Analysis
- max time kernel
120s - max time network
133s - platform
windows7_x64 - resource
win7-20240611-en - resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system - submitted
13/06/2024, 11:16
Static task
static1
Behavioral task
behavioral1
Sample
a53f716bd660715f7857ed0afbacecbc_JaffaCakes118.html
Resource
win7-20240611-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
a53f716bd660715f7857ed0afbacecbc_JaffaCakes118.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a53f716bd660715f7857ed0afbacecbc_JaffaCakes118.html
- Size 567KB
- Sample240613-ndabcawepf
- SHA256 b9c6bf6e30c269a80e32523242eae542e11a45268de7260ff4c83c08876ba277
- MD5 a53f716bd660715f7857ed0afbacecbc
- SHA1 d0aa5e96b2c2b175ae51d0bc1cd3f13fe66e3761
- SHA512 cc27b1f395f4b18d0562184b35e60937149b576561eef4aa44fdc3c1fdc7d7c47e3fc2e5c66537a473fd1e4e193dc94acb6995adde991137bed039b42555d959
- SSDEEP 6144:SnbsMYod+X3oI+YJsMYod+X3oI+YosMYod+X3oI+YKsMYod+X3oI+Y/sMYod+X3+:8v5d+X3r5d+X3M5d+X3W5d+X3x5d+X3+
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 6 IoCs
pid Process 2600 svchost.exe 2876 DesktopLayer.exe 2548 svchost.exe 2520 svchost.exe 1100 svchost.exe 1500 svchost.exe - Loads dropped DLL 6 IoCs
pid Process 2568 IEXPLORE.EXE 2600 svchost.exe 2568 IEXPLORE.EXE 2568 IEXPLORE.EXE 2568 IEXPLORE.EXE 2568 IEXPLORE.EXE -
resource yara_rule behavioral1/files/0x0015000000015c79-2.dat upx behavioral1/memory/2600-6-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2600-9-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2876-20-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2876-17-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2548-29-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2548-25-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1100-35-0x0000000000400000-0x000000000042E000-memory.dmp upx - Drops file in Program Files directory 11 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\px671C.tmp svchost.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\px648D.tmp svchost.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\px6642.tmp svchost.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\px675B.tmp svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\px6661.tmp svchost.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff00000000000000008604000065020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424439253" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000003427fa0668bc1f7232e09754fa569f28b05cc9dd271f32de75236cbc2378cc20000000000e80000000020000200000003a42340f685e938901a809b019c2c588e9f91e6d9f8ade125c6bb10e89b10a9d20000000268dfbb6e8551090d88f54b7196c1f931380ccb4ab70a696e03e306113544bce40000000a3f92cd0331314687e253365a473868c0fdb2848c6cfc85d65b28261e2cf3e12c455cb269b79cdaa004d8c3fe496c446756dfd062f720ea5680bf8113f72db89 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60ee873483bdda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000005aadb983dbd2cb46e65ac8fc98b80f5cf1683089e631bc918696358b03d2232b000000000e8000000002000020000000c82f2fd8189a3c07fbc780ac4574e977dd660786c28b9e2b4162e0c38be2c72290000000cf13ed6b43492baaa6a00a1947bcc3176e3de5f4f76f81538996ad7e7c8a1f8a7639e469ee9c4df5f21eb559939f1515ceba3f637f59bc9701b3de17fb989727bcc67ff826daefacdb977f2fca90993cad7857f03009ace931128f17671c6bfe9ebdeb457ed3b875cb8bf7a2b9cac3e6ed0896171fd7321892a1fe2e86d9aba801115adf54733619c6ede1e2fdf85b264000000072244b54674a312a1097018406e692d34516cc4c2348f547bef63d44138e2957e80fc61ebc1367c3bdb41449c85b695c141f640bef174587f2942b2cce36a560 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5E820DE1-2976-11EF-B848-DEDD52EED8E0} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2876 DesktopLayer.exe 2876 DesktopLayer.exe 2876 DesktopLayer.exe 2876 DesktopLayer.exe 2548 svchost.exe 2548 svchost.exe 2520 svchost.exe 2548 svchost.exe 2520 svchost.exe 2548 svchost.exe 2520 svchost.exe 2520 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1100 svchost.exe 1500 svchost.exe 1500 svchost.exe 1500 svchost.exe 1500 svchost.exe - Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 2080 iexplore.exe 2080 iexplore.exe 2080 iexplore.exe 2080 iexplore.exe 2080 iexplore.exe 2080 iexplore.exe - Suspicious use of SetWindowsHookEx 26 IoCs
pid Process 2080 iexplore.exe 2080 iexplore.exe 2568 IEXPLORE.EXE 2568 IEXPLORE.EXE 2080 iexplore.exe 2080 iexplore.exe 2640 IEXPLORE.EXE 2640 IEXPLORE.EXE 2080 iexplore.exe 2080 iexplore.exe 2080 iexplore.exe 2080 iexplore.exe 2080 iexplore.exe 2080 iexplore.exe 2080 iexplore.exe 2080 iexplore.exe 820 IEXPLORE.EXE 820 IEXPLORE.EXE 108 IEXPLORE.EXE 108 IEXPLORE.EXE 2568 IEXPLORE.EXE 2568 IEXPLORE.EXE 1340 IEXPLORE.EXE 1340 IEXPLORE.EXE 1340 IEXPLORE.EXE 1340 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2080 wrote to memory of 2568 2080 iexplore.exe 28 PID 2080 wrote to memory of 2568 2080 iexplore.exe 28 PID 2080 wrote to memory of 2568 2080 iexplore.exe 28 PID 2080 wrote to memory of 2568 2080 iexplore.exe 28 PID 2568 wrote to memory of 2600 2568 IEXPLORE.EXE 29 PID 2568 wrote to memory of 2600 2568 IEXPLORE.EXE 29 PID 2568 wrote to memory of 2600 2568 IEXPLORE.EXE 29 PID 2568 wrote to memory of 2600 2568 IEXPLORE.EXE 29 PID 2600 wrote to memory of 2876 2600 svchost.exe 30 PID 2600 wrote to memory of 2876 2600 svchost.exe 30 PID 2600 wrote to memory of 2876 2600 svchost.exe 30 PID 2600 wrote to memory of 2876 2600 svchost.exe 30 PID 2876 wrote to memory of 2504 2876 DesktopLayer.exe 31 PID 2876 wrote to memory of 2504 2876 DesktopLayer.exe 31 PID 2876 wrote to memory of 2504 2876 DesktopLayer.exe 31 PID 2876 wrote to memory of 2504 2876 DesktopLayer.exe 31 PID 2080 wrote to memory of 2640 2080 iexplore.exe 32 PID 2080 wrote to memory of 2640 2080 iexplore.exe 32 PID 2080 wrote to memory of 2640 2080 iexplore.exe 32 PID 2080 wrote to memory of 2640 2080 iexplore.exe 32 PID 2568 wrote to memory of 2548 2568 IEXPLORE.EXE 33 PID 2568 wrote to memory of 2548 2568 IEXPLORE.EXE 33 PID 2568 wrote to memory of 2548 2568 IEXPLORE.EXE 33 PID 2568 wrote to memory of 2548 2568 IEXPLORE.EXE 33 PID 2568 wrote to memory of 2520 2568 IEXPLORE.EXE 34 PID 2568 wrote to memory of 2520 2568 IEXPLORE.EXE 34 PID 2568 wrote to memory of 2520 2568 IEXPLORE.EXE 34 PID 2568 wrote to memory of 2520 2568 IEXPLORE.EXE 34 PID 2548 wrote to memory of 2972 2548 svchost.exe 35 PID 2548 wrote to memory of 2972 2548 svchost.exe 35 PID 2548 wrote to memory of 2972 2548 svchost.exe 35 PID 2548 wrote to memory of 2972 2548 svchost.exe 35 PID 2520 wrote to memory of 2460 2520 svchost.exe 36 PID 2520 wrote to memory of 2460 2520 svchost.exe 36 PID 2520 wrote to memory of 2460 2520 svchost.exe 36 PID 2520 wrote to memory of 2460 2520 svchost.exe 36 PID 2080 wrote to memory of 820 2080 iexplore.exe 37 PID 2080 wrote to memory of 820 2080 iexplore.exe 37 PID 2080 wrote to memory of 820 2080 iexplore.exe 37 PID 2080 wrote to memory of 820 2080 iexplore.exe 37 PID 2568 wrote to memory of 1100 2568 IEXPLORE.EXE 38 PID 2568 wrote to memory of 1100 2568 IEXPLORE.EXE 38 PID 2568 wrote to memory of 1100 2568 IEXPLORE.EXE 38 PID 2568 wrote to memory of 1100 2568 IEXPLORE.EXE 38 PID 2080 wrote to memory of 108 2080 iexplore.exe 39 PID 2080 wrote to memory of 108 2080 iexplore.exe 39 PID 2080 wrote to memory of 108 2080 iexplore.exe 39 PID 2080 wrote to memory of 108 2080 iexplore.exe 39 PID 2568 wrote to memory of 1500 2568 IEXPLORE.EXE 40 PID 2568 wrote to memory of 1500 2568 IEXPLORE.EXE 40 PID 2568 wrote to memory of 1500 2568 IEXPLORE.EXE 40 PID 2568 wrote to memory of 1500 2568 IEXPLORE.EXE 40 PID 1100 wrote to memory of 2660 1100 svchost.exe 41 PID 1100 wrote to memory of 2660 1100 svchost.exe 41 PID 1100 wrote to memory of 2660 1100 svchost.exe 41 PID 1100 wrote to memory of 2660 1100 svchost.exe 41 PID 1500 wrote to memory of 2664 1500 svchost.exe 42 PID 1500 wrote to memory of 2664 1500 svchost.exe 42 PID 1500 wrote to memory of 2664 1500 svchost.exe 42 PID 1500 wrote to memory of 2664 1500 svchost.exe 42 PID 2080 wrote to memory of 1340 2080 iexplore.exe 43 PID 2080 wrote to memory of 1340 2080 iexplore.exe 43 PID 2080 wrote to memory of 1340 2080 iexplore.exe 43 PID 2080 wrote to memory of 1340 2080 iexplore.exe 43
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a53f716bd660715f7857ed0afbacecbc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:22⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:2504
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:2972
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:2460
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:2660
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:2664
-
-
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275464 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2640
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:6566915 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:820
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:7091201 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:108
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:11088897 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1340
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 41025ffb4e770c5f535baa54c9e8cf5ce4f5c7b2931428d680e796ec13ed1833
- MD5 15b32017c354d338937f01c3d4d8c2a3
- SHA1 87d235f44353ef89091acb4476febace83f5f3ec
- SHA512 381b9be2f657dbe1ae8422af1e4a89beab3487335756b4a1308507f908792f05fc14c94dc834f46e73cc7a1327891cdc06a3605e825b6bfe5ea2548f75543d79
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 e0648d51d74d92dbc4132474dca949bc4fa90132a1b783bdcc102b9397a64031
- MD5 80311d08d3c49a175e67514cfe97c358
- SHA1 a098fbbdf4bea589d6ce46b0e443d8d26430dd40
- SHA512 67e9f503fd4301048b83fabea002e37acd371a9e376d07f54d447a6eafc1075388542c89060bb6cc0657f0545b7f0978a045b045e9fb40da7d10070a0edb58e6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 ca0d1d209faf7a66f5b00613a2ff48b768c45bcfe9cfed99f3212473e7c8a168
- MD5 b0001e6d165ed4159acdcb73f4207e98
- SHA1 a99d3697583f9ab23f897902aae4508c32da1112
- SHA512 ecdea96cc5b4a61c8b6097af4337bd71113ea6f31f64dc94c734edd70376c2b89a200be79fe0c4f28521a1e550aab39bb9a1011fdef3cf78dbf2d35210bd9f5e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 5d38e834505f3e2ac1d737ca87537e59dbf47b49833795ae329a71e13ed079b6
- MD5 425fda966e85034b851c56bddfd890d4
- SHA1 9c76681c2d477fac1a717da1a5f15766393b9d3c
- SHA512 93dd3df79adf779f9a78740dc0f453f6e0a8e9811b19df4c28818f1f9dbd6c962c0625c969d6096e2e5b077baf97571617748b35df82869f38b244bbb2b9d7f0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 49bac65f3b6e846e81b6c1e7c362852b0ef7b141eb2f01d574d40640c44d9ace
- MD5 65eb4072eaaaa9d27db8b8b8d2b3c267
- SHA1 a4df216db117593e71a54d661f5c129fec7ec9cb
- SHA512 57415887f5d9d294b6ddda1a7328c1c4770e5e72899eeac37904d43efda29c91e37dae8d05eed5d164d02cb315b7beec8214f48d964b905af8b5cdcf9e3affd8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 9b49f83367a4ceab313fbeb514972fc6dbd41f12d701b6a01a0a6997649fe93b
- MD5 15dd233ab86078468dc55f4afb7407b9
- SHA1 bc55c83d83dd914fbd102b7ce023db2079b119d2
- SHA512 96397150bb9c2d3dd41f9e14c4a43df7b3e0c369fd9f66b507400593be75c49d1409d09f19b185e97ae5b37baed62690f6a00c84c3b867b7b05cf1d2bdd0b479
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 7840b28c56e2500c4ad628f96214416271f1fd306cdcbe4c5ff90a558b63cc77
- MD5 e857075c9a1f53c2cae3a8bad52e5904
- SHA1 1c9afa1b52b181cceb9c8ab43321357ebf663657
- SHA512 e4cfeeac4c66f015fa094c833b80095182e79a9c0a1164a9b26669a3dede5e97f82301dd5501603e5b1a4cfcccf50a441855774c0e45cfe52bce4c5de77413a2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 66fc2770195a4b0da30caebd7ebdf6134fb50533b8fdb7219627568f19302965
- MD5 7908b11840dbee41c780fc34dcae0b67
- SHA1 b6515032b0bd1a2fe185936f6952a4cf9199e86a
- SHA512 772a9921c36d26e11b2a305cc8e443ec031a00e965667d82170587390f4c9360af7cb2c8b85ec726702172ca561326a47729e96dec088eb53df222a1e14a6871
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 a0485f1ae6d20ddaaba0d39592be3e778b59a37026c6dc783ec2a7a2cae4bcca
- MD5 6c0dc88573e365458e26152bedb0259d
- SHA1 1f4a3ad7543121d42185738f143a04f0eb61659c
- SHA512 a53fd1f88a5502b0c6f4e3a7ca020d2c5cd7e34e14898219339ea59d92abae82f0b94d22b2fc0f4936c8adfe572a8d7214509ff8dcf8222c99081edc748f55e3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab5F01.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar5FD1.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\svchost.exe
- Size 55KB
- SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
- MD5 ff5e1f27193ce51eec318714ef038bef
- SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
- SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
- SSDEEP 1536:Q+hzRsibKplyXTq8OGRnsPFG+RODTb7MXL5uXZnzE:bROzoTq0+RO7IwnY
- MD5 SHA1 SHA512 SSDEEP