529a0c6c4053637a32f035732179c9c08b15c24d800064373cea83db39d950b4

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 19:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.Genome.svoj.exe
Size 408KB
Sample261018-xsrzdatwfx
SHA256 529a0c6c4053637a32f035732179c9c08b15c24d800064373cea83db39d950b4
MD5 4a97c61636c6e3113924caefbfd1afd4
SHA1 8e3d7a2dfdbf51e76d00859f4821c81a5c4f4b5b
SHA512 e0ad84038cb4924cc870d3138d8c0c64a02b03581066ef536036817229b87f02d7a2f2b2704d35d5127d0fc2f9287e7d79f082db214c90b95e3f2a2e9df82f8e
SSDEEP 12288:74MktglJK/jgCLXNi4hsYrKqewRM0SYb5hO7pixuIB:5D4FLXNi4hsY2dwNSYb5w8xuI
TLSH
T1CC9423A28545F0AEC5C296390C963D37AA384DE45E0F36982150F06B6D743B50BFB7EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
5128	rar.exe
2864	systen.exe
260	rar.exe
1888	lsiss.exe
1420	systen.exe
5068	rar.exe
1296	lsiss.exe
5420	systen.exe
4696	rar.exe
5040	lsiss.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	cmd.exe
File opened (read-only)	\??\g:	cmd.exe
File opened (read-only)	\??\h:	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\WinRAR	rar.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1972	WScript.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	\??\c:\windows\web\lsiss.exe	cmd.exe
File created	\??\c:\windows\web\lsiss.txt	rar.exe
File opened for modification	\??\c:\windows\web\lsiss.exe	cmd.exe
File opened for modification	\??\c:\windows\web\lsiss.exe	cmd.exe
File opened for modification	\??\c:\windows\web\lsiss.txt	rar.exe
File created	\??\c:\windows\web\lsiss.txt	rar.exe
File opened for modification	\??\c:\windows\web\lsiss.txt	rar.exe
File opened for modification	\??\c:\windows\web\lsiss.exe	cmd.exe
File created	\??\c:\windows\web\lsiss.txt	rar.exe
File opened for modification	\??\c:\windows\web\lsiss.txt	rar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3824	cmd.exe
3436	cmd.exe
6108	cmd.exe
2532	cmd.exe
1288	cmd.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
988	1888	WerFault.exe	103
2136	1296	WerFault.exe	122
1052	5040	WerFault.exe	129

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	systen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	systen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	systen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	systen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	systen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	systen.exe

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsiss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Genome.svoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsiss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsiss.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5128	rar.exe
5844	PING.EXE
260	rar.exe
5068	rar.exe
4696	rar.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4360	taskkill.exe

Modifies data under HKEY_USERS 22 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\scrcons.exe	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\scrcons.exe	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{35786D3C-B075-49B9-88DD-029876E11C01} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 01000000000000005eb48b14345fdd01	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\scrcons.exe\VBScriptSetScriptStateStarted = "240783062"	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0"	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{289AF617-1CC3-42A6-926C-E6A863F0E3BA} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 010000000000000038608a14345fdd01	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry	scrcons.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5844	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4360	taskkill.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2808	jaffacakes118_Trojan.Win32.Genome.svoj.exe
2864	systen.exe
1420	systen.exe
5420	systen.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 3824	2808	jaffacakes118_Trojan.Win32.Genome.svoj.exe	89
PID 3824 wrote to memory of 4360	3824	cmd.exe	91
PID 3824 wrote to memory of 5128	3824	cmd.exe	93
PID 2808 wrote to memory of 3436	2808	jaffacakes118_Trojan.Win32.Genome.svoj.exe	94
PID 3436 wrote to memory of 5844	3436	cmd.exe	96
PID 3436 wrote to memory of 4368	3436	cmd.exe	97
PID 3824 wrote to memory of 2864	3824	cmd.exe	98
PID 3824 wrote to memory of 1972	3824	cmd.exe	99
PID 2864 wrote to memory of 6108	2864	systen.exe	100
PID 6108 wrote to memory of 260	6108	cmd.exe	102
PID 6108 wrote to memory of 1888	6108	cmd.exe	103
PID 3824 wrote to memory of 4308	3824	cmd.exe	107
PID 3824 wrote to memory of 3100	3824	cmd.exe	108
PID 3824 wrote to memory of 1124	3824	cmd.exe	109
PID 3824 wrote to memory of 1868	3824	cmd.exe	110
PID 3824 wrote to memory of 6008	3824	cmd.exe	111
PID 3824 wrote to memory of 1780	3824	cmd.exe	112
PID 3824 wrote to memory of 3296	3824	cmd.exe	113
PID 3824 wrote to memory of 3724	3824	cmd.exe	114
PID 3824 wrote to memory of 3128	3824	cmd.exe	115
PID 3824 wrote to memory of 2332	3824	cmd.exe	116
PID 1960 wrote to memory of 1420	1960	scrcons.exe	118
PID 1420 wrote to memory of 2532	1420	systen.exe	119
PID 2532 wrote to memory of 5068	2532	cmd.exe	121
PID 2532 wrote to memory of 1296	2532	cmd.exe	122
PID 1960 wrote to memory of 5420	1960	scrcons.exe	125
PID 5420 wrote to memory of 1288	5420	systen.exe	126
PID 1288 wrote to memory of 4696	1288	cmd.exe	128
PID 1288 wrote to memory of 5040	1288	cmd.exe	129

Views/modifies file attributes 1 TTPs 11 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4368	attrib.exe
1124	attrib.exe
6008	attrib.exe
2332	attrib.exe
4308	attrib.exe
3100	attrib.exe
1868	attrib.exe
1780	attrib.exe
3296	attrib.exe
3724	attrib.exe
3128	attrib.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Genome.svoj.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Genome.svoj.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\temp\125.bat
  2⤵
  - Enumerates connected drives
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /t /im ksafetray.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4360
- - \??\c:\windows\temp\rar.exe
    "c:\windows\temp\Rar.exe" e -y -ping c:\windows\temp\usbhard.rar c:\windows\temp\
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5128
- - \??\c:\windows\temp\systen.exe
    c:\windows\temp\systen.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\windows\temp\ok.bat
      4⤵
      Drops file in Windows directory
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6108
    - - \??\c:\windows\temp\rar.exe
        
        "c:\windows\temp\Rar.exe" e -y -ping c:\windows\temp\ok.rar c:\windows\web\
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:260
    - - \??\c:\windows\web\lsiss.exe
        
        c:\windows\web\lsiss.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1888
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 584
        6⤵
        Program crash
        
        PID:988
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\windows\temp\00.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:1972
- - C:\Windows\SysWOW64\attrib.exe
    attrib -H -R d:\~1
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4308
- - C:\Windows\SysWOW64\attrib.exe
    attrib +H +R d:\setprter
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3100
- - C:\Windows\SysWOW64\attrib.exe
    attrib -H -R e:\~1
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1124
- - C:\Windows\SysWOW64\attrib.exe
    attrib +H +R e:\setprter
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1868
- - C:\Windows\SysWOW64\attrib.exe
    attrib -H -R f:\~1
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:6008
- - C:\Windows\SysWOW64\attrib.exe
    attrib +H +R f:\setprter
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1780
- - C:\Windows\SysWOW64\attrib.exe
    attrib -H -R g:\~1
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3296
- - C:\Windows\SysWOW64\attrib.exe
    attrib +H +R g:\setprter
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3724
- - C:\Windows\SysWOW64\attrib.exe
    attrib -H -R h:\~1
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3128
- - C:\Windows\SysWOW64\attrib.exe
    attrib +H +R h:\setprter
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\11a.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5844
- - C:\Windows\SysWOW64\attrib.exe
    attrib -S -H c:\ma.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1888 -ip 1888
1⤵
PID:5924

C:\Windows\system32\wbem\scrcons.exe
C:\Windows\system32\wbem\scrcons.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\Temp\systen.exe
  "C:\Windows\Temp\systen.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\temp\ok.bat
    3⤵
    - Drops file in Windows directory
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2532
  - - \??\c:\windows\temp\rar.exe
      "c:\windows\temp\Rar.exe" e -y -ping c:\windows\temp\ok.rar c:\windows\web\
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5068
  - - \??\c:\windows\web\lsiss.exe
      c:\windows\web\lsiss.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1296
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 240
        5⤵
        Program crash
        
        PID:2136
- C:\Windows\Temp\systen.exe
  "C:\Windows\Temp\systen.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5420
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\temp\ok.bat
    3⤵
    - Drops file in Windows directory
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - \??\c:\windows\temp\rar.exe
      "c:\windows\temp\Rar.exe" e -y -ping c:\windows\temp\ok.rar c:\windows\web\
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4696
  - - \??\c:\windows\web\lsiss.exe
      c:\windows\web\lsiss.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5040
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 548
        5⤵
        Program crash
        
        PID:1052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1296 -ip 1296
1⤵
PID:4372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5040 -ip 5040
1⤵
PID:5656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

11a.bat

Path C:\Users\Admin\AppData\Local\Temp\11a.bat
Size 232B
SHA256 0c0668bd908ce7cc1ce18e6dadf798d4ed46314076af4d6a6ee117fbfe7a0f9d
MD5 f5c79f9a14902ae4632cd77af2bdb27a
SHA1 6fd8c6970a8eeb97decb5e08ff1f9a4b3991a797
SHA512 9652ed36d0d135fdc9a4c5d4129ba49ff51c4eb68f97f90b83acf65b997bf3feec4b2df53c7174b1611a3fd752023c49e76bc47d0461b82841287ca11129860b
TLSH
T193D0A70B83C5857D0904A713C93C15CFD81BC85C3FCBAE204793C4EC94A9445AA8F192
MD5 SHA1 SHA512 TLSH

Submit Download

00.vbs

Path C:\Windows\Temp\00.vbs
Size 7.6MB
SHA256 e0bc7b8791cd114fdeee71b74eefff4b082aa40b8e0faa4da96a59078bf4cef2
MD5 77f1964e875de9428df60e2fd0828596
SHA1 bfc421cf4036962782375fda03a98a282a8812be
SHA512 3ed10c132b53df33c9dd4ed611f32cfa97c95d181333b1d82214eeae5cf2724f50d37ff38ddb41c979d16ed73be2a61b1b06c81d6f950690f5747a8a870d548e
SSDEEP 192:SBscGhLdzh2ZTgGzoIGzNvP0dGzvHJl/dGzNzuu0:SBOh2Zlzopz9P/z7szFuu0
TLSH
T1AB86AF86BBC407EAF98816F802A8966344F2D569343525C5FFF94713B73AAB13C1C238
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1.txt

Path C:\Windows\Temp\1.txt
Size 498B
SHA256 6e896c155882c88af057790e1552b5f0207ce93be682e74b29883f3e6ac3254f
MD5 d5254882737cac7d09ebb46ec1e8fc17
SHA1 053bae287947082bddf60e880c98dbf52a4e8f1f
SHA512 10fe685069836df41e198783164ca21fe414889d6625bd9b3d8327ff8085a383bb811176484cce19327e522e1971d38e1ee1900842b124f62d48eff631276c11
TLSH
T1BEF09B1D4EF7D5C93091F38813490790B7FA55A27155401479ED078B8BF183A375F6A9
MD5 SHA1 SHA512 TLSH

Submit Download

00.txt

Path \??\c:\windows\temp\00.txt
Size 7.6MB
SHA256 c95ddc9723d5059fd9934edd8aea539cff5e6479285a631ff101773ec12c17ea
MD5 db40c3f730de6968349a661cd46875ff
SHA1 c5bbd7957201166e2c8d863a49757ddd0bebabfa
SHA512 59a48a00b96b94a2042b10ccdf0e8b09103d6fbd639d7d5802d4db5267b6b003dd75d16d3e9ade21d180987ec8add74a4f71c652ce099af26dea8e63020f0503
SSDEEP 192:SBscGhLdzh2ZTgGzoIGzNvP0dGzvHJl/dGzNzuu:SBOh2Zlzopz9P/z7szFuu
TLSH
T1D0865A86B7840BEAF98816F801A8966744F2D569383525C9FFF25713B53EAB13C1C638
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

125.bat

Path \??\c:\windows\temp\125.bat
Size 1KB
SHA256 f4049d98eeead98dbf1ba8b1ee8db45cc9ab9a1d240b5265f6ccc618de3a44c0
MD5 7526ddc332792483e84261659cd39aed
SHA1 384fbe01332a6302bc6a3c77025e1dc71185f952
SHA512 c8a5dd7da77ba8711662af2efb4a9b3c94f53df6069d56a07a08065c817feee9cae44dd83b383577aa80ab421068ac9dcfa0e84b91880af67a452eb580689e13
TLSH
T1F221B19C62CADA3B54A09562CF9E3ED3758BF04A0F309A213B9C51995054A33A733ED9
MD5 SHA1 SHA512 TLSH

Submit Download

md5.txt

Path \??\c:\windows\temp\md5.txt
Size 498B
SHA256 22bf3062b8aec41e03c60c528f9cea21f32ff190aa99c8eb9d897599b3b896f3
MD5 481cbb0cda65a5a643487f7f9f284de2
SHA1 9dcd9605515af0b54e12e667537b6af4473c87a3
SHA512 3505b687f9dfddb1d8cb37dbb5d8def68d0f62a3a8c79d228e5d616b335d40011c93b43828e1bd67459821069efd98a5c95926606501d07a27fa388b7ec22529
TLSH
T15AF065094EF2D6C93091F24813990B90B7EA55927155401439ED074A8BF183A774F2A9
MD5 SHA1 SHA512 TLSH

Submit Download

ok.bat

Path \??\c:\windows\temp\ok.bat
Size 368B
SHA256 31514d44c421799d991dd0b8d001e45eadd5d880946c15f846856b35e10d5565
MD5 971b72c1a1297f1a5b828e7eb011ef98
SHA1 8f42402ff6b452b55c243c746cb00e78131c7fba
SHA512 b0851262fd6cd04aaa3c1a947d10ccba1c5c91aeba02e0e0a131c7f5195d0948c82794cab9642ac32dcce19f550122ed40dcbdd43c5e4eea53b8e9274c5b3466
TLSH
T1FAE07E6927C7C660C06465B887DEBB13488AF25A1F6029617B5508DA7518133F332ED4
MD5 SHA1 SHA512 TLSH

Submit Download

ok.rar

Path \??\c:\windows\temp\ok.rar
Size 232KB
SHA256 9b7b6ce21bd6d55fc8320386dc2d1af853d927e2457aa80a7186f23d9cb2505a
MD5 ecef67817c51f3f09a5593a8d3aefbc3
SHA1 e1748fbd40e38ea07d0b801eac95d89de141e5da
SHA512 065d4af28a1eb42d1fb8e982758803b648207718c22fe90d1b4b32d3041b78e99ff356c7fbad600d04fee45e41367db8e9d18320045b599be85b96a96c252814
SSDEEP 6144:SUSzPZinsVYQOYew7PaJCQ2AmKzpH/Jrl/mJuFlY:SDDZAgesPaJChYBrl+JuFm
TLSH
T1FF3423D77A8484F262C72691DBB5811E9F952BF4178F37AD3363443B6A890D33F90622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path \??\c:\windows\temp\rar.exe
Size 310KB
SHA256 c7d6bfe9d26d1ecdd9f2e7f3f892a4d32030949937f86938edcb1995655c2814
MD5 0a5680183c0089a64621e211917664d8
SHA1 8525d73c99e28413e97a094c99950e1806786246
SHA512 b843b8994c764c3761bef8d34eefb312c9d9567b3f4aadc38008caf42d0cdb82c33276203e4210adcc1e8c567268ebdf01a0a1e839694811932889ac971bb051
SSDEEP 6144:tfeEyfmsgmkDQbnbNEsLcyB+rtRC6H27LAYcTmMt2X2zPBjX2tKqW:he/fm1jD7GckEw2MAYcaMAK
TLSH
T152649F25EB868276C0504630289EAB32B17FA73933311597A3CC9DA57FF3291F91479E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usbhard.rar

Path \??\c:\windows\temp\usbhard.rar
Size 5KB
SHA256 1dc23f23fecff10a0fb4ce5d18eea801bb1f851d51ce2023b1b19c859fdcded0
MD5 62b9eb2d18689daf231c4297219ecc97
SHA1 02d23d2de3a2a2f0cf7e743f0b993e962e5e51c1
SHA512 86337d29d9d1b9d8a4f6a71bc22062429442743d4879bbd09df9e616e4093cebb3b1494eefbcd76d216b237264cb9fd4d802cb5d32710726942f0b771e57c4ff
SSDEEP 96:d0zeV64Ngs/hQrSKZMGS0MOrVRGDdnO7Yqwu0EJufNZYpI6u8FUPi+E1oxBAy4jc:d0hbspQrqGSIRGDdnOVwRcufN4IJP618
TLSH
T137C19FE1D4B40852C8DBF6F280E7965227C246D9BE8E94A5575DEC4EBC802FC242521E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsiss.exe

Path \??\c:\windows\web\lsiss.exe
Size 55.6MB
SHA256 4884be410d263d39a1138beea213049a2f22f405a25c42378ab8ff1036178e7a
MD5 171c1b8b56b082d9d63af9068b2c08aa
SHA1 cea5e4d48ea03a8aa7dc8334fec00c80c56ceb6b
SHA512 c49508d8c506c37c00ebd0400d47e70099a4f9ed4d6e9755bd1b7ccb7934c81ea0909874dcb87cbf6f92407df68ed7f0d2a6d6618fa50d02d7f5a38ef2dbd217
SSDEEP 3072:QPrz9+/HQLvYKTFmpTZWuetGsGMzMv69D4WrzOSsvZzkuDj3mw2/hSussb8Io+tD:MrqHOYYmlIGbi9VrERLvY/h1ssb7tc3m
TLSH
T1F8D7121FDE17B4ADDC514B78828BD289FD747F507A50832231A0BF9F6E71AE01A245B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-56-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1296-87-0x0000000000400000-0x00000000004EB000-memory.dmp

Download

memory/1296-84-0x0000000000400000-0x00000000004EB000-memory.dmp

Download

memory/1888-64-0x0000000000400000-0x00000000004EB000-memory.dmp

Download

memory/1888-67-0x0000000000400000-0x00000000004EB000-memory.dmp

Download

memory/2808-27-0x0000000000400000-0x000000000049A000-memory.dmp

Download

memory/2808-0-0x0000000000400000-0x000000000049A000-memory.dmp

Download

memory/2808-1-0x00000000007D0000-0x00000000007D3000-memory.dmp

Download

memory/2808-22-0x00000000007D0000-0x00000000007D3000-memory.dmp

Download

memory/2808-21-0x0000000000400000-0x000000000049A000-memory.dmp

Download

memory/4696-98-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5040-107-0x0000000000400000-0x00000000004EB000-memory.dmp

Download

memory/5040-109-0x0000000000400000-0x00000000004EB000-memory.dmp

Download

memory/5068-77-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5128-20-0x0000000000400000-0x0000000000460000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads