nanocore | 5863913433ca1a0aff0ceb63ab3ba5ca4982659bca1b0b8af45a1f5be088d121

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15fbf5c441a3a705ec430d6a1519cf8b_JaffaCakes118.exe
Size

707KB
MD5

15fbf5c441a3a705ec430d6a1519cf8b
SHA1

7aa237162fbffbfdb0b3a525e65c3a3e2554fe61
SHA256

5863913433ca1a0aff0ceb63ab3ba5ca4982659bca1b0b8af45a1f5be088d121
SHA512

ed66a459be4bc82b581ce754d6dbfd0a0fa374ba936e17eb715e054aea992fa8bb37c11f4456f19f5b7e36bb852badc3e25fd00a55196c1d766aa95538be13a9
SSDEEP

6144:D1sTA5l4k8ftRBljcnQBj7wKeA93xYb38KGZSAaWO9G5RSIDgsePXdoxPH+GzXc+:2lRbjN7jYVJ9SUIPe/iRH0SzZ

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

lewisshh.ddns.net:2059

127.0.0.1:2059

Mutex

754fc428-5cea-4b8d-8321-8e90eade8ae1

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
37.235.1.177
buffer_size
65535
build_time
2018-01-02T16:18:50.794116536Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
2059
default_group
Mortgage
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
754fc428-5cea-4b8d-8321-8e90eade8ae1
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
lewisshh.ddns.net
primary_dns_server
37.235.1.174
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Executes dropped EXE 2 IoCs

Processes:

filename.exefilename.exe

pid process

3292 filename.exe
4564 filename.exe

pid	process
3292	filename.exe
4564	filename.exe

Unexpected DNS network traffic destination 10 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	37.235.1.177
Destination IP	37.235.1.174
Destination IP	37.235.1.177
Destination IP	37.235.1.174
Destination IP	37.235.1.174
Destination IP	37.235.1.174
Destination IP	37.235.1.177
Destination IP	37.235.1.174
Destination IP	37.235.1.177
Destination IP	37.235.1.177

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exefilename.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Service = "C:\\Program Files (x86)\\DHCP Service\\dhcpsv.exe"	filename.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

filename.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA filename.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

filename.exe

description pid process target process

PID 3292 set thread context of 4564 3292 filename.exe filename.exe
Drops file in Program Files directory 2 IoCs

Processes:

filename.exe

description ioc process

File created C:\Program Files (x86)\DHCP Service\dhcpsv.exe filename.exe
File opened for modification C:\Program Files (x86)\DHCP Service\dhcpsv.exe filename.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

filename.exe

pid process

4564 filename.exe
4564 filename.exe
4564 filename.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

filename.exe

pid process

4564 filename.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

15fbf5c441a3a705ec430d6a1519cf8b_JaffaCakes118.exefilename.exefilename.exe

description pid process

Token: SeDebugPrivilege 1648 15fbf5c441a3a705ec430d6a1519cf8b_JaffaCakes118.exe
Token: SeDebugPrivilege 3292 filename.exe
Token: SeDebugPrivilege 4564 filename.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	filename.exe

description	pid	process	target process
PID 3292 set thread context of 4564	3292	filename.exe	filename.exe

description	ioc	process
File created	C:\Program Files (x86)\DHCP Service\dhcpsv.exe	filename.exe
File opened for modification	C:\Program Files (x86)\DHCP Service\dhcpsv.exe	filename.exe

pid	process
4564	filename.exe
4564	filename.exe
4564	filename.exe

pid	process
4564	filename.exe

description	pid	process
Token: SeDebugPrivilege	1648	15fbf5c441a3a705ec430d6a1519cf8b_JaffaCakes118.exe
Token: SeDebugPrivilege	3292	filename.exe
Token: SeDebugPrivilege	4564	filename.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

15fbf5c441a3a705ec430d6a1519cf8b_JaffaCakes118.execmd.exefilename.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1648 wrote to memory of 208	1648	15fbf5c441a3a705ec430d6a1519cf8b_JaffaCakes118.exe	cmd.exe
PID 1648 wrote to memory of 208	1648	15fbf5c441a3a705ec430d6a1519cf8b_JaffaCakes118.exe	cmd.exe
PID 1648 wrote to memory of 208	1648	15fbf5c441a3a705ec430d6a1519cf8b_JaffaCakes118.exe	cmd.exe
PID 208 wrote to memory of 3292	208	cmd.exe	filename.exe
PID 208 wrote to memory of 3292	208	cmd.exe	filename.exe
PID 208 wrote to memory of 3292	208	cmd.exe	filename.exe
PID 3292 wrote to memory of 4512	3292	filename.exe	cmd.exe
PID 3292 wrote to memory of 4512	3292	filename.exe	cmd.exe
PID 3292 wrote to memory of 4512	3292	filename.exe	cmd.exe
PID 4512 wrote to memory of 1044	4512	cmd.exe	reg.exe
PID 4512 wrote to memory of 1044	4512	cmd.exe	reg.exe
PID 4512 wrote to memory of 1044	4512	cmd.exe	reg.exe
PID 3292 wrote to memory of 4564	3292	filename.exe	filename.exe
PID 3292 wrote to memory of 4564	3292	filename.exe	filename.exe
PID 3292 wrote to memory of 4564	3292	filename.exe	filename.exe
PID 3292 wrote to memory of 4564	3292	filename.exe	filename.exe
PID 3292 wrote to memory of 4564	3292	filename.exe	filename.exe
PID 3292 wrote to memory of 4564	3292	filename.exe	filename.exe
PID 3292 wrote to memory of 4564	3292	filename.exe	filename.exe
PID 3292 wrote to memory of 4564	3292	filename.exe	filename.exe
PID 3292 wrote to memory of 1580	3292	filename.exe	cmd.exe
PID 3292 wrote to memory of 1580	3292	filename.exe	cmd.exe
PID 3292 wrote to memory of 1580	3292	filename.exe	cmd.exe
PID 1580 wrote to memory of 1888	1580	cmd.exe	reg.exe
PID 1580 wrote to memory of 1888	1580	cmd.exe	reg.exe
PID 1580 wrote to memory of 1888	1580	cmd.exe	reg.exe
PID 3292 wrote to memory of 3780	3292	filename.exe	cmd.exe
PID 3292 wrote to memory of 3780	3292	filename.exe	cmd.exe
PID 3292 wrote to memory of 3780	3292	filename.exe	cmd.exe
PID 3780 wrote to memory of 64	3780	cmd.exe	reg.exe
PID 3780 wrote to memory of 64	3780	cmd.exe	reg.exe
PID 3780 wrote to memory of 64	3780	cmd.exe	reg.exe
PID 3292 wrote to memory of 3280	3292	filename.exe	cmd.exe
PID 3292 wrote to memory of 3280	3292	filename.exe	cmd.exe
PID 3292 wrote to memory of 3280	3292	filename.exe	cmd.exe
PID 3280 wrote to memory of 3896	3280	cmd.exe	reg.exe
PID 3280 wrote to memory of 3896	3280	cmd.exe	reg.exe
PID 3280 wrote to memory of 3896	3280	cmd.exe	reg.exe
PID 3292 wrote to memory of 3036	3292	filename.exe	cmd.exe
PID 3292 wrote to memory of 3036	3292	filename.exe	cmd.exe
PID 3292 wrote to memory of 3036	3292	filename.exe	cmd.exe
PID 3036 wrote to memory of 440	3036	cmd.exe	reg.exe
PID 3036 wrote to memory of 440	3036	cmd.exe	reg.exe
PID 3036 wrote to memory of 440	3036	cmd.exe	reg.exe
PID 3292 wrote to memory of 4856	3292	filename.exe	cmd.exe
PID 3292 wrote to memory of 4856	3292	filename.exe	cmd.exe
PID 3292 wrote to memory of 4856	3292	filename.exe	cmd.exe
PID 4856 wrote to memory of 4984	4856	cmd.exe	reg.exe
PID 4856 wrote to memory of 4984	4856	cmd.exe	reg.exe
PID 4856 wrote to memory of 4984	4856	cmd.exe	reg.exe
PID 3292 wrote to memory of 1576	3292	filename.exe	cmd.exe
PID 3292 wrote to memory of 1576	3292	filename.exe	cmd.exe
PID 3292 wrote to memory of 1576	3292	filename.exe	cmd.exe
PID 1576 wrote to memory of 3208	1576	cmd.exe	reg.exe
PID 1576 wrote to memory of 3208	1576	cmd.exe	reg.exe
PID 1576 wrote to memory of 3208	1576	cmd.exe	reg.exe
PID 3292 wrote to memory of 1424	3292	filename.exe	cmd.exe
PID 3292 wrote to memory of 1424	3292	filename.exe	cmd.exe
PID 3292 wrote to memory of 1424	3292	filename.exe	cmd.exe
PID 1424 wrote to memory of 1188	1424	cmd.exe	reg.exe
PID 1424 wrote to memory of 1188	1424	cmd.exe	reg.exe
PID 1424 wrote to memory of 1188	1424	cmd.exe	reg.exe
PID 3292 wrote to memory of 4972	3292	filename.exe	cmd.exe
PID 3292 wrote to memory of 4972	3292	filename.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\15fbf5c441a3a705ec430d6a1519cf8b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\15fbf5c441a3a705ec430d6a1519cf8b_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\SysWOW64\cmd.exe
"cmd"
2⤵
- Suspicious use of WriteProcessMemory
PID:208

C:\Users\Admin\AppData\Roaming\filename.exe
"C:\Users\Admin\AppData\Roaming\filename.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3292

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
- Suspicious use of WriteProcessMemory
PID:4512

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1044

C:\Users\Admin\AppData\Roaming\filename.exe
"C:\Users\Admin\AppData\Roaming\filename.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4564

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
- Suspicious use of WriteProcessMemory
PID:1580

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1888

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
- Suspicious use of WriteProcessMemory
PID:3780

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:64

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
- Suspicious use of WriteProcessMemory
PID:3280

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:3896

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
- Suspicious use of WriteProcessMemory
PID:3036

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:440

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
- Suspicious use of WriteProcessMemory
PID:4856

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
PID:4984

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
- Suspicious use of WriteProcessMemory
PID:1576

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:3208

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
- Suspicious use of WriteProcessMemory
PID:1424

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1188

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:4972

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:4032

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:4104

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:4088

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1996

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
PID:3260

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:4804

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:844

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1020

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:5108

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:4708

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2368

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2400

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:452

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1076

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:4320

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:3004

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1324

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1336

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1072

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2764

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
PID:3780

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1924

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:3936

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:3872

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:404

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2016

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
PID:4544

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:940

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:3092

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:4924

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:4408

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1184

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2248

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:4040

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:4112

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:3188

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:4204

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1424

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:5052

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:3680

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
PID:4184

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1720

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1248

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:848

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1684

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1068

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1308

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:4896

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1136

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:3760

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1996

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1568

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
PID:368

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:4688

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1484

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:4224

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:984

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2544

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2596

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:4884

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:556

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:4976

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:4312

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:4300

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1288

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1404

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
PID:2436

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1392

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:4728

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:3592

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:4676

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1144

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1836

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:4964

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1076

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2016

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1216

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:4332

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:3480

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2388

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:3724

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:3552

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2600

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:3912

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:3220

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:4792

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:4992

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1684

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2208

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:4940

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
PID:3260

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:3420

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2492

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:436

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2232

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:4472

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:5064

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:4296

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:924

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:4456

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2836

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1568

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1540

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:804

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:3764

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:4860

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:2556

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2192

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
PID:5048

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2784

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1616

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:3040

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:1828

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:2500

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:4996

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:4872

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:880

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1600

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:4300

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:4884

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:5000

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:4544

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:940

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:440

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:4776

C:\Windows\SysWOW64\cmd.exe
"cmd"
4⤵
PID:1552

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
5⤵
- Adds Run key to start application
PID:3788

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Update.txt
Filesize
55B

MD5
9fa63bc1c3e14f3681eaa6a8e3cb520f

SHA1
e09533153a5c8c9eed0e2f4fc3d640c58553e17b

SHA256
1c7939bb6d60f70680c3a861bf8ad56ac7453b552c5bc8339908df427442d8d2

SHA512
ed4a0c39606edfdd0a94c55718587058eb499640c052d8f6758177d0aba84ac6562fab30727071d10eeadc6d3aacfbc3e3b443f51c48d4b45ea08fdad720c1f6

Download Submit
C:\Users\Admin\AppData\Roaming\filename.exe
Filesize
707KB

MD5
15fbf5c441a3a705ec430d6a1519cf8b

SHA1
7aa237162fbffbfdb0b3a525e65c3a3e2554fe61

SHA256
5863913433ca1a0aff0ceb63ab3ba5ca4982659bca1b0b8af45a1f5be088d121

SHA512
ed66a459be4bc82b581ce754d6dbfd0a0fa374ba936e17eb715e054aea992fa8bb37c11f4456f19f5b7e36bb852badc3e25fd00a55196c1d766aa95538be13a9

Download Submit
memory/1648-0-0x0000000074A02000-0x0000000074A03000-memory.dmp

Filesize
4KB

Download
memory/1648-1-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/1648-2-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/1648-8-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/3292-10-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/3292-11-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/3292-9-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/3292-31-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/4564-13-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4564-16-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/4564-17-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/4564-18-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/4564-33-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download