Analysis
-
max time kernel
148s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 02:06
Static task
static1
Behavioral task
behavioral1
Sample
144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe
-
Size
216KB
-
MD5
144c2e51cf6cc1396a86bc8590e48597
-
SHA1
b419a014d93e5eedbb56b708232b8760cedec647
-
SHA256
a2ed374dfd4b4ebff19cca30d62e5365948b78d2197c3401658004fbe574d09d
-
SHA512
aa7552ad0c365dbf455bbccfc8f74f79a34f6f03b05ed80f114f4ecd6f66b40c00f20d50511ef3ce38c46d223374fdc614ebe91ce34799db4421cda1a0412215
-
SSDEEP
3072:RTBBrEo8iWZmgfTzRvHDfQxfjIm4nfIg5TbbdPM2yldxj0wJVUHIW1Urbrh0:RjwV/drIrunAg53BPMtdB0LI
Malware Config
Extracted
latentbot
games939393.zapto.org
Signatures
-
Modifies firewall policy service 3 TTPs 10 IoCs
Processes:
reg.exereg.exereg.exereg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe:*:Enabled:Windows Messanger" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\U57OXUBMC0.exe = "C:\\Users\\Admin\\AppData\\Roaming\\U57OXUBMC0.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\U57OXUBMC0.exe" 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Processes:
144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7C5F4CEF-5CBE-AEAB-00CB-A5C9AE6EBEC4} 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7C5F4CEF-5CBE-AEAB-00CB-A5C9AE6EBEC4}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\U57OXUBMC0.exe" 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{7C5F4CEF-5CBE-AEAB-00CB-A5C9AE6EBEC4} 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{7C5F4CEF-5CBE-AEAB-00CB-A5C9AE6EBEC4}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\U57OXUBMC0.exe" 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
Processes:
144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exepid process 5820 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral2/memory/2172-8-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/2172-13-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/2172-14-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/2172-12-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/2172-18-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/2172-22-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/2172-23-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/2172-26-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/2172-27-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/2172-30-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/2172-35-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/2172-45-0x0000000000400000-0x0000000000473000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\U57OXUBMC0.exe" 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\U57OXUBMC0.exe" 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exedescription pid process target process PID 5820 set thread context of 5652 5820 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe PID 5652 set thread context of 2172 5652 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe -
Modifies registry key 1 TTPs 4 IoCs
Processes:
reg.exereg.exereg.exereg.exepid process 3564 reg.exe 3644 reg.exe 3296 reg.exe 3676 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
Processes:
144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exedescription pid process Token: 1 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeCreateTokenPrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeAssignPrimaryTokenPrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeLockMemoryPrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeMachineAccountPrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeTcbPrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeSecurityPrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeSystemtimePrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeCreatePermanentPrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeBackupPrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeRestorePrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeShutdownPrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeDebugPrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeAuditPrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeUndockPrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeSyncAgentPrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeEnableDelegationPrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeManageVolumePrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeImpersonatePrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: 31 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: 32 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: 33 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: 34 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: 35 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe Token: SeDebugPrivilege 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exepid process 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.execmd.execmd.execmd.execmd.exedescription pid process target process PID 5820 wrote to memory of 5652 5820 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe PID 5820 wrote to memory of 5652 5820 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe PID 5820 wrote to memory of 5652 5820 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe PID 5820 wrote to memory of 5652 5820 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe PID 5820 wrote to memory of 5652 5820 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe PID 5820 wrote to memory of 5652 5820 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe PID 5820 wrote to memory of 5652 5820 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe PID 5652 wrote to memory of 2172 5652 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe PID 5652 wrote to memory of 2172 5652 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe PID 5652 wrote to memory of 2172 5652 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe PID 5652 wrote to memory of 2172 5652 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe PID 5652 wrote to memory of 2172 5652 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe PID 5652 wrote to memory of 2172 5652 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe PID 5652 wrote to memory of 2172 5652 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe PID 5652 wrote to memory of 2172 5652 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe PID 2172 wrote to memory of 3464 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe cmd.exe PID 2172 wrote to memory of 3464 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe cmd.exe PID 2172 wrote to memory of 3464 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe cmd.exe PID 2172 wrote to memory of 5320 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe cmd.exe PID 2172 wrote to memory of 5320 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe cmd.exe PID 2172 wrote to memory of 5320 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe cmd.exe PID 2172 wrote to memory of 3980 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe cmd.exe PID 2172 wrote to memory of 3980 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe cmd.exe PID 2172 wrote to memory of 3980 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe cmd.exe PID 2172 wrote to memory of 3924 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe cmd.exe PID 2172 wrote to memory of 3924 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe cmd.exe PID 2172 wrote to memory of 3924 2172 144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe cmd.exe PID 5320 wrote to memory of 3296 5320 cmd.exe reg.exe PID 5320 wrote to memory of 3296 5320 cmd.exe reg.exe PID 5320 wrote to memory of 3296 5320 cmd.exe reg.exe PID 3924 wrote to memory of 3676 3924 cmd.exe reg.exe PID 3924 wrote to memory of 3676 3924 cmd.exe reg.exe PID 3924 wrote to memory of 3676 3924 cmd.exe reg.exe PID 3464 wrote to memory of 3644 3464 cmd.exe reg.exe PID 3464 wrote to memory of 3644 3464 cmd.exe reg.exe PID 3464 wrote to memory of 3644 3464 cmd.exe reg.exe PID 3980 wrote to memory of 3564 3980 cmd.exe reg.exe PID 3980 wrote to memory of 3564 3980 cmd.exe reg.exe PID 3980 wrote to memory of 3564 3980 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe"3⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\144c2e51cf6cc1396a86bc8590e48597_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\U57OXUBMC0.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\U57OXUBMC0.exe:*:Enabled:Windows Messanger" /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\U57OXUBMC0.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\U57OXUBMC0.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Active Setup
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Active Setup
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\sjf1fb44be78fAg.dllFilesize
2KB
MD5fdb78e2feda0cf7d1d07c057277642e5
SHA15f227dee38ab653c60ae5a1fec9bd3e09a5f79f5
SHA2565eda823af4c45ba86b8365cf66fb18c54c45412826ac6a75280f625a50a8ede1
SHA5128f37f0c2543dc1e34f5f8b8fabb68f7be465888c49f4da89007c3ca2bf07a5e48a98aaae5f3b15a7910d4b83db02fb47a69b35fd5fd6f1343130cf6d5a0b3bec
-
memory/2172-18-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/2172-22-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/2172-45-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/2172-8-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/2172-13-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/2172-14-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/2172-35-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/2172-30-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/2172-12-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/2172-23-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/2172-26-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/2172-27-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/5652-4-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/5652-6-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/5652-7-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB