Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
14/08/2024, 14:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe
-
Size
472KB
-
MD5
966f7044de3f67549aeb3e915abe2b7c
-
SHA1
c1b600d1363ffcb7c3f08d4291bc9c4769f4c6bf
-
SHA256
c063f197aa16954067129a99f3d28dea5577c404bdb4562190f3ef2912d6b6f5
-
SHA512
102a94d1ecdff0c626cef678b110e75350724c0412704ca8ba5a611a43f27d5ac9184498af03e4b957b81fdd321750627a31ec572776b88940e7b3b8fa4516d7
-
SSDEEP
6144:ppMMVVbsrDbFULI0PHBWN0tNcl4rTHM8syD0pMMVVbsrDbj:UtrmRPHBWN0bclSsy3trT
Score
8/10
Malware Config
Signatures
-
Contacts a large (1386) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ati display driver = "ÔN@" 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\SecEdit.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\verclsid.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\Bubbles.scr- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\icacls.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\PostMig.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\rasdial.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\DWWIN.EXE 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\esentutl.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\ocsetup.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\icsunattend.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\msinfo32.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\tcmsetup.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\Bubbles.scr 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\gpscript.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\grpconv.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\mspaint.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\chkntfs.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\DWWIN.EXE- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\regini.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\brmfcwia.inf_amd64_neutral_817b8835aed3d6b7\BrmfRsmg.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\fsutil.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\lodctr.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\rasautou.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\explorer.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\mstsc.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\newdev.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\RegisterIEPKEYs.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\taskmgr.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\LocationNotifications.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\MigSetup.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\msinfo32.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\regedt32.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\RmClient.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\chkntfs.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\Magnify.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\com- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\compact.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\dnscacheugc.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\regedt32.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\SyncHost.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\TpmInit.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\userinit.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\divacx64.inf_amd64_neutral_fa0f82f024789743\ditrace.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\dnscacheugc.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\lodctr.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\NETSTAT.EXE_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\wextract.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\wscript.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\dllhost.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP10\IMJPDCT.EXE- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\poqexec.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\poqexec.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\powercfg.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\SysWOW64\regedt32.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Hearts\Hearts.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Java\jre7\bin\servertool.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Windows Journal\PDIALOG.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Java\jre7\bin\javaw.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Chess\Chess.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Windows Mail\wab.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Mail\wab.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Java\jre7\bin\keytool.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Java\jre7\bin\javacpl.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\java.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\wordicon.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-security-spp_31bf3856ad364e35_6.1.7601.17514_none_78875ce737927d27\sppsvc.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-tapisetup_31bf3856ad364e35_6.1.7600.16385_none_d03cc6bce93bce83\TapiUnattend.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-eudcedit_31bf3856ad364e35_6.1.7601.17514_none_5b9fee911dc04044\eudcedit.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-security-secedit_31bf3856ad364e35_6.1.7600.16385_none_aebd843e13122315\SecEdit.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\iisreset.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_6.1.7600.16385_none_d96243212694b69e\esentutl.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_aspnet_compiler_b03f5f7f11d50a3a_6.1.7600.16385_none_a5a135380060b978\aspnet_compiler.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-ielowutil_31bf3856ad364e35_8.0.7600.16385_none_7d25450501edb94f\ielowutil.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-installer-executable_31bf3856ad364e35_6.1.7601.17514_none_a7a77a3b9cb96ce6\msiexec.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\msil_ieexec_b03f5f7f11d50a3a_6.1.7600.16385_none_53678ee8c3f93f6b\IEExec.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-chkdsk_31bf3856ad364e35_6.1.7600.16385_none_c1bcb003ee041301\chkdsk.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-deviceproperties_31bf3856ad364e35_6.1.7600.16385_none_ea20b9269b3c9a2c\DeviceProperties.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\fveupdate.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-mcglidhost_31bf3856ad364e35_6.1.7600.16385_none_05a2b72417ec1c6a\mcGlidHost.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_6.1.7601.17514_none_04846decebf43c4c\perfmon.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-convert_31bf3856ad364e35_6.1.7601.17514_none_9edcb4a706944d0a\convert.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_6.1.7601.17514_none_5ffc161221c1b4f6\rdpclip.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-gc-registeriepkeys_31bf3856ad364e35_8.0.7601.17514_none_44aa873ff9136c27\RegisterIEPKEYs.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7600.16385_none_ce6f64032560fa6b\user.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_6.1.7600.16385_none_3b3f55233d47d4f2\gpupdate.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\PresentationFontCac#\0246845f487e5f33d3564eff578665a3\PresentationFontCache.ni.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\Setup.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_infocard_b77a5c561934e089_6.1.7601.17514_none_583a8c60c0b305a1\infocard.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\msil_edmgen_b77a5c561934e089_6.1.7601.17514_none_cddf79f7120d371d\EdmGen.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..-deployment-package_31bf3856ad364e35_6.1.7600.16385_none_bac291589d407fde\TFTP.EXE- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-acluifilefoldercomtool_31bf3856ad364e35_6.1.7600.16385_none_58257acb668f62bc\cacls.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-driverquery_31bf3856ad364e35_6.1.7600.16385_none_f217bd1caebaa683\driverquery.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-irftp_31bf3856ad364e35_6.1.7600.16385_none_b2af329397f29f60\irftp.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_6.1.7600.16385_none_052696aea98bcefc\PING.EXE_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-r..s-regkeys-component_31bf3856ad364e35_6.1.7601.17514_none_58b4153116c17b41\RDVGHelper.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_6.1.7601.17514_none_b5ac5cc3a1b7e9ef\BitLockerWizardElev.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\MSBuild\b93c627ec2e15c2675bcc81edafb10be\MSBuild.ni.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..eoptionalcomponents_31bf3856ad364e35_11.2.9600.16428_none_87f259ebb3f177fa\ConfigureIEOptionalComponents.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winhlp32.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_6.1.7601.17514_none_e2a1ffe0ca40cff2\recdisc.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_6.1.7600.16385_none_9d299157e03ce00f\klist.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_90ecf919657dacf4\ROUTE.EXE_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_6.1.7600.16385_none_ca61f601a4548b8e\_isdel.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-rpc-ping_31bf3856ad364e35_6.1.7600.16385_none_9d906433a20c1949\RpcPing.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\ehome\mcupdate.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-ehshell_31bf3856ad364e35_6.1.7600.16385_none_95955bd51390781b\ehshell.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-f..opycompareutilities_31bf3856ad364e35_6.1.7600.16385_none_3575d2dc8edf4a22\diskcopy.com- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_subsystem-for-unix-based-applications_31bf3856ad364e35_6.1.7601.17514_none_d20e5d35068f261a\psxrun.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_8.0.7601.17514_none_4abf71c398c9a7d6\ExtExport.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\outicon.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\IMEPADSV.EXE_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-notepadwin_31bf3856ad364e35_6.1.7600.16385_none_9ebebe8614be1470\notepad.exe- 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_6.1.7601.17514_none_e1cb175aef3b13bb\UserAccountControlSettings.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..s-mdac-odbcconf-exe_31bf3856ad364e35_6.1.7600.16385_none_0d4d30a05370cb73\odbcconf.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-mountvol_31bf3856ad364e35_6.1.7600.16385_none_b22fcf90b2c6e173\mountvol.exe_ 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 504d48c354eeda01 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c920000000002000000000010660000000100002000000021ca1ec13da7a9ed88a4d7819bccac26d44817cb74b9aa07d31e2913eff8db14000000000e800000000200002000000077c8007ea086fcae2fbb46a20fc8d13b376f3af4d8ab297b6c8b1b88360dcfd4900000009ea60bd7155b74bdb2304d25cf6ad80cf0603ee097eb5cd968b59b336d238dd77cd5acf82b31808b3ca3cbdfa6ca12e8a4aedee1ebacab1a11eb6fcc67ed15b7b5d56dddfd6f5aaf7c407ecfb4fbf2764e32a6357bded15b528d878f6e5d282bc7cece4cbd00052b115dee76240ae7229d124a65edb12431421a03af1f56f542781d277df8169647b141e3a08edf888a40000000e7eb2db7577d9b3b75ac4f96ebe734db8f0387a203786b2fcb04b8c0339642a1bb6a70b04988a1de014a79c4befc366d89d1f333a2f8bf3a5fd21114399010ce IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000dbcd99e665b1f0127051f14dde03e388fed84db08c9adbe1e42f4e1ff80ab812000000000e8000000002000020000000efbdde78f26928a6dd8001e8dd7b1ef61c7107fdb154ca984da83e773c3ff11d20000000862df9e2d5f8c598a40a542022a219e0141e82e69099f57b55a0535e0545e0ef40000000e85d3cbab17b175a8995f20b8985d5ce38119ae78518f4ae9597410f9da163d33789ee34742d8154d181b3fb228caf497c4cc0482b8e5486b26560c9ff9c4b93 IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429806914" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ECC71A81-5A47-11EF-B88D-EAA2AC88CDB5} = "0" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" IEXPLORE.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2560 IEXPLORE.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2560 IEXPLORE.exe 2560 IEXPLORE.exe 1976 IEXPLORE.EXE 1976 IEXPLORE.EXE 1976 IEXPLORE.EXE 1976 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2256 wrote to memory of 2560 2256 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe 30 PID 2256 wrote to memory of 2560 2256 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe 30 PID 2256 wrote to memory of 2560 2256 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe 30 PID 2256 wrote to memory of 2560 2256 966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe 30 PID 2560 wrote to memory of 1976 2560 IEXPLORE.exe 31 PID 2560 wrote to memory of 1976 2560 IEXPLORE.exe 31 PID 2560 wrote to memory of 1976 2560 IEXPLORE.exe 31 PID 2560 wrote to memory of 1976 2560 IEXPLORE.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\966f7044de3f67549aeb3e915abe2b7c_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE" 212.33.237.86/images/1/report.php2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2560 CREDAT:275457 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1976
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
618KB
MD5b39e419f52b4b418717d05c026376428
SHA1ec5095cc2d9ae7ff95ffff94b22a7d781b1f7c79
SHA256bfbd2c0560f52d794ce3da791a8d97c755ac7b51325cdfd364b8236e6c478aba
SHA512039cbbd054f2b033bda87a06b022bad0e47717ad527fc7604e2d6a49bf9ff268fe21fcdf25edc2e899d83098bfea889049235285087107f1d1b1063e01111b8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564e7d5b9626810086869a1aedb633c06
SHA10c42cbdcc217d0a05cf607363acd81d849dd5eee
SHA256473cb337e05b054b7459a8fc3061ae46b1c718321d5dc2363660ff3d6efc5e13
SHA51217833dbf8f2f4a16d7eaa28283784dae6294fa1d195fd69d1dfec925e711de14ff1a954fafc535125004917f780ee1ec1826a0b44dcdfe16f73ca3b7cfced423
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3b935b3ba6f011fa7619e073eb49710
SHA1e32d9d36176f16ac818c0126e2ee9d8dbc38601c
SHA256f4921b36b28a724e88e2fb4d0df99af3090e1dfa9448684867ea93f4a1f57309
SHA51271d5da86cc61cc882211c4abfc2018bc417be30a19a83bbd232f5ebe8b89e852d88331bedce339606c08afbd7f5b9f4f98d10cd457787d866d78eaa2fba1f53f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff5c482aeea7de9598f81022c561b611
SHA116286266df376159a085b961a1022d3519c8e574
SHA2560f6a58c9cbb0bcdb06d88aeda746c97fd8a20dc755ca7df992bdce061c6adae6
SHA512c4ae5a2749ace8925246d141ec545e27e42d0a6f824540ae6f0443c2d8d948280fef9792881f9821e21473de1d798205e6b98ca21c46def013d4b2397d439d3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573097558f2ad944583e0965f001f4948
SHA1f585dddb0048488b1af1b42dbc5326ac616dfe34
SHA25688ec5a40f312b48abb614c4da8b7733de2926f9e85687f014adc784978645711
SHA51226e7f2ee8286f860bc9581ebd2746f81091921cb61d6bd190b1dc59c805bb426998ede2039f40aae073d1cb05bbcc868bd0470648c531f86d67384ac310508a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56afaa619bde57b039987de7ef8798c0e
SHA123d598c6160c55eff3e069efa056aa7e6d09f659
SHA256982d4a490ff3e348e7f12c95ce8bdb6db82c3700c2ec1ba964e83f7b5b2e740f
SHA51237c989a8b5627b6225a416060a0eb7d730dc6513218c656d9c6c3ad576825f956dd468aca4337f3c73e64f6dabefcae38e169c0865090f2a3b21a616179a8fcb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d92bb9dbd4a5f3afbc7b650d32c6c1b4
SHA13c8f050c08ec49d80fe87b0601fb7310a58866b2
SHA256e1dcfcf0834d57341a3800b3dc865b82c81dba9f34ab7b783b9e1e9a247d6436
SHA5126138ff4befaaa2f4060c1abf2393986de7ba77b7106a74fac8f9a6120b3f299309d1b9efa4fbaf4bfa8a1b500786b3fa16ac5e215b3f566fec5093f5b62944fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56463b3ce80fa541bd6e9747abec97641
SHA1f2e8fca554d4a84789162fc872d7d47174de8e5c
SHA256d1b2ee14d880c5460dac72241d2b3cbf85ceceb4fa328a8918e04b8d34495740
SHA5122dee8c45afc3600e524d98dada32a83eb1473a26a318c9736b89b52250bf7e1ad0e529da1df86dfc51639f6dc10125c7332ee7d974eb762bbde3e6d845d062bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578e4f7b7b5cb75297780ea7d1f8528e2
SHA1179ce7f8195e37a4922d4ef65b3a50e0b30a7e7f
SHA256e3e97c64b00a003aefa9ed8851b67e9d173ccfaf65d637c8bf826554db889cf2
SHA512f6e6df439d854f6f18a955a14f8362874a5ffe47b37169c6ffdb1bb9657b0c78ade35fe07a943fdec09e89ef40c253b3c260afdf6301f0bd59a6b5423cf25967
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589e228321a5625b6782f5d0a34d566d3
SHA1c7a875e75ec8f524302c7cf0550771a3d15cd83d
SHA256389dc7d97100bd5f002d49e8744c98fc0535ebcaa6ee4573f57cd1ce6b256419
SHA51210c74ad7f90aa539d5604a2cf8399d21962b0bc1c5cf20c41a64d30a6d245f0989c2eeac0216fccc1cb9a5f135ddc2e402d3933fdfa5b509cad2795f4a54439d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2687c09bfdb5c740015f897a744b87a
SHA1fb343eb0a9be12645808d1f2ca9949eedf64c3ec
SHA25685f54382a8d9c30b5590e45a6e3fdf2cdefe7db1ed1709b450fc2ac446191c85
SHA512c683e0c479906584ff358df9e66f330e918f5c08f0f3d9a5cb24762b3b48154252afa4d7065eb98fbe47f23c40af288a069f5c5eaf0d9e7b10deb6c751ddb02d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55477e16fa6b9568c419398df4d9112e7
SHA1bd576d32244f0717b4e02b09f2c301d32ff361ab
SHA256d13431579e8ada7ab3e61a07ba9e6c5e07ed73bb40fab9d94ee545d48335eec5
SHA51299f48ef088d89601ad6b6a2a3507c842532ed50ebea6d54983c30e64052d3457516922722ec57fae419ee4aba10da6f3b70f44e71585f4c4fc4f32f7ec3dab70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ef084afc84f11209a33bcc9f2c0a6af
SHA19f52b41be33bc689d297f4cf4775ed978f4fdd26
SHA256a515a170bd640b0a7af1285fc53f99e200f348848471ab89f351ee174b15e954
SHA51208a9facca4eed93b34a3db16bf9bad6cef425619044035b74a24907283e7235465cc6206ace9c22474ed8ce8e3facad72dec919341ae5ad74617bb4743045106
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57053c50f72257f309a02d8cf961d6a1f
SHA1a8b7146ee577bc9fb7ab9d7180215ab96dd8b8e0
SHA2560a915f9eb79ee6771dd062015c63281ef28439da6136425555a90888659ca90d
SHA5123a5b67f94395bdae01ce37ecc7bf64cb5e6b6e452873b7ae9ee847633a1e8e0c3341a3df8c9d3528772cd0ed5088ae6576600d42f979c6ef0cea628601e6bac0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ec4fd0b6aae74cdc199d5fa4dcb685b
SHA1bb7997109e935965aa91a88093ca1c486349e3a6
SHA256c98f9a6218f376692c76678f124a0bc1b6f02cf6bf87e0a7db03833143f30cb7
SHA512689190561ea5633d2080a2968776e08e040e71ececdd4f67fe1213c66bc47bcd65df154bb9c16ac65aac1a6bf9149c8a4cc23177e53ea8819f9edff28ed86dfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2411b31e5c6c2b7bf5336ada3ea717f
SHA17a2200a696dd3758d8ea397d6a80abe713409eb5
SHA2564460183be05fc3d5b15d97adf93b6c18df374db791dc6ffb13624c6ee5cd76c8
SHA512fa7c0fde8b7c1e6f47547e7d1c43373972a4ea5d90d3152dcb25b12781d75ba992795cd31cae4f7eb0308ffdd2db92b76e0e152f67fd341226fd6a7ee2899759
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e72ce2f7a29ff33c540d922dd06c4337
SHA12f1b86c659f6b586d0da0d046820d3ca211cbb90
SHA2561106cc76f9b4baf354c0cebcf8e25c367d5416f609faf2c5e6a1a2a0644f4b0a
SHA5121af4a9c1d347a19a3a3d8b81e15c93a76aebc471481502f34d43b617dad531d622e2206fb0efcc633f4546902f207c26eb4ca891424327379b2b60b38f313520
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524602d11a669fa8077a9d5aea698a12d
SHA17bad3b3e6c5587213aeea08b773b02005277d28c
SHA256b3af74a8bee93214650a6ba1181b25507c1480d8d87fe170425de3dc4c4b8e70
SHA5127298dae6dd9657a831348a60d439304925b95cba61773645ca0143485f2773fde652f3f055c6e2b8ed7b6eacd170d137e3cd07c7d3e6ac1d34c97c25a981fe9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f33a428c2946104a5030ce576a80b161
SHA1f62675679e62b839872879b575888e1b773a5903
SHA256bf75b81d68e89c8c2076f4524c6ed03dc224cc3e3f9d24f1dd352f64d542cc26
SHA512011cd84d928a67ba7abb27a8eb8b5a6720b9f35bca1b0cf296b889899fcfd7e6e3a90b531b6e0195c78113e203a12355abb19c833700664cb434ae940c35b31d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cbfa5e555d89f71cbb29e8a7f1bcb514
SHA17f71343cbf1d8efae5469ed912003f9c019b1747
SHA256a4a99fd495acfba032dbe2fba3c687a9cb7df25c96198c798ded9bf94e034fe1
SHA512e62ae898dacb7072132a729a21438aabc2bd74972895e7785ea46e2f1c507df1f0122cac4285756749d706a67b058d90d7965a11214db5c3026b11a01ea460ec
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b