Analysis
-
max time kernel
126s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-06-2024 08:00
Static task
static1
Behavioral task
behavioral1
Sample
114626620c1c7ac58aa6198abb61d688_JaffaCakes118.dll
Resource
win7-20240611-en
General
-
Target
114626620c1c7ac58aa6198abb61d688_JaffaCakes118.dll
-
Size
239KB
-
MD5
114626620c1c7ac58aa6198abb61d688
-
SHA1
f77b1b7efa307797325274b979ffb7b5e26a868e
-
SHA256
538cf6f7120ccfb4b3a46cef0d8b4038ad18fd701fa440a352c6a3985b5ed175
-
SHA512
d69d9a1e98257b54770e044609730e72fc61b0010adbb3946348db9830ae4670cf8695d197ce026f80d1eabc181569cc7dff2736556a84dd7b7301e11ed71a03
-
SSDEEP
3072:tM25gs+jNAFBHZkZ/p20fryPDfMAS3uhpK4mMn3oTiaMYk9y2IF9Mn8YuosT//dD:bCRhsBHyr2HjVn36Zk9y2/n8Yuoe5P
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation regsvr32mgr.exe -
Executes dropped EXE 2 IoCs
pid Process 2112 regsvr32mgr.exe 2340 hjbiuncybixuvrbd.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 3644 1528 WerFault.exe 91 3640 5104 WerFault.exe 106 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4120452774" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115166" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4117015111" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115166" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "22047911" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{2104A7E0-3392-11EF-B8C0-FE55E2F65CCF} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4117015111" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115167" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426153793" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115166" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE -
Modifies registry class 32 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Igfxdo.DataObject\CurVer\ = "Igfxdo.DataObject.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4FA3D4E-BE69-11D4-AA30-00902704C6BF}\TypeLib\ = "{D4FA3D41-BE69-11D4-AA30-00902704C6BF}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D4FA3D41-BE69-11D4-AA30-00902704C6BF}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D4FA3D41-BE69-11D4-AA30-00902704C6BF}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D4FA3D41-BE69-11D4-AA30-00902704C6BF} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D4FA3D41-BE69-11D4-AA30-00902704C6BF}\1.0\ = "igfxdo 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D4FA3D41-BE69-11D4-AA30-00902704C6BF}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\114626620c1c7ac58aa6198abb61d688_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D4FA3D41-BE69-11D4-AA30-00902704C6BF}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4FA3D4E-BE69-11D4-AA30-00902704C6BF} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4FA3D4E-BE69-11D4-AA30-00902704C6BF}\VersionIndependentProgID\ = "Igfxdo.DataObject" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4FA3D4E-BE69-11D4-AA30-00902704C6BF}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4FA3D4E-BE69-11D4-AA30-00902704C6BF}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\114626620c1c7ac58aa6198abb61d688_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Igfxdo.DataObject\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4FA3D4E-BE69-11D4-AA30-00902704C6BF}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4FA3D4E-BE69-11D4-AA30-00902704C6BF}\ProgID\ = "Igfxdo.DataObject.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4FA3D4E-BE69-11D4-AA30-00902704C6BF}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D4FA3D41-BE69-11D4-AA30-00902704C6BF}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Igfxdo.DataObject\CLSID\ = "{D4FA3D4E-BE69-11D4-AA30-00902704C6BF}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Igfxdo.DataObject\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4FA3D4E-BE69-11D4-AA30-00902704C6BF}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4FA3D4E-BE69-11D4-AA30-00902704C6BF}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Igfxdo.DataObject.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Igfxdo.DataObject\ = "DataObject Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4FA3D4E-BE69-11D4-AA30-00902704C6BF}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D4FA3D41-BE69-11D4-AA30-00902704C6BF}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4FA3D4E-BE69-11D4-AA30-00902704C6BF}\ = "DataObject Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D4FA3D41-BE69-11D4-AA30-00902704C6BF}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Igfxdo.DataObject.1\ = "DataObject Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Igfxdo.DataObject.1\CLSID\ = "{D4FA3D4E-BE69-11D4-AA30-00902704C6BF}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Igfxdo.DataObject.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Igfxdo.DataObject regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D4FA3D41-BE69-11D4-AA30-00902704C6BF}\1.0\FLAGS regsvr32.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 668 Process not Found -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeSecurityPrivilege 2112 regsvr32mgr.exe Token: SeDebugPrivilege 2112 regsvr32mgr.exe Token: SeSecurityPrivilege 2340 hjbiuncybixuvrbd.exe Token: SeLoadDriverPrivilege 2340 hjbiuncybixuvrbd.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2260 IEXPLORE.EXE 2260 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2260 IEXPLORE.EXE 2260 IEXPLORE.EXE 2360 IEXPLORE.EXE 2360 IEXPLORE.EXE 2360 IEXPLORE.EXE 2360 IEXPLORE.EXE 2260 IEXPLORE.EXE 2260 IEXPLORE.EXE 4364 IEXPLORE.EXE 4364 IEXPLORE.EXE 4364 IEXPLORE.EXE 4364 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 4424 wrote to memory of 4824 4424 regsvr32.exe 89 PID 4424 wrote to memory of 4824 4424 regsvr32.exe 89 PID 4424 wrote to memory of 4824 4424 regsvr32.exe 89 PID 4824 wrote to memory of 2112 4824 regsvr32.exe 90 PID 4824 wrote to memory of 2112 4824 regsvr32.exe 90 PID 4824 wrote to memory of 2112 4824 regsvr32.exe 90 PID 2112 wrote to memory of 1528 2112 regsvr32mgr.exe 91 PID 2112 wrote to memory of 1528 2112 regsvr32mgr.exe 91 PID 2112 wrote to memory of 1528 2112 regsvr32mgr.exe 91 PID 2112 wrote to memory of 1528 2112 regsvr32mgr.exe 91 PID 2112 wrote to memory of 1528 2112 regsvr32mgr.exe 91 PID 2112 wrote to memory of 1528 2112 regsvr32mgr.exe 91 PID 2112 wrote to memory of 1528 2112 regsvr32mgr.exe 91 PID 2112 wrote to memory of 1528 2112 regsvr32mgr.exe 91 PID 2112 wrote to memory of 1528 2112 regsvr32mgr.exe 91 PID 2112 wrote to memory of 2628 2112 regsvr32mgr.exe 103 PID 2112 wrote to memory of 2628 2112 regsvr32mgr.exe 103 PID 2112 wrote to memory of 2628 2112 regsvr32mgr.exe 103 PID 2628 wrote to memory of 2260 2628 iexplore.exe 104 PID 2628 wrote to memory of 2260 2628 iexplore.exe 104 PID 2260 wrote to memory of 2360 2260 IEXPLORE.EXE 105 PID 2260 wrote to memory of 2360 2260 IEXPLORE.EXE 105 PID 2260 wrote to memory of 2360 2260 IEXPLORE.EXE 105 PID 2112 wrote to memory of 5104 2112 regsvr32mgr.exe 106 PID 2112 wrote to memory of 5104 2112 regsvr32mgr.exe 106 PID 2112 wrote to memory of 5104 2112 regsvr32mgr.exe 106 PID 2112 wrote to memory of 5104 2112 regsvr32mgr.exe 106 PID 2112 wrote to memory of 5104 2112 regsvr32mgr.exe 106 PID 2112 wrote to memory of 5104 2112 regsvr32mgr.exe 106 PID 2112 wrote to memory of 5104 2112 regsvr32mgr.exe 106 PID 2112 wrote to memory of 5104 2112 regsvr32mgr.exe 106 PID 2112 wrote to memory of 5104 2112 regsvr32mgr.exe 106 PID 2112 wrote to memory of 5076 2112 regsvr32mgr.exe 110 PID 2112 wrote to memory of 5076 2112 regsvr32mgr.exe 110 PID 2112 wrote to memory of 5076 2112 regsvr32mgr.exe 110 PID 5076 wrote to memory of 1092 5076 iexplore.exe 111 PID 5076 wrote to memory of 1092 5076 iexplore.exe 111 PID 2260 wrote to memory of 4364 2260 IEXPLORE.EXE 112 PID 2260 wrote to memory of 4364 2260 IEXPLORE.EXE 112 PID 2260 wrote to memory of 4364 2260 IEXPLORE.EXE 112 PID 2112 wrote to memory of 2340 2112 regsvr32mgr.exe 114 PID 2112 wrote to memory of 2340 2112 regsvr32mgr.exe 114 PID 2112 wrote to memory of 2340 2112 regsvr32mgr.exe 114
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\114626620c1c7ac58aa6198abb61d688_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\114626620c1c7ac58aa6198abb61d688_JaffaCakes118.dll2⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵PID:1528
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 2085⤵
- Program crash
PID:3644
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2260 CREDAT:17410 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2360
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2260 CREDAT:82950 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4364
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵PID:5104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 2045⤵
- Program crash
PID:3640
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"5⤵
- Modifies Internet Explorer settings
PID:1092
-
-
-
C:\Users\Admin\AppData\Local\Temp\hjbiuncybixuvrbd.exe"C:\Users\Admin\AppData\Local\Temp\hjbiuncybixuvrbd.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2340
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1528 -ip 15281⤵PID:4140
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3804,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:81⤵PID:3300
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 5104 -ip 51041⤵PID:1288
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5b9b9f42ce6d2b20bf169d05480d239d4
SHA132b094cc2ff79f07fcd68d585846b919bc350e4d
SHA2564d16bb8c9a34d4de9d39bb5f0e87095617b5ad551112db17b38b6cb752fbdae4
SHA51236b45c544439c6b1fab4c2fa58712475a65ad467e3da61086c4a953d6587d35f5c6ae7de740863295ae0d3534cbf67d0bed6843d95b6786b50431bfeebcf1010
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD57384aeeb3183419d6f3ed91fb6e6fba9
SHA1af3bc7723b0a0c38693fdd02bc1eb0ee38483635
SHA256f3c509460ccff1291b70d84f052a613451b57e577028e583678aac33adbcd4df
SHA512dee67aedfffde1eb868a6275fb96372362a22881ea561766d0357ea88d4672674cb40dd61686d8cff194f1c3c8b493b3bbca6304b26fe6a98b727e0b955b4bd0
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
109KB
MD523dcf284359d24e3fbee7741c80f246d
SHA1da45f93fe6c380c9f4b8b6dbba7943cf8b3688b3
SHA256989006203c54720a6f43a83c597aa2564db9b77f4df2b6ff2ba772db0109deb2
SHA5124a70bab783505c246f5a37dbce77a0529bf7c467c9c3f52e9edbef55fd36b735f64bc069ee3cde6939586f605daf895be90dc3604b40fa375b6a023568f2375d