Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
25/07/2024, 19:19
Static task
static1
Behavioral task
behavioral1
Sample
70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe
-
Size
57KB
-
MD5
70e49a354e53708d81202744ae8fc1c6
-
SHA1
24746e0dbaa653171c308be8759d866e91e61a2f
-
SHA256
7285c09b613a6d73bd7982011a13abdf56c39a2302d88a314b47836eb426ba4e
-
SHA512
a1a132cb17b9fae471633dd3c30c4fc7b1b1cbee61ff302e008b0b910f78ed943a2c26dcc183d3615e9685a8d4b36755de6f98a03993fd592f89d6f942cdc84c
-
SSDEEP
1536:MYE8pu3/c5YtKIuaHQ3mZUdkjXDRFdy7ABwj8AoUwLPb2:MYE8pu3/c5YtKIuaHQ3mZUdkjNy7c28I
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation 70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation acrotray.exe Key value queried \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation acrotray .exe -
Executes dropped EXE 4 IoCs
pid Process 4368 acrotray.exe 2208 acrotray.exe 3564 acrotray .exe 2344 acrotray .exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe_Reader = "c:\\program files (x86)\\adobe\\acrotray.exe" 70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created \??\c:\program files (x86)\adobe\acrotray .exe 70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe File created \??\c:\program files (x86)\adobe\acrotray.exe 70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language acrotray.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ielowutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language acrotray .exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "310093770" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000debc2266799c244dbced532ae65bc0ec00000000020000000000106600000001000020000000b16b6c8ff128185a8c5ba7c0a70f1819214f8143b0e474583cdeb1e3f5513f66000000000e80000000020000200000006686e5041dd956d36c7a50b10067192ececbcb68f3b4ccb60f3f36785def910f2000000078e15f014af5f162a351b3d12ff9cd4cf8b7241eb336cf75f3f33bdc7e7bd6bd400000009cac654ade93da63f49880f4253b015ed3c2fdea8a070b0008066de7b95dd7fe2638d9dacca4eba6b27803184d5b902790de8561093c58f3632b23651f51fbd6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428700328" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31121096" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3D8C9759-4ABB-11EF-A8A8-EEBB2D38B7CC} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "310093770" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000debc2266799c244dbced532ae65bc0ec00000000020000000000106600000001000020000000cabd46487e9b9d509d97c730de25f1dc05c17469d4c3830337bca8f0de0c1be7000000000e8000000002000020000000b06f9e684b9c3cb8d55cd9c411b03b31659a225d621c3d5c3287821557b98621200000004e2b8473176f0416727a942d64a012daccde5192990ed84de396812e6adebe87400000002ff395a6ca3e38806a5c1e866788eeca4c5a92ec30062dd45554edf1d9f6dc5727344d249fa6608762136fc9a2973b4191efc51d1bff9379d5846f9a22b11497 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30223c11c8deda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31121096" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0bc5821c8deda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 552 70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe 552 70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe 552 70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe 552 70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe 552 70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe 552 70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe 3908 70e49a354e53708d81202744ae8fc1c6_jaffacakes118.exe 3908 70e49a354e53708d81202744ae8fc1c6_jaffacakes118.exe 3908 70e49a354e53708d81202744ae8fc1c6_jaffacakes118.exe 3908 70e49a354e53708d81202744ae8fc1c6_jaffacakes118.exe 3908 70e49a354e53708d81202744ae8fc1c6_jaffacakes118.exe 3908 70e49a354e53708d81202744ae8fc1c6_jaffacakes118.exe 3908 70e49a354e53708d81202744ae8fc1c6_jaffacakes118.exe 3908 70e49a354e53708d81202744ae8fc1c6_jaffacakes118.exe 3908 70e49a354e53708d81202744ae8fc1c6_jaffacakes118.exe 3908 70e49a354e53708d81202744ae8fc1c6_jaffacakes118.exe 4368 acrotray.exe 4368 acrotray.exe 4368 acrotray.exe 4368 acrotray.exe 4368 acrotray.exe 4368 acrotray.exe 2208 acrotray.exe 2208 acrotray.exe 2208 acrotray.exe 2208 acrotray.exe 3564 acrotray .exe 3564 acrotray .exe 3564 acrotray .exe 3564 acrotray .exe 3564 acrotray .exe 3564 acrotray .exe 2344 acrotray .exe 2344 acrotray .exe 2344 acrotray .exe 2344 acrotray .exe 3908 70e49a354e53708d81202744ae8fc1c6_jaffacakes118.exe 3908 70e49a354e53708d81202744ae8fc1c6_jaffacakes118.exe 2208 acrotray.exe 2208 acrotray.exe 2344 acrotray .exe 2344 acrotray .exe 3908 70e49a354e53708d81202744ae8fc1c6_jaffacakes118.exe 3908 70e49a354e53708d81202744ae8fc1c6_jaffacakes118.exe 2208 acrotray.exe 2208 acrotray.exe 2344 acrotray .exe 2344 acrotray .exe 3908 70e49a354e53708d81202744ae8fc1c6_jaffacakes118.exe 3908 70e49a354e53708d81202744ae8fc1c6_jaffacakes118.exe 2208 acrotray.exe 2208 acrotray.exe 2344 acrotray .exe 2344 acrotray .exe 3908 70e49a354e53708d81202744ae8fc1c6_jaffacakes118.exe 3908 70e49a354e53708d81202744ae8fc1c6_jaffacakes118.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 552 70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe Token: SeDebugPrivilege 3908 70e49a354e53708d81202744ae8fc1c6_jaffacakes118.exe Token: SeDebugPrivilege 4368 acrotray.exe Token: SeDebugPrivilege 2208 acrotray.exe Token: SeDebugPrivilege 3564 acrotray .exe Token: SeDebugPrivilege 2344 acrotray .exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 996 iexplore.exe 996 iexplore.exe 996 iexplore.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 996 iexplore.exe 996 iexplore.exe 220 IEXPLORE.EXE 220 IEXPLORE.EXE 996 iexplore.exe 996 iexplore.exe 3260 IEXPLORE.EXE 3260 IEXPLORE.EXE 996 iexplore.exe 996 iexplore.exe 4500 IEXPLORE.EXE 4500 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 552 wrote to memory of 3908 552 70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe 85 PID 552 wrote to memory of 3908 552 70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe 85 PID 552 wrote to memory of 3908 552 70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe 85 PID 552 wrote to memory of 4368 552 70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe 100 PID 552 wrote to memory of 4368 552 70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe 100 PID 552 wrote to memory of 4368 552 70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe 100 PID 4368 wrote to memory of 2208 4368 acrotray.exe 103 PID 4368 wrote to memory of 2208 4368 acrotray.exe 103 PID 4368 wrote to memory of 2208 4368 acrotray.exe 103 PID 996 wrote to memory of 220 996 iexplore.exe 104 PID 996 wrote to memory of 220 996 iexplore.exe 104 PID 996 wrote to memory of 220 996 iexplore.exe 104 PID 4368 wrote to memory of 3564 4368 acrotray.exe 105 PID 4368 wrote to memory of 3564 4368 acrotray.exe 105 PID 4368 wrote to memory of 3564 4368 acrotray.exe 105 PID 3564 wrote to memory of 2344 3564 acrotray .exe 106 PID 3564 wrote to memory of 2344 3564 acrotray .exe 106 PID 3564 wrote to memory of 2344 3564 acrotray .exe 106 PID 996 wrote to memory of 3260 996 iexplore.exe 107 PID 996 wrote to memory of 3260 996 iexplore.exe 107 PID 996 wrote to memory of 3260 996 iexplore.exe 107 PID 996 wrote to memory of 4500 996 iexplore.exe 116 PID 996 wrote to memory of 4500 996 iexplore.exe 116 PID 996 wrote to memory of 4500 996 iexplore.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\70e49a354e53708d81202744ae8fc1c6_jaffacakes118.exe"C:\Users\Admin\AppData\Local\Temp\70e49a354e53708d81202744ae8fc1c6_jaffacakes118.exe" C:\Users\Admin\AppData\Local\Temp\70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3908
-
-
C:\program files (x86)\adobe\acrotray.exe"C:\program files (x86)\adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\program files (x86)\adobe\acrotray.exe"C:\program files (x86)\adobe\acrotray.exe" C:\program files (x86)\adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2208
-
-
C:\program files (x86)\adobe\acrotray .exe"C:\program files (x86)\adobe\acrotray .exe" C:\program files (x86)\adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\program files (x86)\adobe\acrotray .exe"C:\program files (x86)\adobe\acrotray .exe" C:\program files (x86)\adobe\acrotray .exe" C:\program files (x86)\adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\70e49a354e53708d81202744ae8fc1c6_JaffaCakes118.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2344
-
-
-
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
- System Location Discovery: System Language Discovery
PID:1624
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:996 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:220
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:996 CREDAT:17416 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3260
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:996 CREDAT:17424 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4500
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
85KB
MD5856a0ffe3bc6e72cb8ebf4a75a7fff85
SHA153f9710e57fd46c1d1f19f81562bd1d7f075c5e3
SHA256998817fa018d047f43ee1fef2d0f3e52ef562308eebe57a7937b017625f1f2e2
SHA512b31cfe14cfe9cfd15e57b7c0b9dc81d6e56d6f769bc45ac186527366cbbc2e060d6164a8bf94ea1b37e84657af0f2b050ffebc6a46a50bf26739b116dd2f2dbc
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms
Filesize3KB
MD5250197dffb2e4174b56f28782049e1c5
SHA1f548e2f1770e8387118bdfe182f43bdc1352cfd8
SHA2569cb7b67ef5236b6aee84f18a6f88b5034c09a1b4c80a2d6e1864521d99dda584
SHA5125d85ea64886505a24b9d3e4795684aa7a668e395fedee1850eb6bfceaeaf96909d678f5120f0526d0130c0be351d28fa885fcfdcfabcd7598dc792e572a0532c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms
Filesize3KB
MD5442ad8e8060eda539390c58c702567ab
SHA17bbee4a22a447c1d3936a298cf984b2469662cc6
SHA256de109bba5ca5f939979d9c2d7fac1a24f221442c23f9a86f32464aea46d0bdc2
SHA512aba7a23f0f23c3298f60295620f1d37fdc460cd422c4c26671425af328f1879c5585bf7b90e4f09c8ca102da29268140bf667f8eb07df67db9da290d92e46359
-
Filesize
95KB
MD584efc00e55ef719ce2bb6b2d3499da9e
SHA1a8513b46e688c654cba3d0bbd5b0b346796a5893
SHA2567e4229b94d141c721a0e1d8cc165ca276cb28e98fe49d6da3f56251491ecb0dc
SHA51280944e98350f5f5c8d80590d5be910ef9c02cb9ed5db5caf6af9f4f9ec11775470803001e3c89f572819566a4816f720f387087bebf23a5fdfc37fb7674518c4