b6305bc0d5d6ac96ff9d41a9d6bcd3e3a1766494deab5030e88ec56564627be7

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-09-2024 21:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Size

806KB
MD5

db3a1c67b7eab30c2184cfc3714af177
SHA1

ad3c667ff18f876a98d3e2c76347d852d2ad38bb
SHA256

b6305bc0d5d6ac96ff9d41a9d6bcd3e3a1766494deab5030e88ec56564627be7
SHA512

469c633da4573267e9d636f258eb3ba2c60adb53faf417e364f52e0fff468d4f0aa5d7bd634a8522364e341adbd0acb08eb389daec88e9c052afbd9a1df47929
SSDEEP

12288:GEncCP0UpnIIxU8H3Ek9aL4cLdWJb1AWSWxxLs/JI4s/unEIZUlxOnY7a+z:HcaAIxL3EkyrLdMLMJEdIKxQXg

Score

10^/10

discovery evasion

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "1"	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\system32\drivers\etc\hosts	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
File created	C:\WINDOWS\system32\drivers\etc\hosts	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msscp.reg	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msscp.reg	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\taobao.ico	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\System\taobao.ico	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\web\Index.html	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
File opened for modification	C:\Windows\web\Index.htm	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
File opened for modification	C:\Windows\web\Index.html	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
File created	C:\Windows\web\Index.htm	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TYPEDURLS	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://t.wozhao123.com"	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://t.wozhao123.com"	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe

Modifies registry class 53 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA\9 = "0"	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\ÖØÃüÃû(&M)\Command	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\ShellFolder\HideFolderVerbs	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\Open(&O)\Command	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\ShellFolder\HideOnDesktopPerUser	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\É¾³ý(&D)\Command	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\É¾³ý(&D)\Command\ = "Rundll32.exe"	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\ÖØÃüÃû(&M)\Command\ = "Rundll32.exe"	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\É¾³ý(&D)	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\Open(&O)\Command\ = "iexplore.exe C:\\WINDOWS\\Web\\index.html"	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\DefaultIcon\ = "C:\\Program Files (x86)\\Common Files\\System\\taobao.ico"	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\ÊôÐÔ(&R)\Command	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\ÊôÐÔ(&R)	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\ÖØÃüÃû(&M)\Command	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\ = "Internet Explorer"	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\Open(&O)\ = "´ò¿ªÖ÷Ò³(&H)"	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\ShellFolder\Attributes = "0"	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\ShellFolder\HideOnDesktopPerUser	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\É¾³ý(&D)\Command	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA\cdafile2 = "282038"	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\Open(&O)	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\ÖØÃüÃû(&M)	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\ÊôÐÔ(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl"	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA\1 = "20240911"	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\ÊôÐÔ(&R)	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\É¾³ý(&D)\Command\ = "Rundll32.exe"	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\ShellFolder\HideFolderVerbs	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\ShellFolder\Attributes = "0"	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\ShellFolder\WantsParseDisplayName	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\DefaultIcon	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\ShellFolder\WantsParseDisplayName	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\ShellFolder	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\ShellFolder	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\DefaultIcon	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\É¾³ý(&D)	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA\9 = "1"	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\ÊôÐÔ(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl"	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\ÖØÃüÃû(&M)\Command\ = "Rundll32.exe"	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\Open(&O)	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\Open(&O)\Command\ = "iexplore.exe C:\\WINDOWS\\Web\\index.htm"	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\Open(&O)\ = "´ò¿ªÌÔ±¦Íø(&T)"	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\ÊôÐÔ(&R)\Command	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\Open(&O)\Command	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE"	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\ = "ÌÔ±¦Íø£¡"	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\ÖØÃüÃû(&M)	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe

Runs .reg file with regedit 2 IoCs

pid	Process
712	regedit.exe
2444	regedit.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 712	4256	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe	83
PID 4256 wrote to memory of 712	4256	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe	83
PID 4256 wrote to memory of 712	4256	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe	83
PID 4256 wrote to memory of 4704	4256	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe	84
PID 4256 wrote to memory of 4704	4256	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe	84
PID 4256 wrote to memory of 4704	4256	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe	84
PID 4704 wrote to memory of 2444	4704	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe	85
PID 4704 wrote to memory of 2444	4704	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe	85
PID 4704 wrote to memory of 2444	4704	db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Drops file in Drivers directory
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\SysWOW64\regedit.exe
  C:\Windows\regedit.exe /S C:\Windows\system32\msscp.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:712
- C:\Users\Admin\AppData\Local\Temp\db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\db3a1c67b7eab30c2184cfc3714af177_JaffaCakes118.exe
  2⤵
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\SysWOW64\regedit.exe
    C:\Windows\regedit.exe /S C:\Windows\system32\msscp.reg
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs .reg file with regedit
    PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\taobao.ico

Filesize
14KB

MD5
468fada123f5548ac87e57bae81f6782

SHA1
edb8f012c25906e6afd8bf335b495e16c440243d

SHA256
091c882bb307d57f2c7c42309e7ba8740130fef8c3ed772b0bc5e5505e37034d

SHA512
635ec26c88c2394dd4f2a81b9aea8f429a91adfeb37ae34e51b03f3cf8e503c123c3685938f40cea07d6146e0c7113aadbe62fa528f1f6d8b995e617fd68a4aa

Download Submit
C:\WINDOWS\system32\drivers\etc\hosts

Filesize
3KB

MD5
a9a2eaa6e4437050ae3d3c8d9ef876d6

SHA1
26cab2b0c6ab330fefd7ffe7f7db9a14cf8ea864

SHA256
0f664cf39d5c19d100cf2c29a81c53e5c750071af0740ca72d6414f89bf21380

SHA512
bb31b293ffa09316fc31038e887cb464228c19b14cfd09d4afe652cf3f559749d51b1e49ec61f52dbed986a4c3cbdeafb8b9cc00303cfcb47ddd3eaeb1570627

Download Submit
C:\Windows\SysWOW64\msscp.reg

Filesize
336B

MD5
45c2ffcb48ade649255bc861d1928963

SHA1
4a7042765fab8063c2383fb9cde3a4ece24a0628

SHA256
658a998e67711f328b0a8a5dd1ccb6738d0fc0abd0351c71270c4fc4b490fa71

SHA512
70cfa5b430e18a589e0d88284d5a79433a3b7351767ccf1500349b8e44ab2a8f3c5dffd86124cccf4b326dac5f93dd3ef7c48873fa58c0b3413eb629ef9c53db

Download Submit
memory/4256-0-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/4256-1-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/4256-28-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/4704-5-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/4704-27-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads