d03d0e0d5ba6fe251bd6561e023aa8999abaaf3ada6ace8be6ab9b532ca29e86

Analysis

max time kernel
133s
max time network
130s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17-08-2024 08:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1d768f3068d783c375380ec85cea715_JaffaCakes118.exe
Size

250KB
MD5

a1d768f3068d783c375380ec85cea715
SHA1

728f40d004e3013dee504459a4545365f30966dc
SHA256

d03d0e0d5ba6fe251bd6561e023aa8999abaaf3ada6ace8be6ab9b532ca29e86
SHA512

6fda133d1a1f49acceb7b06778eb33292f99b8b82ce474f1678032f35ab288a5d74df64bdfbe8d700bfc3f82dc914cf2dbfd472c09ce872b4e120057203ca4d0
SSDEEP

6144:2hieuJDr5T8b2ufqBLjSB/MS7irtIa6cwoD8ZroSfjGFA:zeKrJJuf86AYcwoaoSbr

Score

8^/10

discovery execution persistence upx

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Deletes itself 1 IoCs

pid	Process
668	cmd.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2196-0-0x0000000000400000-0x00000000004B1000-memory.dmp	upx
behavioral1/memory/2196-36-0x0000000000400000-0x00000000004B1000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2196-36-0x0000000000400000-0x00000000004B1000-memory.dmp	autoit_exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\WinRAR\winrar.jse	a1d768f3068d783c375380ec85cea715_JaffaCakes118.exe
File opened for modification	C:\Program Files\WinRAR\winrar.jse	a1d768f3068d783c375380ec85cea715_JaffaCakes118.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1d768f3068d783c375380ec85cea715_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2144	PING.EXE
668	cmd.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0783b777ff0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430045184"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000cc54e903bb1630e9c5bb8c2f31ec24218037ad209a4ff34d4d257ac0480a92ae000000000e8000000002000020000000c1699a03ffe333716cb90d1d95fa9855c3950ecbc54ba50fc80d004649fd12d0900000007769708314429e760a30e3116592ae003ccbbb0060775c4659d021b4d1675dac82d28428310a71bb2ea421c284c53a90e03bb92acd081c39a7d8e750af7d5a100332970ee41aef6dfc72d241c55e86f9c3ec70cec38737894ffe9d8558fd6153cefecd47aca8c17ff9d60fe888fa4fdb40343f8d5f20a17ed6f0461f3e299901355bd8cb7dcad0d695e69111a6bfa33540000000ba158df0056444a304b08a56d0c6c9d6d1428b0582a1fa95daa2866942768a266e48dbdd5faf6398c0b60281110dc9b3cea342a8aea3f66a0e9cd6df99e3569f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B2D07DD1-5C72-11EF-ACB8-4605CC5911A3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000e37aabfa6f4598963d0ef828fa3c44f02ed2e268491eac87b15d8b2414075c6a000000000e80000000020000200000002e41614816b9c170f85364684fba9d896a09ad49e9eaa42213fe94637d48cc92200000008f414525e00f2eb7ff428ce22793ec2d9495ed8bad9ec170f6a4b063c978e172400000005f58e5b87ae04bedef4e414a7e67bd9e2bb9ccc926083005fbcc953060bcb0a1b30b54ec5129920fd7085eb56ccfc5a14a2cb8f8c8700e0a660a0f064bbcc262	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mmc\ = "mmcfile"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\DefaultIcon\ = "%SystemRoot%\\SysWow64\\url.dll,0"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shell\open\command	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shell\open\command\ = "WScript.exe \"C:\\Program Files (x86)\\Winrar\\winrar.jse\" \"%1\""	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shell\open	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shell\open\CLSID = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mmc	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\IsShortcut	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\ = "¿ì½Ý·½Ê½"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shellex\ContextMenuHandlers\	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\NeverShowExt	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\CLSID\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shell	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shell\ = "open"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shellex\IconHandler	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shellex\IconHandler\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"	WScript.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\DefaultIcon	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\CLSID	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shellex\ContextMenuHandlers	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shellex	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2144	PING.EXE

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1196	explorer.exe
Token: SeShutdownPrivilege	1196	explorer.exe
Token: SeShutdownPrivilege	1196	explorer.exe
Token: SeShutdownPrivilege	1196	explorer.exe
Token: SeShutdownPrivilege	1196	explorer.exe
Token: SeShutdownPrivilege	1196	explorer.exe
Token: SeShutdownPrivilege	1196	explorer.exe
Token: SeShutdownPrivilege	1196	explorer.exe
Token: SeShutdownPrivilege	1196	explorer.exe
Token: SeShutdownPrivilege	1196	explorer.exe
Token: SeShutdownPrivilege	1196	explorer.exe
Token: SeShutdownPrivilege	1196	explorer.exe
Token: SeShutdownPrivilege	1196	explorer.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
2196	a1d768f3068d783c375380ec85cea715_JaffaCakes118.exe
2196	a1d768f3068d783c375380ec85cea715_JaffaCakes118.exe
2196	a1d768f3068d783c375380ec85cea715_JaffaCakes118.exe
2196	a1d768f3068d783c375380ec85cea715_JaffaCakes118.exe
2624	iexplore.exe
2624	iexplore.exe
2624	iexplore.exe
2624	iexplore.exe
2624	iexplore.exe
2624	iexplore.exe
2624	iexplore.exe
2624	iexplore.exe
2624	iexplore.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
2624	iexplore.exe
1196	explorer.exe

Suspicious use of SendNotifyMessage 21 IoCs

pid	Process
2196	a1d768f3068d783c375380ec85cea715_JaffaCakes118.exe
2196	a1d768f3068d783c375380ec85cea715_JaffaCakes118.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2624	iexplore.exe
2624	iexplore.exe
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2832	2196	a1d768f3068d783c375380ec85cea715_JaffaCakes118.exe	30
PID 2196 wrote to memory of 2832	2196	a1d768f3068d783c375380ec85cea715_JaffaCakes118.exe	30
PID 2196 wrote to memory of 2832	2196	a1d768f3068d783c375380ec85cea715_JaffaCakes118.exe	30
PID 2196 wrote to memory of 2832	2196	a1d768f3068d783c375380ec85cea715_JaffaCakes118.exe	30
PID 2832 wrote to memory of 2624	2832	WScript.exe	33
PID 2832 wrote to memory of 2624	2832	WScript.exe	33
PID 2832 wrote to memory of 2624	2832	WScript.exe	33
PID 2832 wrote to memory of 2624	2832	WScript.exe	33
PID 2196 wrote to memory of 668	2196	a1d768f3068d783c375380ec85cea715_JaffaCakes118.exe	34
PID 2196 wrote to memory of 668	2196	a1d768f3068d783c375380ec85cea715_JaffaCakes118.exe	34
PID 2196 wrote to memory of 668	2196	a1d768f3068d783c375380ec85cea715_JaffaCakes118.exe	34
PID 2196 wrote to memory of 668	2196	a1d768f3068d783c375380ec85cea715_JaffaCakes118.exe	34
PID 668 wrote to memory of 2144	668	cmd.exe	36
PID 668 wrote to memory of 2144	668	cmd.exe	36
PID 668 wrote to memory of 2144	668	cmd.exe	36
PID 668 wrote to memory of 2144	668	cmd.exe	36
PID 2624 wrote to memory of 2540	2624	iexplore.exe	37
PID 2624 wrote to memory of 2540	2624	iexplore.exe	37
PID 2624 wrote to memory of 2540	2624	iexplore.exe	37
PID 2624 wrote to memory of 2540	2624	iexplore.exe	37

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a1d768f3068d783c375380ec85cea715_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a1d768f3068d783c375380ec85cea715_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files\WinRAR\winrar.jse"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://www.go2000.com/?g8
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2624 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 4 127.1>nul &del /q "C:\Users\Admin\AppData\Local\Temp\a1d768f3068d783c375380ec85cea715_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:668
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 4 127.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2144

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\WinRAR\winrar.jse

Filesize
11KB

MD5
9208c38b58c7c7114f3149591580b980

SHA1
8154bdee622a386894636b7db046744724c3fc2b

SHA256
cb1b908e509020904b05dc6e4ec17d877d394eb60f6ec0d993ceba5839913a0c

SHA512
a421c6afa6d25185ec52a8218bddf84537407fd2f6cabe38c1be814d97920cfff693a48b4f48eb30c98437cbbb8ad30ccd28c3b4b7c24379ef36ac361ddfdbf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7b9788c7b153f0c0cd361dd4bd2a0807

SHA1
111d5c8dc4063d891fb898e3364eb88c204ff493

SHA256
bc0c0dcd2c910cfbf4cea1b66ff67a6f59b76251ac53286d2286d4ca07ce211c

SHA512
902f835493502ad46b8edeb8b2628c2a6d06492abc70b49da9da3ae9b64748abaa802be09f25383239e951e7f8b36d8201ba0ae613e8ce5e5fafc0b13b43c201

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3ba5c167777abca8d7d2e7f191592083

SHA1
29180fe8f28de165927e6e7c7dc10a6269325e4d

SHA256
2f5e9ad4f5ac3f3985542a3cc2f823ec69bf9008d411e90a02d1ead5fa07e0a9

SHA512
021a1cd1af930b88d82d95f8dae9fa0f73bc59b92635eb1b52cce3c7934044968bf46010b7d48df9cb7d770118105d2c420a370da737910db54e2d1caa212574

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5eea77d7ba9fabd71cea12a999557c7b

SHA1
2337443f5a36662ef775fda69ed4175d7af3277a

SHA256
44829753f4b03d675dbf5540d2893e072daf9f8f719dce242f37534b88a68704

SHA512
97c90758a5ae400216305fd83616e950657bab8ee82d3a3e2c6c23f4b1dc1d2a4867e76992bfcf551f33fc42f84543a32b0f37e25cfc63bb832f0aad37224eca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
dab66324dd5e4ef0b61c7d24b4cc35a0

SHA1
59590fbe743a1b9a90b5f1a558318e573871754b

SHA256
a5a9c4f97d02c978103619ee4f9a44da76c82bc48ae8c3b649257e7a48ddd705

SHA512
02a942896d18924db92d0df44dcd2ba1b24a81c4ea585b6dc346ec8a52e2f4e9d82109a69519074fda85928df3359a2d29075d7f0bf0cc954019a08a6457f88c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
68e06e0f22a073e3db599e55995ec8c8

SHA1
61e82ad93283cb213640b1a4fe4efa787bef750e

SHA256
6935c46afdfed859431c718af6c7932b0a422c94757f137151e69cd75db19da8

SHA512
011d6eed9f605e7af91494ae32815af3f3ac95e1d9a04a0b106b53490cc1652a85c956dda54fdd0333357868468bb2c436cc5a307627de471e1c1fb23c7c7784

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2f81c865f762bfcfe24c3705d9ad983d

SHA1
8284af6fd6e89745be6bfe80ea1b6c9c66bb9032

SHA256
88f9f6ac426e12149889f52f7dcd490810237015cd6113bb65edb259d2ae20aa

SHA512
4dc557c3b85a494b4c5708a8021194e2f785a653fc59a709aac243bb595bbdbeef1ec83b93da6b1b19f330f345220fc41013035d8e6b4eb3d63a945b4eb51179

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
62e41059c05327cc1afd425c33f2b60b

SHA1
9cbdca997cee04e8b0cde31a0613f0202595c241

SHA256
28e4b6202b2d528a0c1277ec155c7cc0e9dbed8d122cb607f86472a8b4d8685e

SHA512
88e968a4df52c23cb97496bb0d6ba81dfa57e8ff0fd98bce0cc5b26dac5459296088ae720d4a754c2b77412839044c48397e62858106d0e4353e4ecd43fc0b86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0faf3d5dd6292fef048cfe06896ee81f

SHA1
1523e8407905a810489b8ba4d14128f1aa5528d1

SHA256
401085b40a0363aa7bf61bdd24ce5fd4cd25ebd9b3e2639a64fed7b707e271f2

SHA512
a732dd391ab8f3d887aac8eefaec425f0101d6821ed55b0f485c36da6f7520451beb87905dc537907eb268b3bf01c286b3356baa2e5c98e27e1025735db9fa3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
057355c96c9416a858d88fa030667809

SHA1
58d74ba8ce36302b2da69531dce2e6a08d92517e

SHA256
3f7398b802ea60bb82d2456a51d44a93199b45b77eea8176044d5b842c6d4ff2

SHA512
a0987e47cd6e27997e7a96ffed474525208ca7ce5e32a42236ad281edf5f64bef1248ad941b2f883ce91379391bdae6bd0f7b4842ffee0298a3716a70b11bd97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3c4cfe1e71bca2809fe20468433747b9

SHA1
5de61d0b5af56d525375782130b4382781376305

SHA256
cbdae39ccf3bde5168ea493ce39d1a015a3e0211718aaf54c7d19b2b5b8c99f0

SHA512
185f7f47cb3ae68273dbcda1f7511b15f01a73b77e6aa6ed076908fa2461d784a1077d4b2d8d9f000ced2e581f3fe54140d0d17f162ec1111d6ec5ebc5489b41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ca320d6d5da613a0496932f060fb0dcd

SHA1
30e9a3f9381f7f8eb094698b20dfed9a7c519e91

SHA256
28055748ce2de2e022012d6ed72619657c51773736ea9c4fe0f5a3eafd5e2a91

SHA512
c7850899cc3444347160dd1cfa1026629717f4f21d59c879b29ff477ad5cb0a24163e0735d8f7f88aea4ee894fadbcda8f4dbf40b48585de31d480f226fd133a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1a5f653e185fc19dfbfbab15ef1b4df2

SHA1
986db3b862bd896bb956b6c511dd47bae4c629f9

SHA256
9578dfe335efdeab030fa552c3f7c80d3e546939d2d2450cb34f3e7bbbc492f2

SHA512
17a335d0db72e34d7a1ecae415d0288e57c3f00b9dc1b0e84826ae37e04fcf540951b02153bd55b773731b35f56fb39ab77879c173351e2141d4f43e382db4ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e83d7382622770e032ec01c96b221cf4

SHA1
f5a67143d64f832ddb77336bab4876104513cf47

SHA256
c667af74162062b0b2cf8001263ddbd60533d63226f842c098a6d3ded8c95c3f

SHA512
66fd13c0d93cddfad2c81a1aa648687541b3db452afba29f0f46b899c73c630685091cde8e9e15d342ffc4977cf9239eedad9fa864a7530ae909e000e2865c37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9dd7be1baa44ef36c56d8c5dd6117e7d

SHA1
c2a3a4f13819e398049ebca8345e4ad9e2fa6a48

SHA256
5bf2d7d8ab4e45dd41d12ffd42a1f66a03843d5eb20c0f48338d6ea8621ffa10

SHA512
9ddfc351e194c436d5f1fb91cec7211bde1f7bfed25c49843f5acdb52900a25f0ca1d799dbea423e9f42cc6128b6a4918d149e2bbe9285720d8a381734c38aef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e0da8491fb5bf0d715adfb5256448a49

SHA1
09396a0c6d9a258c3ee9d6c1753595b5ae149656

SHA256
5c94da330b498150dfe49df1e2a3b195937e2c5e07b89f70aec9030cfa9b300d

SHA512
527b189193a517db815d8e6773529ab246b30a9121b0dd1e0be5ba69872e3ec6f853fc69223c2c057657dff7cadc630a92fae6a3d7efceeb92458c2ed189c0eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b8616d37a89077447493b6523d5a1cb7

SHA1
aefbe2e510fffb665ab5db456cb4ae9525e780b5

SHA256
0c08aff223bc7466b278d2698c5676fb06a84189dd78db20f9551cb973c8ce02

SHA512
489cb1f9758da25ef08f929a857878167ad7fcf0d487b4986407f02cbce956c3afa49e3a26d88d9613c2b4ea366b424f83221b240d9f7663b3c33714869d7195

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
20d77ab9e210bf599817f2f40706dfe7

SHA1
bb9a6eae76bb6960b25fc9aba11ff383f52b422c

SHA256
24927e15a5d1763ff547396a7a10e930011185ea5b70a747b423a22609c9f79d

SHA512
ca22526f5d424f96779571ff6cdb7db6e89412975046cbc79366008b32b32c2ddde291943e3f7606f41fb80dbef5108416e65d5c67d910b136b60e39490f9ea0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4546398d32742e6626a07f9f27ad32b0

SHA1
336d8d73dfa1e139ac85153abd183523e2e93f4c

SHA256
5e0e7b46770d3a5dcb4ce713b2a380371bc53e06ac6c1711d58c69425840288f

SHA512
418f59872c89177abb5c20b59558cb955a2acceedee72310219382aa5db37519ac6a546781c086dbaa9bfac6379a4c7f7301b2b20bc27d529e032d779a2b4f3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f7c2dc2ebca0bea4ab8fb7f245ed2574

SHA1
8373b3157c3606df61fbc68f33bdcabe03bece34

SHA256
189c5c1e3c0eac0bfad538b8a97b3b834a0afe4e013c46c62af9f958685b9612

SHA512
ffaf1f22b8a83c36f0f797999412e3ae8efe1f1bcf127fc371ba59e2474c4f1e04e9fef2b611304ccf5dacfe79090593bddee46f15333a201536ac1032747e9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6f06698c57d566bf79ffe4f247e92b36

SHA1
be91b7a2eeca47af03856201c4c7c864761adab1

SHA256
7838d511a5551f0315adb948b9e6d3d4d08f02e2096647f662bcdfe60d0ab5eb

SHA512
78bd08cc7ae652c4d04ceadb98f3fd9b68b25c3be9978b2a84b032e67ed99027d9071caa2d7f373c1fb39bbbef7e6dd11764d11cc16fe23209d6bef7423a13e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8DEF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8E02.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.mmc

Filesize
149B

MD5
b0ad7e59754e8d953129437b08846b5f

SHA1
9ed0ae9bc497b3aa65aed2130d068c4c1c70d87a

SHA256
cf80455e97e3fede569ea275fa701c0f185eeba64f695286647afe56d29e2c37

SHA512
53e6ce64ad4e9f5696de92a32f65d06dbd459fd12256481706d7e6d677a14c15238e5351f97d2eb7bfb129a0d39f2603c4d14305a86821ed56e9face0bc252b6

Download Submit
memory/1196-1286-0x0000000003DD0000-0x0000000003DE0000-memory.dmp

Filesize
64KB

Download
memory/2196-0-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2196-36-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads