Analysis
-
max time kernel
145s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06-09-2024 06:28
Behavioral task
behavioral1
Sample
cee291306818412f879ab3df22ad1126_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
cee291306818412f879ab3df22ad1126_JaffaCakes118.exe
-
Size
908KB
-
MD5
cee291306818412f879ab3df22ad1126
-
SHA1
33f53bc68ece6e129dee0f7f1eb1db43070ff2d0
-
SHA256
60e56ff40a3f53385faed68011dba9e70e63899a91e821527fed3ba8c79d3e4c
-
SHA512
a6428e9a8838ce4e5958a64c531dd29b47adc575eb4f3415eeed261f7da43c6f60badd1d5c1bafd6c4fe2add11a30a13cc03d2d8575db5e85b19ca49bfff9596
-
SSDEEP
1536:tV7RSS9YSCSISCShSCSxAGzsCTXYtFBo45GQG770gSvc1RIVLmyLmRgRLuLkutb+:JuAGBTYzGHsNv6xgRK4VljQaeA
Malware Config
Extracted
gozi
-
build
300854
Extracted
gozi
202004141
https://devicelease.xyz
-
build
300854
-
dga_base_url
constitution.org/usdeclar.txt
-
dga_crc
0x4eb7d2ca
-
dga_season
10
-
dga_tlds
com
ru
org
-
exe_type
loader
-
server_id
12
-
url_path
index.htm
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEcee291306818412f879ab3df22ad1126_JaffaCakes118.exeIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cee291306818412f879ab3df22ad1126_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
Processes:
iexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4DB08921-6C19-11EF-8778-C60424AAF5E1} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f5420000000002000000000010660000000100002000000097d779d2d22b843c62bc68a3a1b42890b45940230d8a4fc2de4e7f4a3afb0b7c000000000e80000000020000200000004dc089e130dc0fdeccf838e42209aba636c287b793c8c05e433e650636e1bbb090000000597c3e97901467cc3c654acfd63d5c9d28ca324126a2a76435adf4a8edffce703932ce7db164742efbd6cb6f51c306c72a19a724d5dcfd90ddebc39def9d06b7b825f87e0bf632367e16db4cb68b71dc08637fc695690d41e1985d5e2e40bdbde1f70b1b1dc1ef182bfe1db85c6105e4c2eeedf7b890eb4b73665b7885e5d92742ffef93ced6282b99b13fe01407f48c40000000973eb6b5ab8cf32aaace94bf276d9bbd76d60a70deb78bcb85e637cb85bbb566fd77f2240f6e539f3b76371a896d1876d7c6e30db56714e25cb9b5f602b8bc03 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9AEBE5E1-6C19-11EF-8778-C60424AAF5E1} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f5420000000002000000000010660000000100002000000014dfaae93d7cc0f94077b0d06f5c73fff88517691389d7d138e4530ccb897670000000000e80000000020000200000004ed34c1e2b2be44278abff48232d6a0dc82b0dcd0985f077654f449c29f215a020000000d667790b2bf89d5c2b4febccc63726f36e83cb2f2270c91b64be0f1f52317538400000009f7b5ced4008e8eb1afb418ae07236d01912bf66451c97ba9a3165d6fd0d88dd22a2abecd4bc8e242d202a4a473d0159321630cc7151e9fc7bc1ce79b3805deb iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{799FCA01-6C19-11EF-8778-C60424AAF5E1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exepid process 2872 iexplore.exe 2872 iexplore.exe 2276 iexplore.exe 1824 iexplore.exe 1828 iexplore.exe 2508 iexplore.exe -
Suspicious use of SetWindowsHookEx 24 IoCs
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEpid process 2872 iexplore.exe 2872 iexplore.exe 2884 IEXPLORE.EXE 2884 IEXPLORE.EXE 2872 iexplore.exe 2872 iexplore.exe 556 IEXPLORE.EXE 556 IEXPLORE.EXE 2276 iexplore.exe 2276 iexplore.exe 1072 IEXPLORE.EXE 1072 IEXPLORE.EXE 1824 iexplore.exe 1824 iexplore.exe 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE 1828 iexplore.exe 1828 iexplore.exe 2968 IEXPLORE.EXE 2968 IEXPLORE.EXE 2508 iexplore.exe 2508 iexplore.exe 2084 IEXPLORE.EXE 2084 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exedescription pid process target process PID 2872 wrote to memory of 2884 2872 iexplore.exe IEXPLORE.EXE PID 2872 wrote to memory of 2884 2872 iexplore.exe IEXPLORE.EXE PID 2872 wrote to memory of 2884 2872 iexplore.exe IEXPLORE.EXE PID 2872 wrote to memory of 2884 2872 iexplore.exe IEXPLORE.EXE PID 2872 wrote to memory of 556 2872 iexplore.exe IEXPLORE.EXE PID 2872 wrote to memory of 556 2872 iexplore.exe IEXPLORE.EXE PID 2872 wrote to memory of 556 2872 iexplore.exe IEXPLORE.EXE PID 2872 wrote to memory of 556 2872 iexplore.exe IEXPLORE.EXE PID 2276 wrote to memory of 1072 2276 iexplore.exe IEXPLORE.EXE PID 2276 wrote to memory of 1072 2276 iexplore.exe IEXPLORE.EXE PID 2276 wrote to memory of 1072 2276 iexplore.exe IEXPLORE.EXE PID 2276 wrote to memory of 1072 2276 iexplore.exe IEXPLORE.EXE PID 1824 wrote to memory of 2248 1824 iexplore.exe IEXPLORE.EXE PID 1824 wrote to memory of 2248 1824 iexplore.exe IEXPLORE.EXE PID 1824 wrote to memory of 2248 1824 iexplore.exe IEXPLORE.EXE PID 1824 wrote to memory of 2248 1824 iexplore.exe IEXPLORE.EXE PID 1828 wrote to memory of 2968 1828 iexplore.exe IEXPLORE.EXE PID 1828 wrote to memory of 2968 1828 iexplore.exe IEXPLORE.EXE PID 1828 wrote to memory of 2968 1828 iexplore.exe IEXPLORE.EXE PID 1828 wrote to memory of 2968 1828 iexplore.exe IEXPLORE.EXE PID 2508 wrote to memory of 2084 2508 iexplore.exe IEXPLORE.EXE PID 2508 wrote to memory of 2084 2508 iexplore.exe IEXPLORE.EXE PID 2508 wrote to memory of 2084 2508 iexplore.exe IEXPLORE.EXE PID 2508 wrote to memory of 2084 2508 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\cee291306818412f879ab3df22ad1126_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cee291306818412f879ab3df22ad1126_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1448
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2884 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:406541 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:556
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1072
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1824 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2248
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1828 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2968
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2508 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2084
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55bfc8d8cbcd864e9ebf3d5091311b9ac
SHA197190b10e5ecc21ebda843f87b08a90138a8b02e
SHA2562b2b4425d640bfadb07404ed928a9bb69123f4f9d1289d3b833477bcad74bc63
SHA512818bbe1bb056652731c5a17d98cf3045467c28670479d19de0631426321310daa89b8437f6c30fdcb1dce440a720b9e3b6896f3ccce5c44c2bf0f62a61089788
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55bb04ca1fec659af2aa9aae329ef8544
SHA1167f8c01ee3ee11eefe94c19e94d3d9dcd8a05a5
SHA256c3ab78174a3791145de4c9012205b9f74a93881a96b64d6d3e53c398bd53a3c2
SHA5127d9f46f2d773df37e0bd1c76c3a1e330138cb141921d40e64e289e7434886cb2e72a2eddb3fb65978f2eebf2a2b0f402ab5b3cd1261a54745f87deef2d8505cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ca54b893f47451bcb81c8a3d44f9948
SHA14023d5ecca9ff97920846cdca81bccb83f71edc0
SHA256ddae80c002ca4261a5be9d42217de410f73a8624142649c5ec548bb992f70f2f
SHA512a55da6a59d96776196d26ec959a8c69dc54ce69ad365bfde0a173b008710108a2f1f928c6564e6dd8b1f09e47aa752c78d74ae004c0c57baf76ca537acf0534a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506d7c87a19e871581a91c2c17af86421
SHA1d36379069b34903479445898f99cfb9d73fb81c4
SHA25619f424345ad96b2b1c0514fd7bd8d5b7c500bbfc825e015bcbef154f116fa1ed
SHA512678087bc573cbb13c9a871ff2f0695708409360cfe7a366e87baa2a06065eb6b600fce74a2a31152a671a81131aad426dddd9f5f78a5489a205a992dcaf674d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55ad3251e1639cef3065cbd24b03c08bc
SHA1e3a30f4f793dcdde7bfadfead500804fac358c92
SHA256599286813f3b4a5552a7724feb9eab7bba038f70b638d6d7c8e119dc3c57f5ca
SHA512f268cf88265e30b66f53e2ed6fc33faf91f112ba30217ee150feb28cf68c6447c4ed41a1cc885642c34b0b6105046427b645011fe4010211400b44058a7175ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a576e5cc0fc89746188bce6250d9116
SHA1e130169b00abb9630205eff9de32f16c57653d12
SHA25670608b2f12d1d46767106442b9a278f964610acf38ae99b85b1f7077aed6d3a5
SHA51259057d6284c77641db904de445abd1662730cc1355d0a9cebb8ad73bb15d36f8d6c6c9af7d4604bedb56a812bd2e69e670a93a33fb5d1c51882f6b19a711c648
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD590c60122d0b6c91b46ba346ce3926e2a
SHA1c614067bca54d4cc0a85aab90af46e8ce06023b4
SHA25693157d9ab3539fdc7bccb550b1093c6364286ebf2581fc62c3bcd8b2dd2d5067
SHA5124d8db34a93dc0328589dc3872d4b0fc20286c99f52c686dbf912ee2bebf5a519b481dcf66edd1e1ab9b5687ccdb4789e9e2a3cc0aa3a1305d3f0d6bd557a7259
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55762a624b551798c5405d9af8b0ae646
SHA17d84b7a00e5e1a66ca8c3984b3230ee271e3aa9d
SHA25622328ed08511c99200054fa60af897dfac07dc433f7b4c999cb10f52185db547
SHA512af38c3c904684c2b4118fda9539241ad007bc1e89f809e17b9a3bdf6413f59f8b4c235e4dd0c0d92d53b93291bcd3446606d28da280602924f1a0dbf1440947f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577750d51ad1bf8682a27ecce7df97eef
SHA1618e62b3cf7bada707c65a60dadc5b61d3d367d0
SHA25618e509c24318054aae1e2ab0710710029af9d25d8204b15ebd6eaef80d1770e0
SHA51217e310951437c787eacd0b9f1863a579bf76adf24aea559604a55317488b46186042f699c7f6ebb0deac2708bcf4a8b68a76dab0a26a6b3568d3416c4590a238
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\633SXO0D\httpErrorPagesScripts[2]
Filesize8KB
MD53f57b781cb3ef114dd0b665151571b7b
SHA1ce6a63f996df3a1cccb81720e21204b825e0238c
SHA25646e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad
SHA5128cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PLSLTMYI\dnserror[1]
Filesize1KB
MD573c70b34b5f8f158d38a94b9d7766515
SHA1e9eaa065bd6585a1b176e13615fd7e6ef96230a9
SHA2563ebd34328a4386b4eba1f3d5f1252e7bd13744a6918720735020b4689c13fcf4
SHA512927dcd4a8cfdeb0f970cb4ee3f059168b37e1e4e04733ed3356f77ca0448d2145e1abdd4f7ce1c6ca23c1e3676056894625b17987cc56c84c78e73f60e08fc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QS2MOPHD\errorPageStrings[1]
Filesize2KB
MD5e3e4a98353f119b80b323302f26b78fa
SHA120ee35a370cdd3a8a7d04b506410300fd0a6a864
SHA2569466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66
SHA512d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y1738IZL\NewErrorPageTemplate[1]
Filesize1KB
MD5cdf81e591d9cbfb47a7f97a2bcdb70b9
SHA18f12010dfaacdecad77b70a3e781c707cf328496
SHA256204d95c6fb161368c795bb63e538fe0b11f9e406494bb5758b3b0d60c5f651bd
SHA512977dcc2c6488acaf0e5970cef1a7a72c9f9dc6bb82da54f057e0853c8e939e4ab01b163eb7a5058e093a8bc44ecad9d06880fdc883e67e28ac67fee4d070a4cc
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
16KB
MD5e47a38ee63d31c6c6fb9932d2678d0c2
SHA12b9fc6eee7be340e6e89f631f60697caf093f7e7
SHA256774e5f521f660344ca0b5102205bc3a371f9bb3c15be95ad35c3f7c408553aa6
SHA5120b0f0c348f3e3581963fccff6035725dfe82d1c528032f351e642c0e136c66aa7eb6c474476a2011135d467707a5ede9e83a1c9c92ab70661143ee2430e96cf1