nanocore | 5863913433ca1a0aff0ceb63ab3ba5ca4982659bca1b0b8af45a1f5be088d121

Analysis

max time kernel
149s
max time network
147s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15fbf5c441a3a705ec430d6a1519cf8b_JaffaCakes118.exe
Size

707KB
MD5

15fbf5c441a3a705ec430d6a1519cf8b
SHA1

7aa237162fbffbfdb0b3a525e65c3a3e2554fe61
SHA256

5863913433ca1a0aff0ceb63ab3ba5ca4982659bca1b0b8af45a1f5be088d121
SHA512

ed66a459be4bc82b581ce754d6dbfd0a0fa374ba936e17eb715e054aea992fa8bb37c11f4456f19f5b7e36bb852badc3e25fd00a55196c1d766aa95538be13a9
SSDEEP

6144:D1sTA5l4k8ftRBljcnQBj7wKeA93xYb38KGZSAaWO9G5RSIDgsePXdoxPH+GzXc+:2lRbjN7jYVJ9SUIPe/iRH0SzZ

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

lewisshh.ddns.net:2059

127.0.0.1:2059

Mutex

754fc428-5cea-4b8d-8321-8e90eade8ae1

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
37.235.1.177
buffer_size
65535
build_time
2018-01-02T16:18:50.794116536Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
2059
default_group
Mortgage
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
754fc428-5cea-4b8d-8321-8e90eade8ae1
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
lewisshh.ddns.net
primary_dns_server
37.235.1.174
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Executes dropped EXE 2 IoCs

Processes:

filename.exefilename.exe

pid process

2768 filename.exe
2684 filename.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

2572 cmd.exe
2572 cmd.exe

pid	process
2768	filename.exe
2684	filename.exe

pid	process
2572	cmd.exe
2572	cmd.exe

Unexpected DNS network traffic destination 10 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	37.235.1.174
Destination IP	37.235.1.177
Destination IP	37.235.1.174
Destination IP	37.235.1.177
Destination IP	37.235.1.174
Destination IP	37.235.1.177
Destination IP	37.235.1.174
Destination IP	37.235.1.174
Destination IP	37.235.1.177
Destination IP	37.235.1.177

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exefilename.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DOS Manager = "C:\\Program Files (x86)\\DOS Manager\\dosmgr.exe"	filename.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

filename.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA filename.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

filename.exe

description pid process target process

PID 2768 set thread context of 2684 2768 filename.exe filename.exe
Drops file in Program Files directory 2 IoCs

Processes:

filename.exe

description ioc process

File created C:\Program Files (x86)\DOS Manager\dosmgr.exe filename.exe
File opened for modification C:\Program Files (x86)\DOS Manager\dosmgr.exe filename.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

filename.exe

pid process

2684 filename.exe
2684 filename.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

filename.exe

pid process

2684 filename.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

15fbf5c441a3a705ec430d6a1519cf8b_JaffaCakes118.exefilename.exefilename.exe

description pid process

Token: SeDebugPrivilege 2396 15fbf5c441a3a705ec430d6a1519cf8b_JaffaCakes118.exe
Token: SeDebugPrivilege 2768 filename.exe
Token: SeDebugPrivilege 2684 filename.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	filename.exe

description	pid	process	target process
PID 2768 set thread context of 2684	2768	filename.exe	filename.exe

description	ioc	process
File created	C:\Program Files (x86)\DOS Manager\dosmgr.exe	filename.exe
File opened for modification	C:\Program Files (x86)\DOS Manager\dosmgr.exe	filename.exe

pid	process
2684	filename.exe
2684	filename.exe

pid	process
2684	filename.exe

description	pid	process
Token: SeDebugPrivilege	2396	15fbf5c441a3a705ec430d6a1519cf8b_JaffaCakes118.exe
Token: SeDebugPrivilege	2768	filename.exe
Token: SeDebugPrivilege	2684	filename.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

15fbf5c441a3a705ec430d6a1519cf8b_JaffaCakes118.execmd.exefilename.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2396 wrote to memory of 2572	2396	15fbf5c441a3a705ec430d6a1519cf8b_JaffaCakes118.exe	cmd.exe
PID 2396 wrote to memory of 2572	2396	15fbf5c441a3a705ec430d6a1519cf8b_JaffaCakes118.exe	cmd.exe
PID 2396 wrote to memory of 2572	2396	15fbf5c441a3a705ec430d6a1519cf8b_JaffaCakes118.exe	cmd.exe
PID 2396 wrote to memory of 2572	2396	15fbf5c441a3a705ec430d6a1519cf8b_JaffaCakes118.exe	cmd.exe
PID 2572 wrote to memory of 2768	2572	cmd.exe	filename.exe
PID 2572 wrote to memory of 2768	2572	cmd.exe	filename.exe
PID 2572 wrote to memory of 2768	2572	cmd.exe	filename.exe
PID 2572 wrote to memory of 2768	2572	cmd.exe	filename.exe
PID 2768 wrote to memory of 2700	2768	filename.exe	cmd.exe
PID 2768 wrote to memory of 2700	2768	filename.exe	cmd.exe
PID 2768 wrote to memory of 2700	2768	filename.exe	cmd.exe
PID 2768 wrote to memory of 2700	2768	filename.exe	cmd.exe
PID 2700 wrote to memory of 2880	2700	cmd.exe	reg.exe
PID 2700 wrote to memory of 2880	2700	cmd.exe	reg.exe
PID 2700 wrote to memory of 2880	2700	cmd.exe	reg.exe
PID 2700 wrote to memory of 2880	2700	cmd.exe	reg.exe
PID 2768 wrote to memory of 2684	2768	filename.exe	filename.exe
PID 2768 wrote to memory of 2684	2768	filename.exe	filename.exe
PID 2768 wrote to memory of 2684	2768	filename.exe	filename.exe
PID 2768 wrote to memory of 2684	2768	filename.exe	filename.exe
PID 2768 wrote to memory of 2684	2768	filename.exe	filename.exe
PID 2768 wrote to memory of 2684	2768	filename.exe	filename.exe
PID 2768 wrote to memory of 2684	2768	filename.exe	filename.exe
PID 2768 wrote to memory of 2684	2768	filename.exe	filename.exe
PID 2768 wrote to memory of 2684	2768	filename.exe	filename.exe
PID 2768 wrote to memory of 2784	2768	filename.exe	cmd.exe
PID 2768 wrote to memory of 2784	2768	filename.exe	cmd.exe
PID 2768 wrote to memory of 2784	2768	filename.exe	cmd.exe
PID 2768 wrote to memory of 2784	2768	filename.exe	cmd.exe
PID 2784 wrote to memory of 2980	2784	cmd.exe	reg.exe
PID 2784 wrote to memory of 2980	2784	cmd.exe	reg.exe
PID 2784 wrote to memory of 2980	2784	cmd.exe	reg.exe
PID 2784 wrote to memory of 2980	2784	cmd.exe	reg.exe
PID 2768 wrote to memory of 2172	2768	filename.exe	cmd.exe
PID 2768 wrote to memory of 2172	2768	filename.exe	cmd.exe
PID 2768 wrote to memory of 2172	2768	filename.exe	cmd.exe
PID 2768 wrote to memory of 2172	2768	filename.exe	cmd.exe
PID 2172 wrote to memory of 2500	2172	cmd.exe	reg.exe
PID 2172 wrote to memory of 2500	2172	cmd.exe	reg.exe
PID 2172 wrote to memory of 2500	2172	cmd.exe	reg.exe
PID 2172 wrote to memory of 2500	2172	cmd.exe	reg.exe
PID 2768 wrote to memory of 2540	2768	filename.exe	cmd.exe
PID 2768 wrote to memory of 2540	2768	filename.exe	cmd.exe
PID 2768 wrote to memory of 2540	2768	filename.exe	cmd.exe
PID 2768 wrote to memory of 2540	2768	filename.exe	cmd.exe
PID 2540 wrote to memory of 2956	2540	cmd.exe	reg.exe
PID 2540 wrote to memory of 2956	2540	cmd.exe	reg.exe
PID 2540 wrote to memory of 2956	2540	cmd.exe	reg.exe
PID 2540 wrote to memory of 2956	2540	cmd.exe	reg.exe
PID 2768 wrote to memory of 2144	2768	filename.exe	cmd.exe
PID 2768 wrote to memory of 2144	2768	filename.exe	cmd.exe
PID 2768 wrote to memory of 2144	2768	filename.exe	cmd.exe
PID 2768 wrote to memory of 2144	2768	filename.exe	cmd.exe
PID 2144 wrote to memory of 1044	2144	cmd.exe	reg.exe
PID 2144 wrote to memory of 1044	2144	cmd.exe	reg.exe
PID 2144 wrote to memory of 1044	2144	cmd.exe	reg.exe
PID 2144 wrote to memory of 1044	2144	cmd.exe	reg.exe
PID 2768 wrote to memory of 1892	2768	filename.exe	cmd.exe
PID 2768 wrote to memory of 1892	2768	filename.exe	cmd.exe
PID 2768 wrote to memory of 1892	2768	filename.exe	cmd.exe
PID 2768 wrote to memory of 1892	2768	filename.exe	cmd.exe
PID 1892 wrote to memory of 2772	1892	cmd.exe	reg.exe
PID 1892 wrote to memory of 2772	1892	cmd.exe	reg.exe
PID 1892 wrote to memory of 2772	1892	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\15fbf5c441a3a705ec430d6a1519cf8b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\15fbf5c441a3a705ec430d6a1519cf8b_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396

C:\Windows\SysWOW64\cmd.exe
"cmd"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572

C:\Users\Admin\AppData\Roaming\filename.exe
"C:\Users\Admin\AppData\Roaming\filename.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2768

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
- Suspicious use of WriteProcessMemory
PID:2700

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2880

C:\Users\Admin\AppData\Roaming\filename.exe
"C:\Users\Admin\AppData\Roaming\filename.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2684

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
- Suspicious use of WriteProcessMemory
PID:2784

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2980

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
- Suspicious use of WriteProcessMemory
PID:2172

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2500

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
- Suspicious use of WriteProcessMemory
PID:2540

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2956

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
- Suspicious use of WriteProcessMemory
PID:2144

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1044

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2772

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2588

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2796

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2800

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2940

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1840

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:808

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1888

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2296

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:548

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2016

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1788

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1996

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2132

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:280

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:884

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2180

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1588

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1540

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1768

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2060

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2072

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
PID:1972

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2720

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
PID:2472

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1740

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:672

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:768

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:588

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:640

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1100

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2968

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2288

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1340

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:832

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2356

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2304

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:792

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2864

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1640

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1644

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:868

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2284

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1332

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
PID:1624

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:568

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2244

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:604

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1512

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:872

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
PID:2988

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:3004

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1608

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2860

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2856

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2572

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2580

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2616

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:3020

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2708

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2592

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2604

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2756

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2668

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2516

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2504

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2508

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1984

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2948

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2952

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:848

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1884

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
PID:1808

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2788

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2816

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2796

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2144

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2828

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
PID:2004

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1272

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1056

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2452

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1992

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1804

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2280

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1684

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2476

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:808

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:548

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1888

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2168

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2308

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1612

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2080

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1692

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1312

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2896

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1504

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
PID:2884

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2472

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1740

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1180

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1636

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1800

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1796

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:448

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1736

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1156

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:940

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1632

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1100

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2356

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
PID:3016

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:556

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
PID:840

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1712

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:864

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1304

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1660

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2104

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
PID:3048

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1252

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1316

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1512

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2988

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:868

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1744

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1596

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2676

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:3032

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1552

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1424

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1928

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2628

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
PID:2636

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2700

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2736

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Update.txt
Filesize
55B

MD5
9fa63bc1c3e14f3681eaa6a8e3cb520f

SHA1
e09533153a5c8c9eed0e2f4fc3d640c58553e17b

SHA256
1c7939bb6d60f70680c3a861bf8ad56ac7453b552c5bc8339908df427442d8d2

SHA512
ed4a0c39606edfdd0a94c55718587058eb499640c052d8f6758177d0aba84ac6562fab30727071d10eeadc6d3aacfbc3e3b443f51c48d4b45ea08fdad720c1f6

Download Submit
\Users\Admin\AppData\Roaming\filename.exe
Filesize
707KB

MD5
15fbf5c441a3a705ec430d6a1519cf8b

SHA1
7aa237162fbffbfdb0b3a525e65c3a3e2554fe61

SHA256
5863913433ca1a0aff0ceb63ab3ba5ca4982659bca1b0b8af45a1f5be088d121

SHA512
ed66a459be4bc82b581ce754d6dbfd0a0fa374ba936e17eb715e054aea992fa8bb37c11f4456f19f5b7e36bb852badc3e25fd00a55196c1d766aa95538be13a9

Download Submit
memory/2396-0-0x0000000074521000-0x0000000074522000-memory.dmp

Filesize
4KB

Download
memory/2396-1-0x0000000074520000-0x0000000074ACB000-memory.dmp

Filesize
5.7MB

Download
memory/2396-2-0x0000000074520000-0x0000000074ACB000-memory.dmp

Filesize
5.7MB

Download
memory/2396-8-0x0000000074520000-0x0000000074ACB000-memory.dmp

Filesize
5.7MB

Download
memory/2684-23-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2684-15-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2684-19-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2684-28-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2684-26-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2684-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2684-17-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2684-13-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2768-10-0x0000000074520000-0x0000000074ACB000-memory.dmp

Filesize
5.7MB

Download
memory/2768-11-0x0000000074520000-0x0000000074ACB000-memory.dmp

Filesize
5.7MB

Download
memory/2768-9-0x0000000074520000-0x0000000074ACB000-memory.dmp

Filesize
5.7MB

Download
memory/2768-43-0x0000000074520000-0x0000000074ACB000-memory.dmp

Filesize
5.7MB

Download