16faa719cc7c17157e3adc99eef37c478f375c022902d548ed497f05da919a80

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 02:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
580deeed50ebf99ca13672d741ba76eb_JaffaCakes118.exe
Size 1.5MB
Sample240519-cm3hpsdd32
SHA256 16faa719cc7c17157e3adc99eef37c478f375c022902d548ed497f05da919a80
MD5 580deeed50ebf99ca13672d741ba76eb
SHA1 3979335642f4c43167d906c917416bd4b9178cc3
SHA512 31fbe588533f3fb52afde66b3d92a160d0bc0da8863a0d23eed8c94ec1ff492edbf14190a522787c62968f00f78b31eb3e472607358d098663dd2d0b7b5ec6dc
SSDEEP 49152:VN2oHiyVAy8kjVjJ5ShsNDWD2KwrvwVP1IFDci6uSZ4w:VN1iq9xjJMhsNCbmIt14o/P
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery persistence stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1976	rGQ_.exe

Loads dropped DLL 3 IoCs

pid	Process
1976	rGQ_.exe
1856	regsvr32.exe
4064	regsvr32.exe

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}\InprocServer32\ = "C:\\Program Files (x86)\\surff! aiNd keep\\ip7.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}\InprocServer32	regsvr32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}\ = "surff! aiNd keep"	rGQ_.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}\NoExplorer = "1"	rGQ_.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}	rGQ_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}\ = "surff! aiNd keep"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}	rGQ_.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\surff! aiNd keep\ip7.dll	rGQ_.exe
File opened for modification	C:\Program Files (x86)\surff! aiNd keep\ip7.dll	rGQ_.exe
File created	C:\Program Files (x86)\surff! aiNd keep\ip7.tlb	rGQ_.exe
File opened for modification	C:\Program Files (x86)\surff! aiNd keep\ip7.tlb	rGQ_.exe
File created	C:\Program Files (x86)\surff! aiNd keep\ip7.dat	rGQ_.exe
File opened for modification	C:\Program Files (x86)\surff! aiNd keep\ip7.dat	rGQ_.exe
File created	C:\Program Files (x86)\surff! aiNd keep\ip7.x64.dll	rGQ_.exe
File opened for modification	C:\Program Files (x86)\surff! aiNd keep\ip7.x64.dll	rGQ_.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	rGQ_.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}	rGQ_.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}	rGQ_.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	rGQ_.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}\Programmable	rGQ_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	rGQ_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	rGQ_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}\Implemented Categories	rGQ_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Keep\CurVer	rGQ_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	rGQ_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Keep\CLSID	rGQ_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}\ = "surff! aiNd keep"	rGQ_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	rGQ_.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Keep.suurf	rGQ_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}\VersionIndependentProgID	rGQ_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\surff! aiNd keep"	rGQ_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	rGQ_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	rGQ_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	rGQ_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	rGQ_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Keep\CurVer\ = "suurf annde Keep.2.19"	rGQ_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}	rGQ_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	rGQ_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	rGQ_.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\annde	rGQ_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	rGQ_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	rGQ_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Keep.2.19\CLSID	rGQ_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	rGQ_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Keep.2.19\CLSID\ = "{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}\ProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}\ProgID	rGQ_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	rGQ_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	rGQ_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	rGQ_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	rGQ_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	rGQ_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\suurf	rGQ_.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}\InprocServer32	rGQ_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	rGQ_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Keep\CLSID\ = "{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}\InprocServer32	rGQ_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	rGQ_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	rGQ_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	rGQ_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	rGQ_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Keep\ = "surff! aiNd keep"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}\ProgID	rGQ_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Keep\ = "surff! aiNd keep"	rGQ_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	rGQ_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Keep.2.19	rGQ_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}\InprocServer32\ThreadingModel = "Apartment"	rGQ_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	rGQ_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	rGQ_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	rGQ_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Keep\CurVer\ = "suurf annde Keep.2.19"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Keep.2.19\CLSID\ = "{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}"	rGQ_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Keep\CLSID\ = "{39758FB1-3CC9-F566-969B-B4A73EEA2ABD}"	rGQ_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	rGQ_.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 1976	4016	580deeed50ebf99ca13672d741ba76eb_JaffaCakes118.exe	84
PID 4016 wrote to memory of 1976	4016	580deeed50ebf99ca13672d741ba76eb_JaffaCakes118.exe	84
PID 4016 wrote to memory of 1976	4016	580deeed50ebf99ca13672d741ba76eb_JaffaCakes118.exe	84
PID 1976 wrote to memory of 1856	1976	rGQ_.exe	85
PID 1976 wrote to memory of 1856	1976	rGQ_.exe	85
PID 1976 wrote to memory of 1856	1976	rGQ_.exe	85
PID 1856 wrote to memory of 4064	1856	regsvr32.exe	86
PID 1856 wrote to memory of 4064	1856	regsvr32.exe	86

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{39758FB1-3CC9-F566-969B-B4A73EEA2ABD} = "1"	rGQ_.exe

C:\Users\Admin\AppData\Local\Temp\580deeed50ebf99ca13672d741ba76eb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\580deeed50ebf99ca13672d741ba76eb_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Users\Admin\AppData\Local\Temp\00294823\rGQ_.exe
  "C:\Users\Admin\AppData\Local\Temp/00294823/rGQ_.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1976
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\surff! aiNd keep\ip7.x64.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1856
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files (x86)\surff! aiNd keep\ip7.x64.dll"
      4⤵
      Loads dropped DLL
      Registers COM server for autorun
      Installs/modifies Browser Helper Object
      Modifies Internet Explorer settings
      Modifies registry class
      PID:4064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ip7.dll

Path C:\Users\Admin\AppData\Local\Temp\00294823\ip7.dll
Size 416KB
SHA256 e23b94a809d4306dce3c0fb5a7dc76ad25e133cb74daa489629419ba1d849ebe
MD5 b5e8219112f5de28e71487fd8c367b8f
SHA1 cc60f4497ee2328e43e89474c412d75a90be2e1b
SHA512 d4dd2a41ab9c17125263824f3f4b5c6f3a5f8dc7c78adc298391a6a18b495a521388e2c8524c5050b7452df89d048a12b014e711fef7e4ed8b439d8959a7357d
SSDEEP 6144:9/c93WBQEoIK6lNS1huqSFeACGcW6kbO36JDWZA+VbfDKHAN2xq:9/c93WBLKUvbhBukbrbqb+gAxq
MD5 SHA1 SHA512 SSDEEP

Submit Download

ip7.tlb

Path C:\Users\Admin\AppData\Local\Temp\00294823\ip7.tlb
Size 3KB
SHA256 2e46c45652d03653c407468ca871f4e910b4cec36af85853e2bd06f3fb7ad4ae
MD5 8d1f5f85eefb09e07c0f1357289b7251
SHA1 f9e39ac9d8e978d8fe834c527a6160eb58392e77
SHA512 df483e23bf19f90b07cf70d5e4bf7a26ece3bea39cc78b0dd652d179890000ec2c603841f5354e27676f60055094e13749ad6fc11dcf56aa8be32a8a7d916fd7
MD5 SHA1 SHA512

Submit Download

ip7.x64.dll

Path C:\Users\Admin\AppData\Local\Temp\00294823\ip7.x64.dll
Size 463KB
SHA256 5b9f026657796490c626a88c1b7533fc23a1ee92b4bad819f4d0940e18d0c7ae
MD5 51869d78edfbeb04d0805522d9232518
SHA1 4c1a736dbf800b83580265a6c6ae2ebd13e0b3cc
SHA512 9f99165b2c27df5f43131d857340aeb197d24b00a7176943c98f9b45bd7919e4ce002f68c9c1ed03424f42a1ce94ff3968b315cf9f6d2edfba708d86fc2c03fc
SSDEEP 6144:vubh8V1Yg80MDKAjY9HzGSAAbMhj1jT9rtnzkSaTTKPn:vuEa0MDKaY9lAA+TdkSJP
MD5 SHA1 SHA512 SSDEEP

Submit Download

rGQ_.dat

Path C:\Users\Admin\AppData\Local\Temp\00294823\rGQ_.dat
Size 3KB
SHA256 2ac69064c54f1a09d437a14308f0977e0dd81a43986311feaab153fa22a61786
MD5 247bf46099675dbe42523cc04ed50041
SHA1 d1182d1bc04abf173bc21d066a80e8212fdb9e28
SHA512 6b7a15fa1ea1bbcfe9a70c238c394ed624959e30c5660e741ddd08ce7e7e548f291dfebc751498567b8e79306f8cd450226e622711d8a3ef9bb99cf88713731a
MD5 SHA1 SHA512

Submit Download

rGQ_.exe

Path C:\Users\Admin\AppData\Local\Temp\00294823\rGQ_.exe
Size 482KB
SHA256 bf0a543d607d8c4f6a64ceb3a09488cfd7631191eb2c6ff6db3532ff1d34a62b
MD5 2f21b030acc94619252a33d36dc2694c
SHA1 82c9801ec0d132500bc823defe9aaa1b8679d198
SHA512 27cb565725965634f7ee0b50ec1502cc188273194c4960545d503e91891d59d842d7a1c3f4b3347d501dd2e5ee89af9b148be1c7fbc6df65488a675eb42e030f
SSDEEP 6144:a4Zy2MXj5/9jquOtXilmKb6xS2UFt6XQCKkHzE/m463cHR5PK7NMtNPvdQ:Byn5FIXLS6xnyi5KkHz749Pi+PPvdQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads