Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 09:18
Static task
static1
Behavioral task
behavioral1
Sample
66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe
-
Size
196KB
-
MD5
66fb1bb18e75f0bb0bca89d55afb0ec9
-
SHA1
52b7f47a3ad12580434f956b21f98547a886284d
-
SHA256
db2725ac686e28562c27ef88699ede3bb5dc3cdd58644cf2cb7bd02bb8d36680
-
SHA512
b3541098cf04bdb3bdfec69981e79848afb4da6b1cebc19dfc75dfaa6ba5266c0a6cee180052380c37f6bc4d1c58e47a829f9df5f4c3cd974df3a83b569318de
-
SSDEEP
3072:1uwTNLvIi99v3kaVfH3b52iOXbbx16B0YMr/F3VvZqsmGqOHXIFBjm1/cY7Kx:PRvpVz5OXp1Y0YMr/FFFm1sUYWx
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe D:\\VolumeXX" mshta.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" mshta.exe -
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4140 2984 attrib.exe 100 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4576 2984 attrib.exe 100 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3920 2984 attrib.exe 100 -
Sets file to hidden 1 TTPs 3 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 4140 attrib.exe 4576 attrib.exe 3920 attrib.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation inl9695.tmp Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation lieC51.tmp Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation 66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe -
Executes dropped EXE 5 IoCs
pid Process 2472 inl9695.tmp 1148 lieC51.tmp 1652 kil270E.tmp 4600 19920306.exe 4912 920306.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File created D:\VolumeXX\desktop.ini mshta.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\wbem\fxsst.dll inl9695.tmp -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files\Common Files\920306.exe kil270E.tmp File created C:\Program Files\temp01\XX.exe kil270E.tmp File opened for modification C:\Program Files\temp01\XX.exe kil270E.tmp File created C:\Program Files\Common Files\19920306.exe kil270E.tmp -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\LOGS\DPX\setupact.log expand.exe File opened for modification C:\Windows\LOGS\DPX\setuperr.log expand.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 2448 4912 WerFault.exe 125 4148 4912 WerFault.exe 125 -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3801471402" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31120614" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10d06ee3e6dcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1177238915-1004336348-682003330-500\Software\Microsoft\Internet Explorer\Main mshta.exe Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3801471402" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31120614" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31120614" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3798971186" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31120614" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000910d3a7c1e28bd46a564221e06ecd8180000000002000000000010660000000100002000000014901b3da3252df2125b3ef9f2780efc95c77e934b7586d233c6e62052fc5728000000000e8000000002000020000000555099c1b8dd8645ba6bd9c4ee3b0b5f6a494a6be8b9930ce2bb0cbeadfde6b620000000f721e2b52a43bb49f197924e24dccc41570bedcb24e4437bce981cdb4ca954fb4000000053e914efcf9d23374a62a9381ef0fb014b089cce3ef09d75307cc55a4c3dfc876e40444e345885a464075be5b3cdea19a43e67efae04d3bdba869c9373394096 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0DDDA084-48DA-11EF-A174-4A319C7DE533} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3798971186" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000910d3a7c1e28bd46a564221e06ecd818000000000200000000001066000000010000200000001485f03b1f66c6f030efaacb2e85671309dbf9bdd004dc3b242cc63a29bb86b1000000000e800000000200002000000064eb12594edb4a8f24f7eb1e5f9efe228567018c8d5f590c921b56a325dd7f95200000007ccdc3adb0caf86ee2377c2cda3715c1e1e95be8783ab9a4c273fe0b01bd183840000000c333d289085cd6ebde0e523d4f778de101228e2e5ff7bf8f9a73dec9dd8088e40af36b903fcc4cad0b379431d538a0ae0be7c6d19ce200bda1c5142bf1c57f37 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428493659" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20c262e3e6dcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.4191.com/?hta" mshta.exe -
Modifies registry class 11 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}\shell\open(&H)\command\ = "mshta.exe C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\NTUSER~1.HTA" mshta.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE" mshta.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}\IsShortCut mshta.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node mshta.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}\shell mshta.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon mshta.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19} mshta.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}\shell\open(&H)\command mshta.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID mshta.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}\shell\open(&H) mshta.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3008 PING.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2472 inl9695.tmp 2472 inl9695.tmp 1652 kil270E.tmp 1652 kil270E.tmp -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4148 66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2860 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2860 iexplore.exe 2860 iexplore.exe 4540 IEXPLORE.EXE 4540 IEXPLORE.EXE 4540 IEXPLORE.EXE 4540 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 4148 wrote to memory of 3140 4148 66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe 89 PID 4148 wrote to memory of 3140 4148 66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe 89 PID 4148 wrote to memory of 3140 4148 66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe 89 PID 4148 wrote to memory of 1696 4148 66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe 91 PID 4148 wrote to memory of 1696 4148 66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe 91 PID 4148 wrote to memory of 1696 4148 66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe 91 PID 4148 wrote to memory of 4652 4148 66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe 93 PID 4148 wrote to memory of 4652 4148 66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe 93 PID 4148 wrote to memory of 4652 4148 66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe 93 PID 1696 wrote to memory of 4632 1696 cmd.exe 94 PID 1696 wrote to memory of 4632 1696 cmd.exe 94 PID 1696 wrote to memory of 4632 1696 cmd.exe 94 PID 3140 wrote to memory of 2472 3140 cmd.exe 96 PID 3140 wrote to memory of 2472 3140 cmd.exe 96 PID 3140 wrote to memory of 2472 3140 cmd.exe 96 PID 2472 wrote to memory of 2796 2472 inl9695.tmp 105 PID 2472 wrote to memory of 2796 2472 inl9695.tmp 105 PID 2472 wrote to memory of 2796 2472 inl9695.tmp 105 PID 2472 wrote to memory of 2860 2472 inl9695.tmp 107 PID 2472 wrote to memory of 2860 2472 inl9695.tmp 107 PID 2860 wrote to memory of 4540 2860 iexplore.exe 108 PID 2860 wrote to memory of 4540 2860 iexplore.exe 108 PID 2860 wrote to memory of 4540 2860 iexplore.exe 108 PID 2796 wrote to memory of 1148 2796 cmd.exe 109 PID 2796 wrote to memory of 1148 2796 cmd.exe 109 PID 2796 wrote to memory of 1148 2796 cmd.exe 109 PID 1148 wrote to memory of 4316 1148 lieC51.tmp 110 PID 1148 wrote to memory of 4316 1148 lieC51.tmp 110 PID 1148 wrote to memory of 4316 1148 lieC51.tmp 110 PID 4316 wrote to memory of 3008 4316 cmd.exe 112 PID 4316 wrote to memory of 3008 4316 cmd.exe 112 PID 4316 wrote to memory of 3008 4316 cmd.exe 112 PID 2472 wrote to memory of 4544 2472 inl9695.tmp 117 PID 2472 wrote to memory of 4544 2472 inl9695.tmp 117 PID 2472 wrote to memory of 4544 2472 inl9695.tmp 117 PID 4544 wrote to memory of 1652 4544 cmd.exe 120 PID 4544 wrote to memory of 1652 4544 cmd.exe 120 PID 4544 wrote to memory of 1652 4544 cmd.exe 120 PID 1652 wrote to memory of 4600 1652 kil270E.tmp 124 PID 1652 wrote to memory of 4600 1652 kil270E.tmp 124 PID 1652 wrote to memory of 4600 1652 kil270E.tmp 124 PID 1652 wrote to memory of 4912 1652 kil270E.tmp 125 PID 1652 wrote to memory of 4912 1652 kil270E.tmp 125 PID 1652 wrote to memory of 4912 1652 kil270E.tmp 125 PID 4316 wrote to memory of 4864 4316 cmd.exe 131 PID 4316 wrote to memory of 4864 4316 cmd.exe 131 PID 4316 wrote to memory of 4864 4316 cmd.exe 131 -
Views/modifies file attributes 1 TTPs 3 IoCs
pid Process 4140 attrib.exe 4576 attrib.exe 3920 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\inl9695.tmpC:\Users\Admin\AppData\Local\Temp\inl9695.tmp cdf1912.tmp3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\run_lk_file.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\lieC51.tmpC:\Users\Admin\AppData\Local\Temp\lieC51.tmp5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\run_rlh_tmp.bat" "6⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\PING.EXEping 88.99.00.007⤵
- Runs ping.exe
PID:3008
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Roaming\MICROS~1\NTUSER_LOG.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}7⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
PID:4864
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://tc.92mh.com/4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4540
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\run_kl_file.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\kil270E.tmpC:\Users\Admin\AppData\Local\Temp\kil270E.tmp5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Program Files\Common Files\19920306.exe"C:\Program Files\Common Files\19920306.exe"6⤵
- Executes dropped EXE
PID:4600
-
-
C:\Program Files\Common Files\920306.exe"C:\Program Files\Common Files\920306.exe"6⤵
- Executes dropped EXE
PID:4912 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 3007⤵
- Program crash
PID:2448
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 3087⤵
- Program crash
PID:4148
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\expand.exeexpand.exe "C:\Users\Admin\AppData\Local\Temp\favorites_url.cab" -F:*.* "C:\Users\Admin\Favorites"3⤵
- Drops file in Windows directory
PID:4632
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\66FB1B~1.EXE > nul2⤵PID:4652
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4912 -ip 49121⤵PID:3356
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4912 -ip 49121⤵PID:1944
-
C:\Windows\system32\attrib.exeattrib +s +h "D:\RECYCLERMD4"1⤵
- Process spawned unexpected child process
- Sets file to hidden
- Views/modifies file attributes
PID:4140
-
C:\Windows\system32\attrib.exeattrib +s +h "D:\VolumeXX\desktop.ini"1⤵
- Process spawned unexpected child process
- Sets file to hidden
- Views/modifies file attributes
PID:4576
-
C:\Windows\system32\attrib.exeattrib +s +h "D:\VolumeXX"1⤵
- Process spawned unexpected child process
- Sets file to hidden
- Views/modifies file attributes
PID:3920
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24.1MB
MD579654049ba429cc93db2faebe9c761c6
SHA1f54f61d20fd1732eb9712953a30ccc1743dbd091
SHA2560edcf4285b5bd8e8edee460be44a10271662261769b646db008fe2d5f9f2d0e3
SHA512aaec7299865cdecfc79bb03e648a1bf6b2b6adebc361c925a161972b21028c8a3c8438f41d41448fa4922b0bb0453f05ebfff0f064832b19ace9e1089895a26e
-
Filesize
24.2MB
MD56cb5cf2002816d36f69f192dbd646385
SHA1786ef5849611ded0287a90536c9b18934c4742bd
SHA256747c8e479f277211d343df1a21c665a13fb1440ba3c490da4d6be767067ab48d
SHA512c0ed93fdba47290280e4cdc1454a32987f6f450b235787d73bd77ae752bf0fae5dfd25b1b7b8323bfe3db6893fb6d665c1e3e752703562e33329fafdf84a749f
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
766B
MD5b69d002455f1a5a100e717a6a84ff991
SHA13a99b22845afb2132300095d84534e65823e678d
SHA256c05465e73465c2d6addc7514ad50b517675ce26bfb1a4cad3d3b64b617940934
SHA5121f2e36f1e8c6f66ba746a3450a9f5c07f300bff4682e32344541596b0bdae7e3f443f3e25deaa7936195c48642f9268e3a626a4018772417ce48d26e4f9d1505
-
Filesize
57B
MD5e0b1a0fe1a2802368b3a8e7b1e399bf1
SHA12fb70f2da2656cb29dd7894d55a6e287272d62db
SHA2561afdcae8686b8112cc3df81ef72c95ae9f23f6da62424672d6e701a3b878a788
SHA5128e91e45a086646e9c4caa5fb5c6a8e0d2bdb5a760f3be40a081f5b5c3956bb144bfa1e0ab58f826b94b50aa79236a77c5738d1914ca76d3f30916593c8cc785d
-
Filesize
45B
MD52220659200be39fcc23b9f8c65a5c0a5
SHA1063f63aa67539d849607695bebeea0dfca6b7a2a
SHA256d64f9bb1344205c769950ce0be3f594941790aaa6a4493694fa4a4c60a435fdc
SHA512aa09cd362f5b6a5a525ed75cd29a190f9ebf387198e82fe502c28696d497ae8875600bef77bd9c41206c1f34f2dbe6070119fdf9fbf9d9616b689e42cd8ad07c
-
Filesize
44B
MD5d8afd0adea160b9755513beeecbd1d3d
SHA16caaf1920b247b6d7928e2a83853b8510202614d
SHA2565a8933fc3d3e3f5dcc32bf978c10b8c507dfbb6f9c933a31458408bb7ff6315f
SHA512c6233c8d5cdac7fed04b2395fa79ebd76fee0629f3587789f81faef3f03480344715a824988374ac5a6e6059d96af493d3f971a4ce3b2413285ffd3f82107dcd
-
Filesize
70B
MD5edea5cd5060d69b6c558fea75e330a67
SHA1929e7c5ca8c300a98ac6833d0e8fa912ca9fa5dd
SHA2561ed1bc8bfd84479497b2c1e3d0ca1df56eb2f3d82a68862e8b50eead06889b39
SHA512adbe14c811b915972709530049bb6934eacead6c5d19243ecea07abdd6c93aeede3fcae99f6419fb7ca1b2394dcef19e642be36f22c572de01b069dac2b4aa61
-
Filesize
98B
MD58663de6fce9208b795dc913d1a6a3f5b
SHA1882193f208cf012eaf22eeaa4fef3b67e7c67c15
SHA2562909ea8555f2fc19097c1070a1da8fcfd6dc6886aa1d99d7e0c05e53feeb5b61
SHA5129381063e0f85e874be54ae22675393b82c6ab54b223090148e4acbeff6f22393c96c90b83d6538461b695528af01d1f1231cf5dc719f07d6168386974b490688
-
Filesize
7KB
MD555409e8335285720e34eeb153fee993d
SHA151336bf33901c5a544387b8ae5fe3ca2f97f7db8
SHA25690e0062b4e9e8dca75ff5f6792529075d2594e74fb4693ace0001fe226e6a42a
SHA5121964296394ae968c3fdc5bbe9d808f2e51c45f5610d48f7db77d7ce70f9525290eede4f8411768825824131bfaffa43d4ccfb0fdfacd3c53ccd5458843d4049d
-
Filesize
154B
MD58d681a59ea75e91f730bd9ce3c42e514
SHA19d426029daeebf03c9053761e0e5a9f447f98e9c
SHA256afd3d42faa66d6703a32f2f5b41e0d679dd8210aacb284d1e46854207087cac7
SHA512ffece212187fb127e98a612a59e7f2df7e9ebc6fee600644e2eef80d62fcc7d411ffba435b48981c4d75ba0ca34f85ff57091f4098104651710220a28a13ba8d
-
Filesize
155B
MD55a17106c27138df10448c2c3be95f399
SHA156acc2ed4fea4171127a13dcdee08bdd39d674d6
SHA256c544ab13bd785ea3d5792873dedb102e87ea9a3b28fb1283be2eaac363ce360c
SHA5121d8839f36323dfb4458745dbf31a98bc676121db3e4ccda59ca8e177437c85a5811125119fbfa3b5bcde6c2fbf25ae910109e785e276c32fbfebe6437aea8198
-
Filesize
156B
MD58a275b261afcc166671132b6f03831e4
SHA103ac21edc1de2df748ee3a301a6b3de989c423c3
SHA2560296e167f4cfe36275cf1a705a6c56b30b15c0712ec5904b4ed3299f07beee8e
SHA512269cf3d57201d9c390cef3a8e74d63036d300ff464d20b419324d4575c04e004655179ac29da5e3b2b52a5e2b6f37ecbf6e512fa0c2c5d5af0c5a359af51d739
-
Filesize
158B
MD5d645085ab92574a2a17abd323415dde5
SHA149ebaa4499cacd9256f270f35f31684b7cd195b1
SHA25641ef37f97f886f32ec9e4d9ebf58079442d8bc8b102e9487de2f3f7da36e8058
SHA512a726352ef7725eb8f94609dc3b80b5314387416513e654487e6a0b96bab922412b15bfbc07f1643bc104543be7c4c8a1b1472374d8cfe7fa9a010d28a135d654
-
Filesize
157B
MD5993f72a439a3301caeb969c7faa7a8b9
SHA1176244349a0463cd0fc38cad426d89dc3b055311
SHA256b7ea84a9d48f22c799c3c3b96f29f0ae7c1b274e6402d6fbadae31fc053f2140
SHA512c373b12c16c65e966593990019b3a2fd96f703820976835c7ab3d042a997f617f49c1b5110e77833a18b3d2a2bef8fd3a97e77ea05dd7cdce9053840398320d8
-
Filesize
425B
MD5da68bc3b7c3525670a04366bc55629f5
SHA115fda47ecfead7db8f7aee6ca7570138ba7f1b71
SHA25673f3605192b676c92649034768378909a19d13883a7ea6f8ba1b096c78ffadb5
SHA5126fee416affcb6a74621479697bca6f14f5429b00de3aa595abe3c60c6b2e094877b59f8783bbe7bdd567fa565d0630bb02def5603f8f0ea92fe8f2c3ac5383c0