73718442f7fb1a5c241aa2573194fdc51bf514aa1758dc35b550a3fa71cfd0b2

General

Target

81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
Size

162KB
MD5

81aa05ab45e06efb51d79d4f83e43b80
SHA1

949645fb5252cab46004dfa1f8a27c7b439f0c04
SHA256

73718442f7fb1a5c241aa2573194fdc51bf514aa1758dc35b550a3fa71cfd0b2
SHA512

0721f4691b2a6b0336e01f8f2ae0ddc8b2e245db56b4fb04d83bf16f4f3f8df561d1306d06ff8fa1a9bdf83839205b592d7026a5cac66ca9db77064e9cd7c5cf
SSDEEP

3072:REyXoN1VwNS1Jorf5qAHi6M0Lu/OIoZUlqhkZfsAS8dmFJ/geIOXBdFr8qq0Zv8:rXoN1SR3FLcNlu0Ef8ODIKB410C

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

Fqeceh.exeFqeceh.exeFqeceh.exe

pid process

3464 Fqeceh.exe
2804 Fqeceh.exe
4004 Fqeceh.exe
Loads dropped DLL 2 IoCs

Processes:

81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exeFqeceh.exe

pid process

1668 81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
3464 Fqeceh.exe

pid	process
3464	Fqeceh.exe
2804	Fqeceh.exe
4004	Fqeceh.exe

pid	process
1668	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
3464	Fqeceh.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fqeceh = "C:\\Users\\Admin\\AppData\\Roaming\\Fqeceh.exe"	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exeFqeceh.exeFqeceh.exe

description	pid	process	target process
PID 1668 set thread context of 1500	1668	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
PID 1500 set thread context of 1976	1500	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
PID 3464 set thread context of 2804	3464	Fqeceh.exe	Fqeceh.exe
PID 2804 set thread context of 4004	2804	Fqeceh.exe	Fqeceh.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Fqeceh.exeiexplore.exeIEXPLORE.EXE81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exeFqeceh.exeFqeceh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqeceh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqeceh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqeceh.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429304813"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2147301886"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2145114565"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31122503"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{AB7BD537-503A-11EF-BE43-F23FCB97D412} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31122503"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31122503"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-195445723-368091294-1661186673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2145270768"	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe

pid process

1976 81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
1976 81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Fqeceh.exeIEXPLORE.EXE

description pid process

Token: SeDebugPrivilege 4004 Fqeceh.exe
Token: SeDebugPrivilege 1972 IEXPLORE.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

1640 IEXPLORE.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXE

pid process

1640 IEXPLORE.EXE
1640 IEXPLORE.EXE
1972 IEXPLORE.EXE
1972 IEXPLORE.EXE
1972 IEXPLORE.EXE
1972 IEXPLORE.EXE

pid	process
1976	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
1976	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	4004	Fqeceh.exe
Token: SeDebugPrivilege	1972	IEXPLORE.EXE

pid	process
1640	IEXPLORE.EXE

pid	process
1640	IEXPLORE.EXE
1640	IEXPLORE.EXE
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 49 IoCs

Processes:

81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exeFqeceh.exeFqeceh.exeFqeceh.exeiexplore.exeIEXPLORE.EXE

description	pid	process	target process
PID 1668 wrote to memory of 1500	1668	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
PID 1668 wrote to memory of 1500	1668	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
PID 1668 wrote to memory of 1500	1668	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
PID 1668 wrote to memory of 1500	1668	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
PID 1668 wrote to memory of 1500	1668	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
PID 1668 wrote to memory of 1500	1668	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
PID 1668 wrote to memory of 1500	1668	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
PID 1668 wrote to memory of 1500	1668	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
PID 1668 wrote to memory of 1500	1668	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
PID 1500 wrote to memory of 1976	1500	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
PID 1500 wrote to memory of 1976	1500	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
PID 1500 wrote to memory of 1976	1500	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
PID 1500 wrote to memory of 1976	1500	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
PID 1500 wrote to memory of 1976	1500	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
PID 1500 wrote to memory of 1976	1500	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
PID 1500 wrote to memory of 1976	1500	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
PID 1500 wrote to memory of 1976	1500	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
PID 1500 wrote to memory of 1976	1500	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
PID 1976 wrote to memory of 3464	1976	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe	Fqeceh.exe
PID 1976 wrote to memory of 3464	1976	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe	Fqeceh.exe
PID 1976 wrote to memory of 3464	1976	81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe	Fqeceh.exe
PID 3464 wrote to memory of 2804	3464	Fqeceh.exe	Fqeceh.exe
PID 3464 wrote to memory of 2804	3464	Fqeceh.exe	Fqeceh.exe
PID 3464 wrote to memory of 2804	3464	Fqeceh.exe	Fqeceh.exe
PID 3464 wrote to memory of 2804	3464	Fqeceh.exe	Fqeceh.exe
PID 3464 wrote to memory of 2804	3464	Fqeceh.exe	Fqeceh.exe
PID 3464 wrote to memory of 2804	3464	Fqeceh.exe	Fqeceh.exe
PID 3464 wrote to memory of 2804	3464	Fqeceh.exe	Fqeceh.exe
PID 3464 wrote to memory of 2804	3464	Fqeceh.exe	Fqeceh.exe
PID 3464 wrote to memory of 2804	3464	Fqeceh.exe	Fqeceh.exe
PID 2804 wrote to memory of 4004	2804	Fqeceh.exe	Fqeceh.exe
PID 2804 wrote to memory of 4004	2804	Fqeceh.exe	Fqeceh.exe
PID 2804 wrote to memory of 4004	2804	Fqeceh.exe	Fqeceh.exe
PID 2804 wrote to memory of 4004	2804	Fqeceh.exe	Fqeceh.exe
PID 2804 wrote to memory of 4004	2804	Fqeceh.exe	Fqeceh.exe
PID 2804 wrote to memory of 4004	2804	Fqeceh.exe	Fqeceh.exe
PID 2804 wrote to memory of 4004	2804	Fqeceh.exe	Fqeceh.exe
PID 2804 wrote to memory of 4004	2804	Fqeceh.exe	Fqeceh.exe
PID 2804 wrote to memory of 4004	2804	Fqeceh.exe	Fqeceh.exe
PID 4004 wrote to memory of 372	4004	Fqeceh.exe	iexplore.exe
PID 4004 wrote to memory of 372	4004	Fqeceh.exe	iexplore.exe
PID 4004 wrote to memory of 372	4004	Fqeceh.exe	iexplore.exe
PID 372 wrote to memory of 1640	372	iexplore.exe	IEXPLORE.EXE
PID 372 wrote to memory of 1640	372	iexplore.exe	IEXPLORE.EXE
PID 1640 wrote to memory of 1972	1640	IEXPLORE.EXE	IEXPLORE.EXE
PID 1640 wrote to memory of 1972	1640	IEXPLORE.EXE	IEXPLORE.EXE
PID 1640 wrote to memory of 1972	1640	IEXPLORE.EXE	IEXPLORE.EXE
PID 4004 wrote to memory of 1972	4004	Fqeceh.exe	IEXPLORE.EXE
PID 4004 wrote to memory of 1972	4004	Fqeceh.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Users\Admin\AppData\Local\Temp\81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Users\Admin\AppData\Local\Temp\81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\81aa05ab45e06efb51d79d4f83e43b80_JaffaCakes118.exe"
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1976
  - - C:\Users\Admin\AppData\Roaming\Fqeceh.exe
      "C:\Users\Admin\AppData\Roaming\Fqeceh.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3464
    - - C:\Users\Admin\AppData\Roaming\Fqeceh.exe
        
        "C:\Users\Admin\AppData\Roaming\Fqeceh.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2804
      - C:\Users\Admin\AppData\Roaming\Fqeceh.exe
        
        "C:\Users\Admin\AppData\Roaming\Fqeceh.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4004
        
        C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:372
        
        C:\Program Files\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
        8⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1640
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:17410 /prefetch:2
        9⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JJOC9KUG\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ekg7afHe415gIxsl6af.tmp

Filesize
3KB

MD5
10a714b195635d9dea52883188903080

SHA1
488b06541880da79a4594bd1535cb2319dcdf262

SHA256
f49075fc33b842978a08a923dd2411f7dfbac0169e732b3fe44a2a1e07e22a00

SHA512
877945f6e2e43c3663ebd7abb534becd70af2b7ff84e3ea93cce14db90edaed1e7dd50b5f8f59c855285cb8add27aa791a8ea2299544599e2d8b922badb2a047

Download Submit
C:\Users\Admin\AppData\Roaming\Fqeceh.exe

Filesize
162KB

MD5
81aa05ab45e06efb51d79d4f83e43b80

SHA1
949645fb5252cab46004dfa1f8a27c7b439f0c04

SHA256
73718442f7fb1a5c241aa2573194fdc51bf514aa1758dc35b550a3fa71cfd0b2

SHA512
0721f4691b2a6b0336e01f8f2ae0ddc8b2e245db56b4fb04d83bf16f4f3f8df561d1306d06ff8fa1a9bdf83839205b592d7026a5cac66ca9db77064e9cd7c5cf

Download Submit
memory/1500-4-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1500-6-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1500-7-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1976-8-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1976-10-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1976-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1976-20-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4004-34-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4004-38-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads