Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
16/07/2024, 01:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4c30f920177a7879446a1572de62af47_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
4c30f920177a7879446a1572de62af47_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
4c30f920177a7879446a1572de62af47_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
4c30f920177a7879446a1572de62af47
-
SHA1
9ec99517701915af05c4b158da1acfb9ac4defdb
-
SHA256
7dd2a31204e2260194dd12862fb663a641436af85177d0e7b547a13e9e34ef45
-
SHA512
e7b8b2fc47263614cbfa710c15e7d559cb9295e48c840781a63652fbb762f82998db9b1a21449bdc6a20d656c5431d369f5b9e38a6fa466a9cb5e25f2e31bf88
-
SSDEEP
24576:G2r4/sxU9RzIUFUlmWLmYbPvHTLukjKNMgL9Z5:Gy40pDDHHKNMU
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2112 FJPCCI.exe 2852 2.exe 2068 2.exe -
Loads dropped DLL 5 IoCs
pid Process 2536 4c30f920177a7879446a1572de62af47_JaffaCakes118.exe 2536 4c30f920177a7879446a1572de62af47_JaffaCakes118.exe 2536 4c30f920177a7879446a1572de62af47_JaffaCakes118.exe 2852 2.exe 2068 2.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA FJPCCI.exe -
Drops file in Program Files directory 12 IoCs
description ioc Process File created C:\Program Files\CEK6E\ANEMUC0XYZ.exe 4c30f920177a7879446a1572de62af47_JaffaCakes118.exe File opened for modification C:\Program Files\CEK6E\OTSCZU.exe 4c30f920177a7879446a1572de62af47_JaffaCakes118.exe File created C:\Program Files\SMYA4\VV19JIDVLY.exe 2.exe File opened for modification C:\Program Files\SMYA4\VV19JIDVLY.exe 2.exe File created C:\Program Files\Q3TQMDTPS\TS6J7J.exe 2.exe File opened for modification C:\Program Files\CEK6E\ANEMUC0XYZ.exe 4c30f920177a7879446a1572de62af47_JaffaCakes118.exe File created C:\Program Files\CEK6E\OTSCZU.exe 4c30f920177a7879446a1572de62af47_JaffaCakes118.exe File created C:\Program Files\SMYA4\5D7WA1IMC.exe 2.exe File opened for modification C:\Program Files\Q3TQMDTPS\TS6J7J.exe 2.exe File opened for modification C:\Program Files\SMYA4\5D7WA1IMC.exe 2.exe File created C:\Program Files\Q3TQMDTPS\5D7WA1IMC.exe 2.exe File opened for modification C:\Program Files\Q3TQMDTPS\5D7WA1IMC.exe 2.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\MNQEVQUKIHRUEC.txt 2.exe File opened for modification C:\Windows\MNQEVQUKIHRUEC.txt 2.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main reg.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Play_Animations = "no" reg.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Display Inline Videos = "no" reg.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Play_Background_Sounds = "no" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Display Inline Images = "yes" reg.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main reg.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main reg.exe -
Modifies registry class 64 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Compact\ = "JScript Compact Profile (ECMA 327)" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Encoder regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\JScript Author regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\OLEScript regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{F0B7A1A2-9847-11CF-8F20-00805F2CD064} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JScript Author\OLEScript regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\JScript Author\OLESCRIPT regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.1 Author\CLSID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\Implemented Categories\{F0B7A1A2-9847-11CF-8F20-00805F2CD064} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ECMAScript Author\ = "JScript Language Authoring" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.3 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.1 Author\OLESCRIPT regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript\OLESCRIPT regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.2\OLESCRIPT regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LiveScript regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\JScript\OLESCRIPT regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript Author\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ECMAScript Author\CLSID\ = "{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}\Implemented Categories\{F0B7A1A2-9847-11CF-8F20-00805F2CD064} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\JSFile\SCRIPTHOSTENCODE regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\LiveScript Author\OLESCRIPT regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\ECMAScript Author regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.2 AuthorJavaScript1.3 Author regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}\Implemented Categories\{F0B7A1A3-9847-11CF-8F20-00805F2CD064} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\LiveScript\OLESCRIPT regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\ProgID\ = "JScript Author" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Encode\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}\ = "JScript Language Encoding" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ECMAScript\OLEScript regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.1 Author regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ECMAScript Author\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JScript\CLSID\ = "{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32\ = "C:\\Windows\\SysWOW64\\jscript.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\ProgID\ = "JScript.Compact" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\Implemented Categories\{F0B7A1A1-9847-11CF-8F20-00805F2CD064} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Compact Author\CLSID\ = "{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Compact\OLEScript regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.2\ = "JScript Language" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript Author\CLSID\ = "{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.2 AuthorJavaScript1.3 Author\ = "JScript Language Authoring" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Compact regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.1\CLSID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\Implemented Categories\{F0B7A1A1-9847-11CF-8F20-00805F2CD064} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Compact\OLESCRIPT regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.1 Author\ = "JScript Language Authoring" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\Implemented Categories\{0AEE2A92-BCBB-11D0-8C72-00C04FC2B085} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\ECMAScript Author\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.1 Author\CLSID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\LiveScript Author\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript Author\OLEScript regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JScript\ = "JScript Language" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.1 Author\OLEScript regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.3\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.3\ = "JScript Language" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\InprocServer32\ = "C:\\Windows\\SysWOW64\\jscript.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript\OLEScript regsvr32.exe -
Modifies registry key 1 TTPs 2 IoCs
pid Process 2144 reg.exe 2732 reg.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 2536 4c30f920177a7879446a1572de62af47_JaffaCakes118.exe 2536 4c30f920177a7879446a1572de62af47_JaffaCakes118.exe 2112 FJPCCI.exe 2112 FJPCCI.exe 2112 FJPCCI.exe 2112 FJPCCI.exe 2112 FJPCCI.exe 2852 2.exe 2852 2.exe 2068 2.exe 2068 2.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2536 wrote to memory of 2112 2536 4c30f920177a7879446a1572de62af47_JaffaCakes118.exe 30 PID 2536 wrote to memory of 2112 2536 4c30f920177a7879446a1572de62af47_JaffaCakes118.exe 30 PID 2536 wrote to memory of 2112 2536 4c30f920177a7879446a1572de62af47_JaffaCakes118.exe 30 PID 2536 wrote to memory of 2112 2536 4c30f920177a7879446a1572de62af47_JaffaCakes118.exe 30 PID 2112 wrote to memory of 2852 2112 FJPCCI.exe 32 PID 2112 wrote to memory of 2852 2112 FJPCCI.exe 32 PID 2112 wrote to memory of 2852 2112 FJPCCI.exe 32 PID 2112 wrote to memory of 2852 2112 FJPCCI.exe 32 PID 2112 wrote to memory of 2068 2112 FJPCCI.exe 33 PID 2112 wrote to memory of 2068 2112 FJPCCI.exe 33 PID 2112 wrote to memory of 2068 2112 FJPCCI.exe 33 PID 2112 wrote to memory of 2068 2112 FJPCCI.exe 33 PID 2112 wrote to memory of 2824 2112 FJPCCI.exe 34 PID 2112 wrote to memory of 2824 2112 FJPCCI.exe 34 PID 2112 wrote to memory of 2824 2112 FJPCCI.exe 34 PID 2112 wrote to memory of 2824 2112 FJPCCI.exe 34 PID 2824 wrote to memory of 2708 2824 cmd.exe 36 PID 2824 wrote to memory of 2708 2824 cmd.exe 36 PID 2824 wrote to memory of 2708 2824 cmd.exe 36 PID 2824 wrote to memory of 2708 2824 cmd.exe 36 PID 2824 wrote to memory of 2708 2824 cmd.exe 36 PID 2824 wrote to memory of 2708 2824 cmd.exe 36 PID 2824 wrote to memory of 2708 2824 cmd.exe 36 PID 2824 wrote to memory of 2916 2824 cmd.exe 37 PID 2824 wrote to memory of 2916 2824 cmd.exe 37 PID 2824 wrote to memory of 2916 2824 cmd.exe 37 PID 2824 wrote to memory of 2916 2824 cmd.exe 37 PID 2824 wrote to memory of 2916 2824 cmd.exe 37 PID 2824 wrote to memory of 2916 2824 cmd.exe 37 PID 2824 wrote to memory of 2916 2824 cmd.exe 37 PID 2824 wrote to memory of 2776 2824 cmd.exe 38 PID 2824 wrote to memory of 2776 2824 cmd.exe 38 PID 2824 wrote to memory of 2776 2824 cmd.exe 38 PID 2824 wrote to memory of 2776 2824 cmd.exe 38 PID 2824 wrote to memory of 2776 2824 cmd.exe 38 PID 2824 wrote to memory of 2776 2824 cmd.exe 38 PID 2824 wrote to memory of 2776 2824 cmd.exe 38 PID 2824 wrote to memory of 2652 2824 cmd.exe 39 PID 2824 wrote to memory of 2652 2824 cmd.exe 39 PID 2824 wrote to memory of 2652 2824 cmd.exe 39 PID 2824 wrote to memory of 2652 2824 cmd.exe 39 PID 2824 wrote to memory of 2724 2824 cmd.exe 40 PID 2824 wrote to memory of 2724 2824 cmd.exe 40 PID 2824 wrote to memory of 2724 2824 cmd.exe 40 PID 2824 wrote to memory of 2724 2824 cmd.exe 40 PID 2824 wrote to memory of 2660 2824 cmd.exe 41 PID 2824 wrote to memory of 2660 2824 cmd.exe 41 PID 2824 wrote to memory of 2660 2824 cmd.exe 41 PID 2824 wrote to memory of 2660 2824 cmd.exe 41 PID 2824 wrote to memory of 2660 2824 cmd.exe 41 PID 2824 wrote to memory of 2660 2824 cmd.exe 41 PID 2824 wrote to memory of 2660 2824 cmd.exe 41 PID 2824 wrote to memory of 2608 2824 cmd.exe 42 PID 2824 wrote to memory of 2608 2824 cmd.exe 42 PID 2824 wrote to memory of 2608 2824 cmd.exe 42 PID 2824 wrote to memory of 2608 2824 cmd.exe 42 PID 2824 wrote to memory of 2608 2824 cmd.exe 42 PID 2824 wrote to memory of 2608 2824 cmd.exe 42 PID 2824 wrote to memory of 2608 2824 cmd.exe 42 PID 2824 wrote to memory of 2616 2824 cmd.exe 43 PID 2824 wrote to memory of 2616 2824 cmd.exe 43 PID 2824 wrote to memory of 2616 2824 cmd.exe 43 PID 2824 wrote to memory of 2616 2824 cmd.exe 43 PID 2824 wrote to memory of 2636 2824 cmd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c30f920177a7879446a1572de62af47_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4c30f920177a7879446a1572de62af47_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\FJPCCI.exeC:\Users\Admin\AppData\Local\Temp\FJPCCI.exe2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\2.exe"C:\2.exe" MNQEVQUKIHRUEC3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2852
-
-
\??\c:\2.exec:\2.exe MNQEVQUKIHRUEC3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2068
-
-
C:\Windows\SysWOW64\cmd.execmd /c c:\2.bat3⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /u /s vbscript.dll4⤵PID:2708
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /u /s msvidctl.dll4⤵PID:2916
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /u /s scrrun.dll4⤵
- Modifies registry class
PID:2776
-
-
C:\Windows\SysWOW64\reg.exereg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Display Inline Videos" /t REG_SZ /d no /F4⤵
- Modifies Internet Explorer settings
PID:2652
-
-
C:\Windows\SysWOW64\reg.exereg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Play_Background_Sounds /t REG_SZ /d no /F4⤵
- Modifies Internet Explorer settings
PID:2724
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s jscript.dll4⤵
- Modifies registry class
PID:2660
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /u /s itss.dll4⤵PID:2608
-
-
C:\Windows\SysWOW64\reg.exereg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Display Inline Images" /t REG_SZ /d yes /F4⤵
- Modifies Internet Explorer settings
PID:2616
-
-
C:\Windows\SysWOW64\reg.exereg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Play_Animations /t REG_SZ /d no /F4⤵
- Modifies Internet Explorer settings
PID:2636
-
-
C:\Windows\SysWOW64\reg.exereg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Disable Script Debugger" /t REG_SZ /d yes /F4⤵
- Modifies Internet Explorer settings
PID:2656
-
-
C:\Windows\SysWOW64\reg.exereg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v DisableScriptDebuggerIE /t REG_SZ /d yes /F4⤵
- Modifies Internet Explorer settings
PID:2680
-
-
C:\Windows\SysWOW64\reg.exereg.exe delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /F4⤵
- Adds Run key to start application
- Modifies registry key
PID:2732
-
-
C:\Windows\SysWOW64\reg.exereg.exe delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /F4⤵
- Modifies registry key
PID:2144
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD576765c71877142243edf9766fd5fcc8f
SHA14e01a90382e6ef63a2902db0d888ae1cb7e8f78c
SHA2563cc9cbf30920f5e277e406e5c981b60fcf8161c5186d868f89186d8f73b80e24
SHA512d671cc850c058c60cd34980820f33b67dbde2e5b93683660f67d2eef277435b14c81d9e7343bd36d2a574b14f761598aa0c62d229b110598d9830b8087a1b811
-
Filesize
21KB
MD50cc2230a06f3636977984747abee72b8
SHA187cacf337c098af57b9aa096637fe8d1fddebf09
SHA2566f64b30f199d05ec81e7f963c4f09942a875206cdb605dd571edfeb447240948
SHA5120595afd55130adf494bac89c00d4cde91c7c82b4e05279dd0eb885e7a343b8fc42b022b42652f7ef98f4775f701eb6378a52f186279dd745cf567bb71dfdc754
-
Filesize
40KB
MD5b44be3df239bb8d68a462fcf4225b6c4
SHA1cd23d649218d6c0ac866f3d7ae2fa46a033134f8
SHA25699b67c7ebe44ecc215ad1d313229315f797c976abab96e4948ea1862217dc51e
SHA512a37857bb13bd2e6af44e0227222f879af55cb89f264038fc236ee0979424c9c08c296d6e3f44539703e33ee337a7011e87c54e6ef59591f4f968cbff76139333
-
Filesize
28KB
MD54cce1de3cd30abd69936b4ae2a163d24
SHA1d83275917d5e896fc1fe8e24845fc14914038a02
SHA25610b1d161d76292b35eddc793049aa1dd4b5d61754edbbeaabcc04e5413ec5ffc
SHA51276da4304183f01358a3bcbebba47bf0998edb87584bae5c910104bf58adb75285387572c78ea14bf40fa9ec86be6189b2bbf2579bf63284fcb7beb539adbd05c