnqC03T/yEwSndA/zJmnPi3Jnv:4TYd5QJc/vaSybs4
TLSH
T16D434943BD8418B9E8541031006EBAF6B27BBEA51A2AB9C77F14DCB14833197B639647
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access discovery execution spyware stealer

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 1 IoCs

pid	Process
4328	wmimgmt.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	wmimgmt.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
1204	ARP.EXE

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5172	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4248	cmd.exe
1980	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmimgmt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmimgmt.exe

System Location Discovery: System Language Discovery 1 TTPs 45 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ROUTE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmimgmt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ARP.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Worm.Win32.AutoRun.edrh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
4168	NETSTAT.EXE

Discovers systems in the same network 1 TTPs 1 IoCs

discovery

Remote System Discovery

T1018

pid	Process
3472	net.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3808	ipconfig.exe
4168	NETSTAT.EXE
4864	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
612	systeminfo.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeBackupPrivilege	4868	jaffacakes118_Worm.Win32.AutoRun.edrh.exe
Token: SeBackupPrivilege	4868	jaffacakes118_Worm.Win32.AutoRun.edrh.exe
Token: SeRestorePrivilege	4868	jaffacakes118_Worm.Win32.AutoRun.edrh.exe
Token: SeBackupPrivilege	4868	jaffacakes118_Worm.Win32.AutoRun.edrh.exe
Token: SeRestorePrivilege	4868	jaffacakes118_Worm.Win32.AutoRun.edrh.exe
Token: SeBackupPrivilege	4868	jaffacakes118_Worm.Win32.AutoRun.edrh.exe
Token: SeRestorePrivilege	4868	jaffacakes118_Worm.Win32.AutoRun.edrh.exe
Token: SeDebugPrivilege	5172	tasklist.exe
Token: SeDebugPrivilege	4168	NETSTAT.EXE
Token: SeBackupPrivilege	4328	wmimgmt.exe
Token: SeBackupPrivilege	4328	wmimgmt.exe
Token: SeBackupPrivilege	4328	wmimgmt.exe
Token: SeBackupPrivilege	4328	wmimgmt.exe
Token: SeBackupPrivilege	4328	wmimgmt.exe
Token: SeBackupPrivilege	4328	wmimgmt.exe
Token: SeRestorePrivilege	4328	wmimgmt.exe
Token: SeBackupPrivilege	4328	wmimgmt.exe
Token: SeBackupPrivilege	4328	wmimgmt.exe
Token: SeBackupPrivilege	4328	wmimgmt.exe
Token: SeBackupPrivilege	4328	wmimgmt.exe
Token: SeBackupPrivilege	4328	wmimgmt.exe
Token: SeBackupPrivilege	4328	wmimgmt.exe
Token: SeBackupPrivilege	4328	wmimgmt.exe
Token: SeBackupPrivilege	4328	wmimgmt.exe
Token: SeBackupPrivilege	4328	wmimgmt.exe
Token: SeBackupPrivilege	4328	wmimgmt.exe
Token: SeBackupPrivilege	4328	wmimgmt.exe
Token: SeBackupPrivilege	4328	wmimgmt.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 4328	4868	jaffacakes118_Worm.Win32.AutoRun.edrh.exe	89
PID 4328 wrote to memory of 4248	4328	wmimgmt.exe	90
PID 4248 wrote to memory of 4880	4248	cmd.exe	92
PID 4248 wrote to memory of 5192	4248	cmd.exe	93
PID 4248 wrote to memory of 5376	4248	cmd.exe	94
PID 5376 wrote to memory of 3704	5376	net.exe	95
PID 4248 wrote to memory of 5564	4248	cmd.exe	96
PID 5564 wrote to memory of 4132	5564	net.exe	97
PID 4248 wrote to memory of 5172	4248	cmd.exe	98
PID 4248 wrote to memory of 612	4248	cmd.exe	100
PID 4248 wrote to memory of 4740	4248	cmd.exe	102
PID 4248 wrote to memory of 3224	4248	cmd.exe	103
PID 4248 wrote to memory of 1848	4248	cmd.exe	104
PID 4248 wrote to memory of 3812	4248	cmd.exe	105
PID 4248 wrote to memory of 2900	4248	cmd.exe	106
PID 4248 wrote to memory of 5792	4248	cmd.exe	107
PID 4248 wrote to memory of 1908	4248	cmd.exe	108
PID 4248 wrote to memory of 4164	4248	cmd.exe	109
PID 4248 wrote to memory of 2260	4248	cmd.exe	110
PID 4248 wrote to memory of 3808	4248	cmd.exe	111
PID 4248 wrote to memory of 4168	4248	cmd.exe	112
PID 4248 wrote to memory of 1204	4248	cmd.exe	113
PID 4248 wrote to memory of 4864	4248	cmd.exe	114
PID 4864 wrote to memory of 1980	4864	NETSTAT.EXE	115
PID 1980 wrote to memory of 4676	1980	cmd.exe	116
PID 4248 wrote to memory of 4540	4248	cmd.exe	117
PID 4540 wrote to memory of 5844	4540	net.exe	118
PID 4248 wrote to memory of 1028	4248	cmd.exe	119
PID 4248 wrote to memory of 5880	4248	cmd.exe	120
PID 4248 wrote to memory of 4980	4248	cmd.exe	121
PID 4980 wrote to memory of 912	4980	net.exe	122
PID 4248 wrote to memory of 3472	4248	cmd.exe	123
PID 4248 wrote to memory of 1520	4248	cmd.exe	124
PID 4248 wrote to memory of 4308	4248	cmd.exe	125
PID 4248 wrote to memory of 4844	4248	cmd.exe	126
PID 4248 wrote to memory of 5680	4248	cmd.exe	127
PID 4248 wrote to memory of 2664	4248	cmd.exe	128
PID 4248 wrote to memory of 1636	4248	cmd.exe	129
PID 4248 wrote to memory of 5312	4248	cmd.exe	130
PID 4248 wrote to memory of 3684	4248	cmd.exe	131
PID 4248 wrote to memory of 4648	4248	cmd.exe	132
PID 4248 wrote to memory of 992	4248	cmd.exe	133
PID 4248 wrote to memory of 2176	4248	cmd.exe	134
PID 4248 wrote to memory of 4384	4248	cmd.exe	135

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Worm.Win32.AutoRun.edrh.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Worm.Win32.AutoRun.edrh.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4868
- C:\ProgramData\Application Data\wmimgmt.exe
  "C:\ProgramData\Application Data\wmimgmt.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /v:on /c C:\Users\Admin\AppData\Local\Temp\ghi.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /s "YM.CGP_" "C:\Users\Admin"\..\*.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:4880
  - - C:\Windows\SysWOW64\chcp.com
      chcp
      4⤵
      System Location Discovery: System Language Discovery
      PID:5192
  - - C:\Windows\SysWOW64\net.exe
      net user
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5376
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3704
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5564
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4132
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5172
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:612
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4740
  - - C:\Windows\SysWOW64\find.exe
      find "REG_"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3224
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office
      4⤵
      System Location Discovery: System Language Discovery
      PID:1848
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Common\UserInfo
      4⤵
      System Location Discovery: System Language Discovery
      PID:3812
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Common\UserInfo
      4⤵
      System Location Discovery: System Language Discovery
      PID:2900
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Common\UserInfo
      4⤵
      System Location Discovery: System Language Discovery
      PID:5792
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Common\UserInfo
      4⤵
      System Location Discovery: System Language Discovery
      PID:1908
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\UserInfo
      4⤵
      System Location Discovery: System Language Discovery
      PID:4164
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Common\UserInfo
      4⤵
      System Location Discovery: System Language Discovery
      PID:2260
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /all
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      PID:3808
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      netstat -ano
      4⤵
      System Location Discovery: System Language Discovery
      System Network Connections Discovery
      Gathers network information
      Suspicious use of AdjustPrivilegeToken
      PID:4168
  - - C:\Windows\SysWOW64\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      System Location Discovery: System Language Discovery
      PID:1204
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      netstat -r
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      Suspicious use of WriteProcessMemory
      PID:4864
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1980
      - C:\Windows\SysWOW64\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4676
  - - C:\Windows\SysWOW64\net.exe
      net start
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4540
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5844
  - - C:\Windows\SysWOW64\net.exe
      net use
      4⤵
      System Location Discovery: System Language Discovery
      PID:1028
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo n"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5880
  - - C:\Windows\SysWOW64\net.exe
      net share
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4980
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 share
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:912
  - - C:\Windows\SysWOW64\net.exe
      net view /domain
      4⤵
      System Location Discovery: System Language Discovery
      Discovers systems in the same network
      PID:3472
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "
      4⤵
      System Location Discovery: System Language Discovery
      PID:1520
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "------"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4308
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "
      4⤵
      System Location Discovery: System Language Discovery
      PID:4844
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "domain"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5680
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "
      4⤵
      System Location Discovery: System Language Discovery
      PID:2664
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "¬A╛╣"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1636
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "
      4⤵
      System Location Discovery: System Language Discovery
      PID:5312
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "░⌡ªµª¿"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3684
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "
      4⤵
      System Location Discovery: System Language Discovery
      PID:4648
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "├ⁿ┴ε"
      4⤵
      System Location Discovery: System Language Discovery
      PID:992
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "
      4⤵
      System Location Discovery: System Language Discovery
      PID:2176
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "completed successfully"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Account Manipulation

T1098

Privilege Escalation

Account Manipulation

T1098

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wmimgmt.exe

Path C:\ProgramData\wmimgmt.exe
Size 58KB
SHA256 29bf37c3f56ae676b4824ef8d51396897fe8734949b2e6d9358c9779c8c22c30
MD5 68aacf8f7bdff8d5e6427ad912a8841b
SHA1 b7083c2a25d6737ac3ba2b8dd38cd4e565250589
SHA512 50854f2c75d352b9fe5ae74a396cdc6c6a64bc8462439d29acd50a694205796d2e57d60f093f359b00023bf46fff731675d609e4cbd75f56a74259e0d2e04b1c
SSDEEP 768:4dICxZk/89MpVT7woQJcW/bnqC03T/yEwSndA/zJmnPi3Jnv:4TYd5QJc/vaSybs4
TLSH
T16D434943BD8418B9E8541031006EBAF6B27BBEA51A2AB9C77F14DCB14833197B639647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INFO.TXT

Path C:\Users\Admin\AppData\Local\Temp\INFO.TXT
Size 12KB
SHA256 fad6dc3c4e50c6f34733c45a84dcc56e4b434dc52dd020dc31871f973462b210
MD5 68154bd6acb238873bff5908a137b9dd
SHA1 37b03c3acd1e7fb0f7342f651cd57082103350af
SHA512 98a9605009bab8a4a63f92755f8b3e3c9215777f15122ed1f8e86b90ca085e50cac87abf4c4b1709793d00d020342f3428ab4a25f7bfef3bee7d49529d5d480f
SSDEEP 384:jmVwBB/PhuPXay/gg6q5PO1Z2OsCLlnHs6DcJiKHah7rMxD3J42tDCuI4ExxgjEZ:CS/puPXay/gg6q5PO1Z2OsCLlnHs6Dcy
TLSH
T16352DC508C9F81B8A51DE3983A134002F79E654631AAADE936CD05987BE4F1CD3EF9B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INFO.TXT

Path C:\Users\Admin\AppData\Local\Temp\INFO.TXT
Size 34.2MB
SHA256 e65ab40006a06b88b842c41d048f747d3ab95f8152d6ef6cd56cb7034aaacc31
MD5 f032d4f1be9ca3702ff3a8c107343e20
SHA1 7c09f3f0fbb9a56a38e5d303419f3787eac4980b
SHA512 91a0f87de188f76396bf2215735724dca2c8a4d4eb8fa08280caa4ce4172c812e44280621f1f9bab2ac1436c9f6ee9d190a3236f8c1008f265019b1c47c223a9
SSDEEP 49152:+3JqW46gsZgjgW27LHoPdnPrYyZgSOwklzRmLwkboAexmzk5RS/jByeOWkByGQon:HjBo
TLSH
T1CF77110BCEE6C6D58993F61122790F92D26E2A43760A8D1833EE43464BF3577379E538
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INFO.TXT

Path C:\Users\Admin\AppData\Local\Temp\INFO.TXT
Size 43B
SHA256 51b6f31f9e498693661cd9b1dc2c91169e5e73b5dc732c2813ca074724df75e4
MD5 d9d1c0d327bed2975e136b3d60dd60ea
SHA1 898054a6a4675b941c9ee8eff36940902363f590
SHA512 3fdbe7d416f960682cd69500d5e86ff6a2e953ccfde0dba230c52608b191c88bd28beaa82df99909811f7b4ed8ebdd951b22c6396516e2634319dd7812c45ae3
MD5 SHA1 SHA512

Submit Download

drivers.p

Path C:\Users\Admin\AppData\Local\Temp\drivers.p
Size 15B
SHA256 d8a21e76d208e48198b4afa4a54157044255e074acd5c25f99d9894ad70fbde2
MD5 48290ef0f324cf793b4f7ef936ddf34a
SHA1 ff77d5f263909066a61c89ead0764f6167dc3b16
SHA512 e32bd98f8ca5ceb6d90fde670c8a8a02d841745083040ced0dc5492ed0cdb7eb0bda3cd0a0a101e374a25ba0227991e545be7d41a114c591a7c5f6025d2f6eac
MD5 SHA1 SHA512

Submit Download

ghi.bat

Path C:\Users\Admin\AppData\Local\Temp\ghi.bat
Size 3KB
SHA256 e369c7e2e7ac0280882693038b213be0309c910df62f35a5159a125ecd18fb9a
MD5 b98e8fcde49a1caee295a6bd3d264e56
SHA1 71c82391a8617212ad48c8d79755e71be2e20be9
SHA512 fb5fa414449e7dd4ce1fedcb92487f59ed18d7fbd3146eb59ec8f7256d68551adebb7d35e859fe7b6bce5a0b042b0de1e9ee56369a8686976dd121b44ff46742
TLSH
T18561EEC7B85C8C1B09650571DB09E4C533B7C2C3D34236A6BC6A5AB0B4AD75943B6ACE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4328-24-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4868-0-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4868-2-0x0000000000400000-0x0000000000411000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads