276720cf837ad739f4e5db594b1993af540406bf2077d82814bbd0f91a171d8e

Analysis

max time kernel
139s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 10:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b9fd9ad4ace6f20860c07d82f42d302_JaffaCakes118.exe
Size

92KB
MD5

5b9fd9ad4ace6f20860c07d82f42d302
SHA1

f0c36d6299d43bbbdc1e74441542f4fb4b46f709
SHA256

276720cf837ad739f4e5db594b1993af540406bf2077d82814bbd0f91a171d8e
SHA512

2133b8effaef92c6db1bc45b3e1ddfea09ab52fea3d6194c7f2ff45df321925c5a5a4f56796f7238113a0fa8b26ca8c54e025c9993db5df7cda6bb012f0a8c4d
SSDEEP

1536:Ne0QgIgRBMi2tAj1Wa543WTg2wqtvacBHUfC82MoXSYnyVy07hFPV5XYBA1+:Ne0Qg/I2jp43WTguU4iu50TYBA4

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3180	E3ADA.exe
4120	E3ADA.exe
928	C0BCD.exe

Loads dropped DLL 2 IoCs

pid	Process
928	C0BCD.exe
928	C0BCD.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	C0BCD.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	C0BCD.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	C0BCD.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	C0BCD.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\SU5XKJON.htm	C0BCD.exe
File opened for modification	C:\Windows\SysWOW64\E3ADA.exe	5b9fd9ad4ace6f20860c07d82f42d302_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MSWINSCK.OCX	E3ADA.exe
File opened for modification	C:\Windows\SysWOW64\C0BCD.exe	E3ADA.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	C0BCD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	C0BCD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	C0BCD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	C0BCD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	C0BCD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	C0BCD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	C0BCD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	C0BCD.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	C0BCD.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	C0BCD.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	C0BCD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	C0BCD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	C0BCD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P	C0BCD.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	C0BCD.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	C0BCD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock	C0BCD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version\ = "1.0"	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	C0BCD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents"	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1	C0BCD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID\ = "MSWinsock.Winsock"	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR	C0BCD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR\	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	C0BCD.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}	C0BCD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ = "Microsoft WinSock Control, version 6.0"	C0BCD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"	C0BCD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus	C0BCD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX, 1"	C0BCD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl"	C0BCD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	C0BCD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32	C0BCD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX"	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0	C0BCD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	C0BCD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl"	C0BCD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents"	C0BCD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	C0BCD.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	C0BCD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\ = "Microsoft WinSock Control, version 6.0"	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories	C0BCD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\ = "0"	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	C0BCD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX"	C0BCD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer\ = "MSWinsock.Winsock.1"	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID	C0BCD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	C0BCD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1\ = "132497"	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID	C0BCD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}	C0BCD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0"	C0BCD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX"	C0BCD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID	C0BCD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID\ = "MSWinsock.Winsock.1"	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Programmable	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control	C0BCD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS	C0BCD.exe

Runs net.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4388	5b9fd9ad4ace6f20860c07d82f42d302_JaffaCakes118.exe
3180	E3ADA.exe
4120	E3ADA.exe
928	C0BCD.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 3180	4388	5b9fd9ad4ace6f20860c07d82f42d302_JaffaCakes118.exe	84
PID 4388 wrote to memory of 3180	4388	5b9fd9ad4ace6f20860c07d82f42d302_JaffaCakes118.exe	84
PID 4388 wrote to memory of 3180	4388	5b9fd9ad4ace6f20860c07d82f42d302_JaffaCakes118.exe	84
PID 3180 wrote to memory of 3476	3180	E3ADA.exe	85
PID 3180 wrote to memory of 3476	3180	E3ADA.exe	85
PID 3180 wrote to memory of 3476	3180	E3ADA.exe	85
PID 3180 wrote to memory of 612	3180	E3ADA.exe	86
PID 3180 wrote to memory of 612	3180	E3ADA.exe	86
PID 3180 wrote to memory of 612	3180	E3ADA.exe	86
PID 612 wrote to memory of 4152	612	cmd.exe	89
PID 612 wrote to memory of 4152	612	cmd.exe	89
PID 612 wrote to memory of 4152	612	cmd.exe	89
PID 3476 wrote to memory of 1636	3476	cmd.exe	90
PID 3476 wrote to memory of 1636	3476	cmd.exe	90
PID 3476 wrote to memory of 1636	3476	cmd.exe	90
PID 4152 wrote to memory of 4068	4152	net.exe	91
PID 4152 wrote to memory of 4068	4152	net.exe	91
PID 4152 wrote to memory of 4068	4152	net.exe	91
PID 1636 wrote to memory of 3956	1636	net.exe	92
PID 1636 wrote to memory of 3956	1636	net.exe	92
PID 1636 wrote to memory of 3956	1636	net.exe	92
PID 4120 wrote to memory of 1196	4120	E3ADA.exe	94
PID 4120 wrote to memory of 1196	4120	E3ADA.exe	94
PID 4120 wrote to memory of 1196	4120	E3ADA.exe	94
PID 1196 wrote to memory of 2320	1196	cmd.exe	96
PID 1196 wrote to memory of 2320	1196	cmd.exe	96
PID 1196 wrote to memory of 2320	1196	cmd.exe	96
PID 2320 wrote to memory of 4788	2320	net.exe	97
PID 2320 wrote to memory of 4788	2320	net.exe	97
PID 2320 wrote to memory of 4788	2320	net.exe	97
PID 4120 wrote to memory of 928	4120	E3ADA.exe	105
PID 4120 wrote to memory of 928	4120	E3ADA.exe	105
PID 4120 wrote to memory of 928	4120	E3ADA.exe	105

C:\Users\Admin\AppData\Local\Temp\5b9fd9ad4ace6f20860c07d82f42d302_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5b9fd9ad4ace6f20860c07d82f42d302_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\SysWOW64\E3ADA.exe
  C:\Windows\system32\E3ADA.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "net start E3ADA"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3476
  - - C:\Windows\SysWOW64\net.exe
      net start E3ADA
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1636
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start E3ADA
        5⤵
        
        PID:3956
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "net start E3ADA"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:612
  - - C:\Windows\SysWOW64\net.exe
      net start E3ADA
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4152
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start E3ADA
        5⤵
        
        PID:4068

C:\Windows\SysWOW64\E3ADA.exe
C:\Windows\SysWOW64\E3ADA.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "net start E3ADA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Windows\SysWOW64\net.exe
    net start E3ADA
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2320
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start E3ADA
      4⤵
      PID:4788
- C:\Windows\SysWOW64\C0BCD.exe
  C:\Windows\system32\C0BCD.exe eee
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\C0BCD.exe

Filesize
100KB

MD5
afe1b5525ce3d6c14c8c03bf29da5607

SHA1
b789e7785a4b81cb6196bb8b71544d5716dddc64

SHA256
ff76be234730780c6a8e2a3a262f8bf6b9f08ed97230f8bc8a299ae96a2163ed

SHA512
f1523fa1a4e0236d3310c4975e3987fea7f2d4aa20f3978f6d330058538a752c597b2110818f09404e0a2b2c4631460263ec707e960de53587e8c6577a672632

Download Submit
C:\Windows\SysWOW64\E3ADA.exe

Filesize
92KB

MD5
5b9fd9ad4ace6f20860c07d82f42d302

SHA1
f0c36d6299d43bbbdc1e74441542f4fb4b46f709

SHA256
276720cf837ad739f4e5db594b1993af540406bf2077d82814bbd0f91a171d8e

SHA512
2133b8effaef92c6db1bc45b3e1ddfea09ab52fea3d6194c7f2ff45df321925c5a5a4f56796f7238113a0fa8b26ca8c54e025c9993db5df7cda6bb012f0a8c4d

Download Submit
C:\Windows\SysWOW64\MSWINSCK.OCX

Filesize
105KB

MD5
9484c04258830aa3c2f2a70eb041414c

SHA1
b242a4fb0e9dcf14cb51dc36027baff9a79cb823

SHA256
bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5

SHA512
9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0

Download Submit
memory/3180-13-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4120-15-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4120-31-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4388-0-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4388-1-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download
memory/4388-12-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download