Analysis
- max time kernel
144s - max time network
134s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
01/04/2024, 11:18
Static task
static1
Behavioral task
behavioral1
Sample
708e82d516395597e3002f2da7537dad_JaffaCakes118.html
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
708e82d516395597e3002f2da7537dad_JaffaCakes118.html
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 708e82d516395597e3002f2da7537dad_JaffaCakes118.html
- Size 575KB
- Sample240401-nedp6ach8x
- SHA256 d0cde94b61367d75e21a4a5f473aad81aaddce6a45eb1255f2c24fe6cf6c9bdd
- MD5 708e82d516395597e3002f2da7537dad
- SHA1 f52e5785d5ccb41b50534a1f84f4fe0190af3cf3
- SHA512 162c5c3e9f1a22db89482679d57b9e33099c580c805c33541c17a44d9986fcabdf98740af8a4409f10e1dd04f40e5c3fc97daee006c7ba3f72a87461a811bb44
- SSDEEP 6144:SgHsMYod+X3oI+Y2sMYod+X3oI+YDsMYod+X3oI+Y5sMYod+X3oI+YEsMYod+X3+:hr5d+X3a5d+X3d5d+X3z5d+X3Y5d+X3+
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 9 IoCs
pid Process 2548 svchost.exe 2452 DesktopLayer.exe 2232 svchost.exe 2328 DesktopLayer.exe 2756 svchost.exe 2824 svchost.exe 2404 DesktopLayer.exe 1540 svchost.exe 1676 DesktopLayer.exe - Loads dropped DLL 6 IoCs
pid Process 2068 IEXPLORE.EXE 2548 svchost.exe 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE -
resource yara_rule behavioral1/files/0x0008000000016c15-2.dat upx behavioral1/memory/2548-6-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2452-18-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2548-8-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2756-32-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2824-36-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1540-46-0x0000000000400000-0x000000000042E000-memory.dmp upx - Drops file in Program Files directory 11 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\px4818.tmp svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\px4AE5.tmp svchost.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\px4BB0.tmp svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\px4A78.tmp svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\px4C8A.tmp svchost.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000679f0d74e2b06bff5345e3d3cf24e4ac3adfe66d85035d8b55d0defff7235289000000000e80000000020000200000001df5aedaa6cbbedc16df9adea522115cbfdbc6e43218a3c7b15fe67b0339297d2000000054497227d392e1dbc0d1ff15a98dba619a86268abb2bfc98a2baebfa1b4716b240000000a37852161e208cdd8be77f05351056e1d9e3a82c049ea6fcdf56c02d3c86e4c1274c2e5ddc7734d651e47ac3f9d59542371190ca27e58ffa3a90149478d29cbe iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f09cf3612684da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418132171" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff00000000000000008604000065020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff19000000190000009f0400007e020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000f1ac2b5063b8e2ac75572b7e0c13c46be06d9e74c70fec3c8856082323a6d633000000000e8000000002000020000000fcd769fa26e475df53b20434cdd7ed2256c0750678faa67de6921bedbaece80d900000007783ddfbd52cab5e7886cd12ff147e921d567ae3cef5935d880075ba519d8efd2112a658f67c79e6d3e3343a2f2e629a18fd2f228d8f9292d0084cf59e3488d661dc8213f0eab6d74c5eabb15337c05f898a167e675284f619cffa87e41d3885a182d1287811f1b77a057ec2ac0011513ba9acc8139fc4afc99ba09fdd3b2f3f0894d82fa0fde60800b0aa08ec9fc50f40000000c4f97f8a8d9a7e06d74c6253860e03aa2e893c3406a9ddf17c85e95d96b925e4f773596b3c943b6b032940d477cfdd8eeacdc9ac8926ac309d2bce78c77d5433 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8C1F2CB1-F019-11EE-8C0A-EA483E0BCDAF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2452 DesktopLayer.exe 2452 DesktopLayer.exe 2452 DesktopLayer.exe 2452 DesktopLayer.exe 2328 DesktopLayer.exe 2756 svchost.exe 2328 DesktopLayer.exe 2328 DesktopLayer.exe 2328 DesktopLayer.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2404 DesktopLayer.exe 2404 DesktopLayer.exe 2404 DesktopLayer.exe 2404 DesktopLayer.exe 1676 DesktopLayer.exe 1676 DesktopLayer.exe 1676 DesktopLayer.exe 1676 DesktopLayer.exe - Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 2176 iexplore.exe 2176 iexplore.exe 2176 iexplore.exe 2176 iexplore.exe 2176 iexplore.exe 2176 iexplore.exe - Suspicious use of SetWindowsHookEx 26 IoCs
pid Process 2176 iexplore.exe 2176 iexplore.exe 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE 2176 iexplore.exe 2176 iexplore.exe 2432 IEXPLORE.EXE 2432 IEXPLORE.EXE 2176 iexplore.exe 2176 iexplore.exe 2176 iexplore.exe 2176 iexplore.exe 2176 iexplore.exe 2176 iexplore.exe 2176 iexplore.exe 2176 iexplore.exe 1220 IEXPLORE.EXE 1220 IEXPLORE.EXE 1220 IEXPLORE.EXE 1220 IEXPLORE.EXE 1756 IEXPLORE.EXE 1756 IEXPLORE.EXE 1756 IEXPLORE.EXE 1756 IEXPLORE.EXE 1756 IEXPLORE.EXE 1756 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2176 wrote to memory of 2068 2176 iexplore.exe 28 PID 2176 wrote to memory of 2068 2176 iexplore.exe 28 PID 2176 wrote to memory of 2068 2176 iexplore.exe 28 PID 2176 wrote to memory of 2068 2176 iexplore.exe 28 PID 2068 wrote to memory of 2548 2068 IEXPLORE.EXE 29 PID 2068 wrote to memory of 2548 2068 IEXPLORE.EXE 29 PID 2068 wrote to memory of 2548 2068 IEXPLORE.EXE 29 PID 2068 wrote to memory of 2548 2068 IEXPLORE.EXE 29 PID 2548 wrote to memory of 2452 2548 svchost.exe 30 PID 2548 wrote to memory of 2452 2548 svchost.exe 30 PID 2548 wrote to memory of 2452 2548 svchost.exe 30 PID 2548 wrote to memory of 2452 2548 svchost.exe 30 PID 2452 wrote to memory of 2588 2452 DesktopLayer.exe 31 PID 2452 wrote to memory of 2588 2452 DesktopLayer.exe 31 PID 2452 wrote to memory of 2588 2452 DesktopLayer.exe 31 PID 2452 wrote to memory of 2588 2452 DesktopLayer.exe 31 PID 2176 wrote to memory of 2432 2176 iexplore.exe 32 PID 2176 wrote to memory of 2432 2176 iexplore.exe 32 PID 2176 wrote to memory of 2432 2176 iexplore.exe 32 PID 2176 wrote to memory of 2432 2176 iexplore.exe 32 PID 2068 wrote to memory of 2232 2068 IEXPLORE.EXE 33 PID 2068 wrote to memory of 2232 2068 IEXPLORE.EXE 33 PID 2068 wrote to memory of 2232 2068 IEXPLORE.EXE 33 PID 2068 wrote to memory of 2232 2068 IEXPLORE.EXE 33 PID 2232 wrote to memory of 2328 2232 svchost.exe 34 PID 2232 wrote to memory of 2328 2232 svchost.exe 34 PID 2232 wrote to memory of 2328 2232 svchost.exe 34 PID 2232 wrote to memory of 2328 2232 svchost.exe 34 PID 2068 wrote to memory of 2756 2068 IEXPLORE.EXE 35 PID 2068 wrote to memory of 2756 2068 IEXPLORE.EXE 35 PID 2068 wrote to memory of 2756 2068 IEXPLORE.EXE 35 PID 2068 wrote to memory of 2756 2068 IEXPLORE.EXE 35 PID 2328 wrote to memory of 2596 2328 DesktopLayer.exe 36 PID 2328 wrote to memory of 2596 2328 DesktopLayer.exe 36 PID 2328 wrote to memory of 2596 2328 DesktopLayer.exe 36 PID 2328 wrote to memory of 2596 2328 DesktopLayer.exe 36 PID 2756 wrote to memory of 2504 2756 svchost.exe 37 PID 2756 wrote to memory of 2504 2756 svchost.exe 37 PID 2756 wrote to memory of 2504 2756 svchost.exe 37 PID 2756 wrote to memory of 2504 2756 svchost.exe 37 PID 2068 wrote to memory of 2824 2068 IEXPLORE.EXE 38 PID 2068 wrote to memory of 2824 2068 IEXPLORE.EXE 38 PID 2068 wrote to memory of 2824 2068 IEXPLORE.EXE 38 PID 2068 wrote to memory of 2824 2068 IEXPLORE.EXE 38 PID 2824 wrote to memory of 2404 2824 svchost.exe 39 PID 2824 wrote to memory of 2404 2824 svchost.exe 39 PID 2824 wrote to memory of 2404 2824 svchost.exe 39 PID 2824 wrote to memory of 2404 2824 svchost.exe 39 PID 2176 wrote to memory of 1220 2176 iexplore.exe 40 PID 2176 wrote to memory of 1220 2176 iexplore.exe 40 PID 2176 wrote to memory of 1220 2176 iexplore.exe 40 PID 2176 wrote to memory of 1220 2176 iexplore.exe 40 PID 2068 wrote to memory of 1540 2068 IEXPLORE.EXE 41 PID 2068 wrote to memory of 1540 2068 IEXPLORE.EXE 41 PID 2068 wrote to memory of 1540 2068 IEXPLORE.EXE 41 PID 2068 wrote to memory of 1540 2068 IEXPLORE.EXE 41 PID 2404 wrote to memory of 1668 2404 DesktopLayer.exe 42 PID 2404 wrote to memory of 1668 2404 DesktopLayer.exe 42 PID 2404 wrote to memory of 1668 2404 DesktopLayer.exe 42 PID 2404 wrote to memory of 1668 2404 DesktopLayer.exe 42 PID 2176 wrote to memory of 1756 2176 iexplore.exe 43 PID 2176 wrote to memory of 1756 2176 iexplore.exe 43 PID 2176 wrote to memory of 1756 2176 iexplore.exe 43 PID 2176 wrote to memory of 1756 2176 iexplore.exe 43
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\708e82d516395597e3002f2da7537dad_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:275457 /prefetch:22⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:2588
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:2596
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:2504
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:1668
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1540 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1676 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:1868
-
-
-
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:209928 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2432
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:537608 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1220
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:996357 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1756
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 106641d7742902d16e1147aa6add33f6202bccb6f130878e57568a9c45023819
- MD5 9fb1f8f054f5233009bd34ed7a9ce6b1
- SHA1 1251a9db84dc6846757a75896b719f4c54b973f6
- SHA512 615203aff2832c43e25bc2dba5cbca2b39307c0bb7d2ed9cae28d14c5b735c7ffc9e95a6d5f260187699dfa105b7f775ffa9a5b7fb912436043d1ef5e160bc4b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 86ddfb23bea6295024135bd151c0b24c6f78947a602171ed19092c8edbb9cf00
- MD5 3387abf7ed0c0ef617afac97de9f6ba8
- SHA1 f7280fa1fc5a16c877896c1d32c82211f095bfbd
- SHA512 557fb733097a713ee296d97e63310711fc8ece7cca29f98d309fea095cb861d070e0b97da13886ffebeba57360d8c25c6b7fe31cb0bcb06d61378f17ae3ab9db
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 722802cc513f4023c4e577bed7d97a3e39a9b36ee83e62b10e661ab852dc740c
- MD5 c09bb3c9da9b8facfb67adfe34f88120
- SHA1 c05fce8546e4720e7d4e428a4ba61908ff92fc19
- SHA512 6dfdb7486c7c7e63be74dd351035f0fe866ca872229eb822043703b812d6bfac170315246948e3abfb3aad34c2fdedb3809717053773a1a2b554fd0b43cd5566
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 89a2335de841eb8b5d1002cc4ba50761092e6adf4ad951c4c69b03447e76fab0
- MD5 0d04143ddcab75ac2e133885d5fef667
- SHA1 81e4e8cd53375d66fb051e42338824a95d6c0867
- SHA512 9afdae1db464ce38394a3d6ffa865a00a2960b10080ba9a8d2b388e9153d77357c1e54a00678c1503b6a26f094023dda0811c847fea0256390682fd32a73436a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 71c824808d285c14fd1f4b0c78754bf00a44d2f5f617d32609e65cc451c6745a
- MD5 20da14a9ab29915ed3593cf59ecfea0b
- SHA1 28404bc2863e2de96dfa14bded47245552a0eb99
- SHA512 5e765b88100fde4a15a83a9a1685e61783849d9a93df4a8aa9a79f799154173ff50674639c94b820e150375f8c9feb4f4c6c5418c74484853490d4b54a4e5f2a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 829c92b488b9f9f2477216df10ff779e1d874c33a71ef3eb64c4186850056244
- MD5 522d1559729cbd74a936072c1c8fc8d6
- SHA1 5130fd059868361ef53f0b8b64d61b8b4cfad2ca
- SHA512 cafa011f963754fb2810ff6a071c23abcedd50146167b7a7098262d207f04466a9735b2f15ce043e6f023358ef117a3f44ca84d5a38cee943781f11a31fe63cb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 02d16635aaf89f994a9c16da27c3df55ef006bc21233f38960e97e2e0db1a9dc
- MD5 b3a71da96e046c1873236f86634669f2
- SHA1 3dc9d926d94acd7d7de94206bdf5485f81fe62e9
- SHA512 74ed16718a2d086cfd01ac2452c1ca9d836d1864a85c0236eaacf0357b7163745e33a85c512cfce467a600f84d21903970e6a1c3446e3d3f80511bb25a767008
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 3c90ad5b5431ea626668de28df928b0bf933a9dd4a041ad30447324d86584e40
- MD5 adbb8a6672395f846af4c2569d7ffe13
- SHA1 60cf86412ad0afead7a5dce826edba367285f86a
- SHA512 bb6512a4262c0b377e7cf4aad4ca416e23cc0765368e1d2996ad4bcc07b76b9da0bcb0e5180754764c71aadede2a6ba439137661db19b4a19346197a0d4b7c07
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 0d7c27b6ff92ffac94a1fe5f3dc0bff22825b44b876604ef405136722073ac7d
- MD5 0594fb54ef19a803aaa6af55b9ea161e
- SHA1 47e3a252c35057ef9ea25cadbd67e929c9695e0d
- SHA512 fd829d99421d69786b95c9d3d72479afdfffd8ea44b4d27e423853f2461d2ef1725b20b88c01ceca244791ec31c9cda0d07147b52af9472c187bcac96230cb81
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab43E5.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Cab45EC.tmp
- Size 68KB
- SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
- MD5 29f65ba8e88c063813cc50a4ea544e93
- SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
- SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
- SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar461E.tmp
- Size 177KB
- SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
- MD5 435a9ac180383f9fa094131b173a2f7b
- SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
- SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
- SSDEEP 1536:fAo/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mJ:f/J+qTR0XCy/dmASru2Aijbdq
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\svchost.exe
- Size 55KB
- SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
- MD5 ff5e1f27193ce51eec318714ef038bef
- SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
- SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
- SSDEEP 1536:Q+hzRsibKplyXTq8OGRnsPFG+RODTb7MXL5uXZnzE:bROzoTq0+RO7IwnY
- MD5 SHA1 SHA512 SSDEEP