Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 00:40
Static task
static1
Behavioral task
behavioral1
Sample
9c7698351fa0d2d4070b618f9f0073e2_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9c7698351fa0d2d4070b618f9f0073e2_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
9c7698351fa0d2d4070b618f9f0073e2_JaffaCakes118.html
-
Size
788KB
-
MD5
9c7698351fa0d2d4070b618f9f0073e2
-
SHA1
4e28c9d2a2e53ae6550567cae3660b5692401901
-
SHA256
06edd7a4e4ce3aa50a35c636c78625948a0aa3526f9d5a7dab44a245d561fd00
-
SHA512
a3b4af52cbc0d881a7dfe0487d67ebb2b310debe3c75a4bd08b706ffd726602607bc6478613f0c1812cbf0090d06cb9f6f12d07097d1caf19b2fb8cfc69b6da2
-
SSDEEP
12288:v5d+X3l5d+X395d+X3R5d+X3o5d+X3j5d+X315d+X3u:f+J+h+t+i+b+5+O
Malware Config
Signatures
-
Executes dropped EXE 8 IoCs
Processes:
svchost.exeDesktopLayer.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exepid process 1276 svchost.exe 1572 DesktopLayer.exe 2764 svchost.exe 2500 svchost.exe 2376 svchost.exe 1880 svchost.exe 2660 svchost.exe 2600 svchost.exe -
Loads dropped DLL 8 IoCs
Processes:
IEXPLORE.EXEsvchost.exepid process 2264 IEXPLORE.EXE 1276 svchost.exe 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\svchost.exe upx behavioral1/memory/1276-9-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1276-6-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1572-16-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1572-20-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1572-18-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2764-27-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2376-35-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2376-33-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2660-43-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Drops file in Program Files directory 15 IoCs
Processes:
svchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\px203D.tmp svchost.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\px20AA.tmp svchost.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\px1F92.tmp svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\px205C.tmp svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\px207C.tmp svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\px2118.tmp svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\px2156.tmp svchost.exe -
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424228323" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff19000000190000009f0400007e020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015c2bb55f3fd574da397ad069f325a0b00000000020000000000106600000001000020000000ec1f4f02865239711389abee0287f0fd8027f376bfeae69f1b2d9801e47fd7b2000000000e80000000020000200000003fedcb21359465fa3fb817151f77df098f828afa61acf4299972a315b9e942d820000000b7f4341a5d7e3b0a43d54a832757fd716e4efab9a6b9b17ac2eeca0a0d423d9f40000000c1dd0d25ac7fab8110cdb3059aea58026a1c82313cd8ef2e4c2741c276ff1a154722eeca26044e32954a994764dd1e360f83fefbe5f0fc3afc5c99a7bcbd3cd2 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 903d991898bbda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3200000032000000b804000097020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff00000000000000008604000065020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{433D02C1-278B-11EF-B1CF-5A791E92BC44} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015c2bb55f3fd574da397ad069f325a0b000000000200000000001066000000010000200000008c18884ae86451ef9c242802633e90378bcd85c76e2e5e974a3ddd89870fa165000000000e8000000002000020000000537545b38391b08fab6108c3d6259b2af3cc6c77f979ca4902d0c54c1a9645de900000001658c67aaa6db05af6be1e985e96c658939590799d3c8a11c32c714a55923cdb7e6e0d3f5b2bf4ecd99789450dda6ae391bb157e73ee6ff169771492c4481d1f6577ab62e684002ec8985c60ee2261b70d52281c426503977869134b6d50069eedc79342667d207f21e6a85baf019c95151b295eee5cda22e48527d269ceaa9f29334a86491647f67374902a7fc078bb4000000028b7babc5c5d431df0206547dfc664d3bc1efd76ce8b9a54d133429b8ac8c8892d1afb13cd79875cef7171917d93bced18fe7d70c1e5c7f9e07fdb4541f2d2d4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
DesktopLayer.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exepid process 1572 DesktopLayer.exe 1572 DesktopLayer.exe 1572 DesktopLayer.exe 1572 DesktopLayer.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2500 svchost.exe 2500 svchost.exe 2500 svchost.exe 2500 svchost.exe 2376 svchost.exe 2376 svchost.exe 2376 svchost.exe 2376 svchost.exe 1880 svchost.exe 1880 svchost.exe 1880 svchost.exe 1880 svchost.exe 2660 svchost.exe 2660 svchost.exe 2660 svchost.exe 2660 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
Processes:
iexplore.exepid process 2156 iexplore.exe 2156 iexplore.exe 2156 iexplore.exe 2156 iexplore.exe 2156 iexplore.exe 2156 iexplore.exe 2156 iexplore.exe 2156 iexplore.exe -
Suspicious use of SetWindowsHookEx 34 IoCs
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEpid process 2156 iexplore.exe 2156 iexplore.exe 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE 2156 iexplore.exe 2156 iexplore.exe 3004 IEXPLORE.EXE 3004 IEXPLORE.EXE 2156 iexplore.exe 2156 iexplore.exe 2156 iexplore.exe 2156 iexplore.exe 2156 iexplore.exe 2156 iexplore.exe 2156 iexplore.exe 2156 iexplore.exe 2156 iexplore.exe 2156 iexplore.exe 2156 iexplore.exe 2156 iexplore.exe 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE 240 IEXPLORE.EXE 240 IEXPLORE.EXE 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE 240 IEXPLORE.EXE 240 IEXPLORE.EXE 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
iexplore.exeIEXPLORE.EXEsvchost.exeDesktopLayer.exesvchost.exesvchost.exesvchost.exesvchost.exedescription pid process target process PID 2156 wrote to memory of 2264 2156 iexplore.exe IEXPLORE.EXE PID 2156 wrote to memory of 2264 2156 iexplore.exe IEXPLORE.EXE PID 2156 wrote to memory of 2264 2156 iexplore.exe IEXPLORE.EXE PID 2156 wrote to memory of 2264 2156 iexplore.exe IEXPLORE.EXE PID 2264 wrote to memory of 1276 2264 IEXPLORE.EXE svchost.exe PID 2264 wrote to memory of 1276 2264 IEXPLORE.EXE svchost.exe PID 2264 wrote to memory of 1276 2264 IEXPLORE.EXE svchost.exe PID 2264 wrote to memory of 1276 2264 IEXPLORE.EXE svchost.exe PID 1276 wrote to memory of 1572 1276 svchost.exe DesktopLayer.exe PID 1276 wrote to memory of 1572 1276 svchost.exe DesktopLayer.exe PID 1276 wrote to memory of 1572 1276 svchost.exe DesktopLayer.exe PID 1276 wrote to memory of 1572 1276 svchost.exe DesktopLayer.exe PID 1572 wrote to memory of 2568 1572 DesktopLayer.exe iexplore.exe PID 1572 wrote to memory of 2568 1572 DesktopLayer.exe iexplore.exe PID 1572 wrote to memory of 2568 1572 DesktopLayer.exe iexplore.exe PID 1572 wrote to memory of 2568 1572 DesktopLayer.exe iexplore.exe PID 2156 wrote to memory of 3004 2156 iexplore.exe IEXPLORE.EXE PID 2156 wrote to memory of 3004 2156 iexplore.exe IEXPLORE.EXE PID 2156 wrote to memory of 3004 2156 iexplore.exe IEXPLORE.EXE PID 2156 wrote to memory of 3004 2156 iexplore.exe IEXPLORE.EXE PID 2264 wrote to memory of 2764 2264 IEXPLORE.EXE svchost.exe PID 2264 wrote to memory of 2764 2264 IEXPLORE.EXE svchost.exe PID 2264 wrote to memory of 2764 2264 IEXPLORE.EXE svchost.exe PID 2264 wrote to memory of 2764 2264 IEXPLORE.EXE svchost.exe PID 2764 wrote to memory of 2532 2764 svchost.exe iexplore.exe PID 2764 wrote to memory of 2532 2764 svchost.exe iexplore.exe PID 2764 wrote to memory of 2532 2764 svchost.exe iexplore.exe PID 2764 wrote to memory of 2532 2764 svchost.exe iexplore.exe PID 2264 wrote to memory of 2500 2264 IEXPLORE.EXE svchost.exe PID 2264 wrote to memory of 2500 2264 IEXPLORE.EXE svchost.exe PID 2264 wrote to memory of 2500 2264 IEXPLORE.EXE svchost.exe PID 2264 wrote to memory of 2500 2264 IEXPLORE.EXE svchost.exe PID 2500 wrote to memory of 2364 2500 svchost.exe iexplore.exe PID 2500 wrote to memory of 2364 2500 svchost.exe iexplore.exe PID 2500 wrote to memory of 2364 2500 svchost.exe iexplore.exe PID 2500 wrote to memory of 2364 2500 svchost.exe iexplore.exe PID 2264 wrote to memory of 2376 2264 IEXPLORE.EXE svchost.exe PID 2264 wrote to memory of 2376 2264 IEXPLORE.EXE svchost.exe PID 2264 wrote to memory of 2376 2264 IEXPLORE.EXE svchost.exe PID 2264 wrote to memory of 2376 2264 IEXPLORE.EXE svchost.exe PID 2376 wrote to memory of 2484 2376 svchost.exe iexplore.exe PID 2376 wrote to memory of 2484 2376 svchost.exe iexplore.exe PID 2376 wrote to memory of 2484 2376 svchost.exe iexplore.exe PID 2376 wrote to memory of 2484 2376 svchost.exe iexplore.exe PID 2264 wrote to memory of 1880 2264 IEXPLORE.EXE svchost.exe PID 2264 wrote to memory of 1880 2264 IEXPLORE.EXE svchost.exe PID 2264 wrote to memory of 1880 2264 IEXPLORE.EXE svchost.exe PID 2264 wrote to memory of 1880 2264 IEXPLORE.EXE svchost.exe PID 1880 wrote to memory of 628 1880 svchost.exe iexplore.exe PID 1880 wrote to memory of 628 1880 svchost.exe iexplore.exe PID 1880 wrote to memory of 628 1880 svchost.exe iexplore.exe PID 1880 wrote to memory of 628 1880 svchost.exe iexplore.exe PID 2156 wrote to memory of 2692 2156 iexplore.exe IEXPLORE.EXE PID 2156 wrote to memory of 2692 2156 iexplore.exe IEXPLORE.EXE PID 2156 wrote to memory of 2692 2156 iexplore.exe IEXPLORE.EXE PID 2156 wrote to memory of 2692 2156 iexplore.exe IEXPLORE.EXE PID 2264 wrote to memory of 2660 2264 IEXPLORE.EXE svchost.exe PID 2264 wrote to memory of 2660 2264 IEXPLORE.EXE svchost.exe PID 2264 wrote to memory of 2660 2264 IEXPLORE.EXE svchost.exe PID 2264 wrote to memory of 2660 2264 IEXPLORE.EXE svchost.exe PID 2156 wrote to memory of 240 2156 iexplore.exe IEXPLORE.EXE PID 2156 wrote to memory of 240 2156 iexplore.exe IEXPLORE.EXE PID 2156 wrote to memory of 240 2156 iexplore.exe IEXPLORE.EXE PID 2156 wrote to memory of 240 2156 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9c7698351fa0d2d4070b618f9f0073e2_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:22⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2660 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2600 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:2712
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:209930 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3004 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:603144 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2692 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:865283 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:240 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:5387266 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2624
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD567eeddb426fe54c42bc08311906c394d
SHA1fefd89bc02f899a613f7f7a1b440e9e5479acf32
SHA256ac7cc266824e1b6132d826776733a2f4bffeb31d5ddd613153bf7a36f044344e
SHA5121e22e1eab978feaaeb097b1033081f9a5dda4141c3d85d0127926361a7fa96fbfc36f77db398dd318c486c7ce56e253399e16a5b59079e6dfea1496810c2272c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be8754728ceca2871d908e82d3a40579
SHA10a07c9ee97795c283a5b48764a0ae38419a64ff9
SHA2561d28f50e210f92c7edcd55d52e8db8bef930b78468d6115b2652f8c75ebf56f2
SHA512970acbee26cb584362b35fdb1540e644304df076a03e66cebc9e669f948766a3b48b6c23949d3350ed2ca5327649d8ad6585c0c7a9963ef9338305ca6f4e497a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD540b557088e3eb9b0a6bd9512ed095529
SHA1f8afee0b240e20aba78cf8c169b9c690245306e6
SHA25690f0bd03151ec14b98eb767c72e35d4386b5743a50efe31a43c3b046b7b0e8c5
SHA512b086c55f8c5fc620694051fcccaa125e7e9c8b976906e9f1ca9612c3c1dd9820151dca94a07c4aa477834210f1d248420adf3b0ac54c4343b0e5fa8997970af0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534e7859883779a4d7a4fb9412b59a836
SHA142590506d8538c3ef7230ac9d41aba84a764006f
SHA256ca38dc811a258c2f1e4dcf91fd42fde32c85ba113d2ed08853f1fcd404fcada4
SHA5127a2c5f44232494498a6a700b2e9e7d479acce0d4ab3910b11a7156e03d511535d3830062b1662b054efe89fef28ce82f7f9024facb730c8c1198dc4f41f966b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f0ce3bdc23a55f360efc9e86b1986f3
SHA178ce50c16f13854b3af9ae8ec3e96347111b1172
SHA2563845fa2c3ca7f530f8ef009db2f84eaa59cd6115fd6182c8e90103b60d8368e6
SHA51236eaa0d28e9c1229c502fa59da516544942f4af7badba2e20539e81e1c375845649bace8f5b8699ac1e9f98e66d9050a57e118e2ef6c6f3b0bd09432b477522c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae73a075543082461feb1debf7d6da8d
SHA1dbc8b1ae82c755d39fc2e2984603abc6a2c20675
SHA25646cf33884846c62d276a6b8484aa7ea6386b4f8b28cfefc291c80b02fdb314e1
SHA512d54680bb02b4846ee5a9b2ccf57a6606b6a3e05e97780ba9a7a0407d6e5a4a665ff5ee1b9b6c8f2bc50d8c62da01b0aa12fec42600c77b24974035476a28595b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d15b91b789f409b80ddd648d9f0fc5cb
SHA157f220d9946de52c6a1d5966b94811c4e956bdf1
SHA2564a459ecf17dca4ef06487095113a8c88fe63e0a454e69bfba701f9c936fc5edc
SHA5124a3b71dc94e1b91893d0278f4c2b8bdd89e3b759087883575092f05f234636e739d2acbd597e3d5d788f2d102cbad02b1dfd6a942c6f946426ed956471497069
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52968897e4c914adec882a4760e68b8c5
SHA1469f5bf6520f5d46dc173b4ccab5df7963011c01
SHA256d08442e2fa75426112913b8cb2061389331cffcae30311757f40f68f0f17407d
SHA5128e032b23b476d9203d30d114e40dbece7d4a09062a1f652b9c79465fb433c88649d6fd093a214c77b4120b094ffea5e8c96672ab84d4c4a7b21218fc4d2df934
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514d40a4080811d7b23a76dc41b592e7d
SHA192ec156db902cc0aa41e5b0eacb1991528c3915c
SHA256aba2016787da65ebb31a24f0f19338938d81aceb04dede5dc05dd32a618c1bbc
SHA5129713886f4445d050c8ab70307cbdeebced7f61c961db2684aba3a96161d3b40e4852d2b09b98e3bc24c19631f31e8b68584dbc28c133f619ebdbe330ceb95a4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5babfe65d1071030306d1f7d9da2278d0
SHA15220c0e76549f6498e4ba9a456bea49c2a7cd139
SHA25653d562bd67ed8ad774784f5dcf37778293344000695b83481e00f01619ba2db4
SHA51251099e5393f21a060fac6d503ce69f924f7915fde746b976258441bbe107066b53ef9743167f62630341f266f502797586685c674972e16d82e4e9343af53cf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b6dc94ee54d119085a76a3f0e836873
SHA1d136214b9d315e47734129c5f2f4bbbec5efcb66
SHA25675c2b645f2ec4bea8b1090bdbd5e12088761ab2b4890d3b61565c7469b93b527
SHA5122ac5d789611aafd11e671e72494d779ddef4019483a4d1203ac3eda0f9525a9051c4dfb0e0d530a04ca7c21ca1cca62ccdec4c002d46f218be26a4f11b723173
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5f65b372f9408909040a1daad9e67d9cc
SHA163f12db9b1a516e8037687ff3af3e8fe12f506f6
SHA256229148bcc3459743a1862ccfc183bcf67addaa44e588e50c56af0457efc57ce0
SHA512199a598ebebaa7f6c4c808b51a4505730363a87fc744a3ae909b2340119fd22a605399c2558cbb0661c21040f8e5e4950f00da429e43b7831177a3d79ad8c79e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a