Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2024, 22:00
Static task
static1
Behavioral task
behavioral1
Sample
defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe
-
Size
1.7MB
-
MD5
defaaaf754d0ea2fe664e82061f56f74
-
SHA1
d83c4b6cce9d18c3400f472d5d7f6a36d7f19319
-
SHA256
c0e1d9f27d5d57b7dd90853012e16106be85923796d74f15fafa7825007adcbf
-
SHA512
cbb88febe57a203c1b581acc15b8f2a7681093d6d19bb77da90611380f26abfb9cf3454a768cba43cc8ebaec86a30768e7eb2bc7b5e06ddbb0f81f38b5c82865
-
SSDEEP
3072:boFZSQ895kPwaH8y0YrftKo8PiKxl8k7H4+CPolWyG6wYR5KKfKO9iYqE4xm:boTzwacQrfWHbYJPo0n67R5xT9WE4
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\recovery = "C:\\Windows\\system32\\ipobjsql.exe" defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe -
Executes dropped EXE 36 IoCs
pid Process 1028 disppdbfwc.exe 2640 smss.exe 3368 smss.exe 3352 smss.exe 3504 smss.exe 1816 smss.exe 3992 smss.exe 896 smss.exe 688 smss.exe 1832 smss.exe 3280 smss.exe 1576 smss.exe 4084 smss.exe 1948 smss.exe 3812 smss.exe 4132 smss.exe 3388 smss.exe 4072 smss.exe 2984 smss.exe 4768 smss.exe 4472 smss.exe 3940 smss.exe 1128 smss.exe 4564 smss.exe 1460 smss.exe 1504 smss.exe 216 smss.exe 3684 smss.exe 3504 smss.exe 4788 smss.exe 2952 smss.exe 3180 smss.exe 1400 smss.exe 4108 smss.exe 5048 smss.exe 5012 smss.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\recovery = "C:\\Windows\\system32\\ipobjsql.exe" defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ = "AcroIEHelperStub" defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\NoExplorer = "1" defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe -
Drops file in System32 directory 8 IoCs
description ioc Process File created C:\Windows\SysWOW64\poolctfpool.ocx defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\poolctfpool.ocx defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe File created C:\Windows\SysWOW64\ipobjsql.exe defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ipobjsql.exe defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe File created C:\Windows\SysWOW64\procdnsras.exe defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\procdnsras.exe defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe File created C:\Windows\SysWOW64\objctfhost.exe defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\objctfhost.exe defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4564 1028 WerFault.exe 94 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language disppdbfwc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ielowutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00272f852806db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2372902764" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009a7bf3bae5f3a549b81f23758225dc5c00000000020000000000106600000001000020000000e094cf393e29fab4c672bda371bb80d134bef560aceef18bed5179fb9dd2fbff000000000e800000000200002000000000425788f49aa10c9689b61298d86bc58096e1b91c047d4739bfa070e7999149200000006cb97de9712d3a8e021398ef9f21276b40bea52612659a17acec071fd067075040000000aff9a53d3a6c47cd5840a41896e4ebaa4b1bf3da4657ffd2598ea84901e303d5d03756ffe21e4a39e2fde6fc9662ed5b1745432f103a7e68dcb99605752d46ab iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009a7bf3bae5f3a549b81f23758225dc5c00000000020000000000106600000001000020000000a99bf09309b7eb8da22ff7e3cd0d2d91f796d5ac226bb636343144f6cb9ee39e000000000e8000000002000020000000c7886509687b2dd9f8a9f5ac910ed4c49eafed24a123e005a85f23c3b655183020000000ccce6b2427044adfc350635a02d0c5cf56df6c90fab6262890178c78c9a58ccd40000000c8424bed5905d9a7d4b92be91f43cb3cb2233659585e7ae90c7dcc1e295500d66c2c7af857b5423514d5c9f1262984dce064af68723d7f1d7a863ea64a28f53b iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31131176" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31131176" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009a7bf3bae5f3a549b81f23758225dc5c000000000200000000001066000000010000200000004b81ad8cc80a5b8a3514144139fe8a5ce1ee2b643e462f79f151cbbdd84e4f3d000000000e8000000002000020000000e7cac94a3cd569471e48c7f4398885e713f42c22305859a2371f5299f38c929e20000000d011930f685288a46b5c8f06d7c4be155cdea10170bb88599a231b25f4d66f2840000000cc4eb832577b5f2fb4e51f865099342e30c7d50044e09c5d3e29c5b5cd746708cc6261882757e21629f3f11cac963d466f5e2c886ee8dd17a042655b4ca1c675 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B8FA2847-721B-11EF-A2A4-5E50324ADEFE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2374465157" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009a7bf3bae5f3a549b81f23758225dc5c00000000020000000000106600000001000020000000353575a27f1ae7f0ad2fb02e74748850318ee3083af3d3f7f41ecb81416daf43000000000e800000000200002000000082eb65885efdf7416774432b75a345d0b777bac78bbb25c4f4d336f7dc4f1d0d20000000607cc5a207e523904509876f2f576508e3ed1831c161f1e66b9134ea64d8f75940000000f3e61ee42782d96486223e1f2e58d096e7139d8023820b904d441edcc57ba1221bf3285c69a697fc11019fb95d35fefd900db872313e255b174aaba4d1b27c3e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2373059324" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d017658e2806db01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Check_Associations = "no" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009a7bf3bae5f3a549b81f23758225dc5c0000000002000000000010660000000100002000000077e45f526457a748c31c3feea1351f97603a8e68cc5ad716ab29593f78fdc710000000000e80000000020000200000003464c4d7a46e2d9e6a6e26225ae438e6334198dddbc60fff55aa7882f683896020000000021cdfd4f84b05e7175e01f579ac928f724a5f8abf3d28cded463734ba9e0cfc40000000f77e6e6ae053db277bb792487da936d53796717775216fef5f6667eb719eec51c2759f70320db39bb997b1b42bfbf2d058092985087cd09f4a85440a8573ec7c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009a7bf3bae5f3a549b81f23758225dc5c000000000200000000001066000000010000200000005e386cedf5742091928fe3776f5270aff73a4276efc060a64bcf6d72dc1b2ff3000000000e80000000020000200000004ab8f8f720f318bf324d59714ac57428f64de13a5db83e0b7b2b0a70505a5dfe20000000b0e442b97e791dcc48cdf91717e019f601a671b33920ffaa745f7d4509956e76400000003a283ba398da2a8d3fe4cdbbaed2559949dad2e11f1627e39446f804ebda896631314c8c89306a97758945fe1357d2b2cbc56d875163afe131ea5f4f987f2dd0 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6025d8a02806db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31131176" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31131176" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 104d379c2806db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0089b972806db01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70fac8892806db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40cc0baa2806db01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009a7bf3bae5f3a549b81f23758225dc5c000000000200000000001066000000010000200000006b89567315e06e308f7c97929dd6c4580eec1688aa47618e6c478482eb87adfd000000000e80000000020000200000005a9b2e6e31ec4d943f7dbc47bb37fa87b6fc2bcfabf7ba2cbfcc8c88aa5a15da20000000c6825f6727ece7195d8050061639e67425575c3a5466ba56368679e8cdf990b0400000005306af3b8504cf90dfb9f875645faa5fc3da7aba04a046b485d597d2bb47b3f7d0bedad2b75da27f1f8b80c7d0c62e751073c1deb0a97dfd23ae83a5ffdfa4fb iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009a7bf3bae5f3a549b81f23758225dc5c000000000200000000001066000000010000200000005903ad547265a9f436887edd61f2918989aa09db74038c3b742862f048835664000000000e800000000200002000000083ca3dcebfea3b4e781438f5f300746318e0b10ae064367a248585cb58b8a35920000000c59520e8b1e686db1a966bcdce0d9a19541fbf3d84e040ec4036e037193cfd6540000000845cc7bf555dd3ab8b1a3a8cc7162ffbb7e42d4cd8091e4108d1ddf675d8a81e35e4d1c50d0c78294332fcc439c41818b712164c48058d788e2dd50a4f43d4b0 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0f871a52806db01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0e9a7ae2806db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\Main regedit.exe Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2374465157" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5030fa922806db01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009a7bf3bae5f3a549b81f23758225dc5c00000000020000000000106600000001000020000000ea75e1063a0d70e858e04f611083b1cccd53e1167c3ff5a7dc3b57296f999cb5000000000e8000000002000020000000f4a53d03b8c753478af544b1e8de2aaf1d50bb7bbbfc213e24c0859da6b4d136200000005ddde337868ad393dceeb6216e6b5aac02cd2d53999db2cf2d7cbf50b34432c94000000018fb6931e4b1acd30e114e69464d7e8843b528f18ad713f876e930b3208179f45b9c3401a599dd41bf4ac629bbed711aafa7d8bf9bcdf7d0f2ec00110c07a00d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009a7bf3bae5f3a549b81f23758225dc5c0000000002000000000010660000000100002000000078bfe287b0242d4b555133c2250c35f60b08326f51eb2da23a8c207378692193000000000e800000000200002000000024513ac817d39f113fdaabff5de660e7926b1266970669484194764abe8c942220000000b2b9fb512935d6f797b9a2e07b484c6d401c700739b9797a9160109e151073674000000076daf70eff5bc487e84d60ffee367fa08365029db810b6e134e35df39b103da999a7d215575a9d0a0633dfa866b1121cabe09beb9e929e3c0fdaa7fffe7f6b38 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433029861" iexplore.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ = "Adobe PDF Link Helper" defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\InprocServer32 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\InprocServer32\ = "C:\\Windows\\SysWow64\\poolctfpool.ocx" defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\InprocServer32\ThreadingModel = "Apartment" defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ProgID defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\VersionIndependentProgID defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ProgID\ = "AcroIEHelperShim.AcroIEHelperShimObj.1" defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\VersionIndependentProgID\ = "AcroIEHelperShim.AcroIEHelperShimObj" defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe -
Runs regedit.exe 1 IoCs
pid Process 1332 regedit.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeBackupPrivilege 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe Token: SeDebugPrivilege 1028 disppdbfwc.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 552 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 552 iexplore.exe 552 iexplore.exe 1996 IEXPLORE.EXE 1996 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3092 wrote to memory of 1028 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 94 PID 3092 wrote to memory of 1028 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 94 PID 3092 wrote to memory of 1028 3092 defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe 94 PID 1028 wrote to memory of 440 1028 disppdbfwc.exe 98 PID 1028 wrote to memory of 440 1028 disppdbfwc.exe 98 PID 1028 wrote to memory of 440 1028 disppdbfwc.exe 98 PID 440 wrote to memory of 2640 440 cmd.exe 100 PID 440 wrote to memory of 2640 440 cmd.exe 100 PID 440 wrote to memory of 2640 440 cmd.exe 100 PID 440 wrote to memory of 2176 440 cmd.exe 103 PID 440 wrote to memory of 2176 440 cmd.exe 103 PID 440 wrote to memory of 2176 440 cmd.exe 103 PID 440 wrote to memory of 3368 440 cmd.exe 105 PID 440 wrote to memory of 3368 440 cmd.exe 105 PID 440 wrote to memory of 3368 440 cmd.exe 105 PID 440 wrote to memory of 2312 440 cmd.exe 109 PID 440 wrote to memory of 2312 440 cmd.exe 109 PID 440 wrote to memory of 2312 440 cmd.exe 109 PID 440 wrote to memory of 3352 440 cmd.exe 110 PID 440 wrote to memory of 3352 440 cmd.exe 110 PID 440 wrote to memory of 3352 440 cmd.exe 110 PID 440 wrote to memory of 3444 440 cmd.exe 111 PID 440 wrote to memory of 3444 440 cmd.exe 111 PID 440 wrote to memory of 3444 440 cmd.exe 111 PID 440 wrote to memory of 3504 440 cmd.exe 112 PID 440 wrote to memory of 3504 440 cmd.exe 112 PID 440 wrote to memory of 3504 440 cmd.exe 112 PID 440 wrote to memory of 4800 440 cmd.exe 113 PID 440 wrote to memory of 4800 440 cmd.exe 113 PID 440 wrote to memory of 4800 440 cmd.exe 113 PID 440 wrote to memory of 1816 440 cmd.exe 114 PID 440 wrote to memory of 1816 440 cmd.exe 114 PID 440 wrote to memory of 1816 440 cmd.exe 114 PID 440 wrote to memory of 1536 440 cmd.exe 115 PID 440 wrote to memory of 1536 440 cmd.exe 115 PID 440 wrote to memory of 1536 440 cmd.exe 115 PID 440 wrote to memory of 3992 440 cmd.exe 116 PID 440 wrote to memory of 3992 440 cmd.exe 116 PID 440 wrote to memory of 3992 440 cmd.exe 116 PID 440 wrote to memory of 4656 440 cmd.exe 118 PID 440 wrote to memory of 4656 440 cmd.exe 118 PID 440 wrote to memory of 4656 440 cmd.exe 118 PID 440 wrote to memory of 896 440 cmd.exe 119 PID 440 wrote to memory of 896 440 cmd.exe 119 PID 440 wrote to memory of 896 440 cmd.exe 119 PID 1028 wrote to memory of 1332 1028 disppdbfwc.exe 120 PID 1028 wrote to memory of 1332 1028 disppdbfwc.exe 120 PID 1028 wrote to memory of 1332 1028 disppdbfwc.exe 120 PID 552 wrote to memory of 1996 552 iexplore.exe 123 PID 552 wrote to memory of 1996 552 iexplore.exe 123 PID 552 wrote to memory of 1996 552 iexplore.exe 123 PID 440 wrote to memory of 4056 440 cmd.exe 125 PID 440 wrote to memory of 4056 440 cmd.exe 125 PID 440 wrote to memory of 4056 440 cmd.exe 125 PID 440 wrote to memory of 688 440 cmd.exe 126 PID 440 wrote to memory of 688 440 cmd.exe 126 PID 440 wrote to memory of 688 440 cmd.exe 126 PID 440 wrote to memory of 3492 440 cmd.exe 127 PID 440 wrote to memory of 3492 440 cmd.exe 127 PID 440 wrote to memory of 3492 440 cmd.exe 127 PID 440 wrote to memory of 1832 440 cmd.exe 128 PID 440 wrote to memory of 1832 440 cmd.exe 128 PID 440 wrote to memory of 1832 440 cmd.exe 128 PID 440 wrote to memory of 856 440 cmd.exe 129 -
Views/modifies file attributes 1 TTPs 34 IoCs
pid Process 3528 attrib.exe 2312 attrib.exe 1536 attrib.exe 3324 attrib.exe 5004 attrib.exe 5068 attrib.exe 4044 attrib.exe 4800 attrib.exe 856 attrib.exe 5052 attrib.exe 2884 attrib.exe 1412 attrib.exe 2176 attrib.exe 3492 attrib.exe 2752 attrib.exe 3492 attrib.exe 4584 attrib.exe 3444 attrib.exe 4656 attrib.exe 4056 attrib.exe 3492 attrib.exe 3836 attrib.exe 2696 attrib.exe 4412 attrib.exe 3420 attrib.exe 5064 attrib.exe 3448 attrib.exe 2812 attrib.exe 2948 attrib.exe 4908 attrib.exe 892 attrib.exe 4192 attrib.exe 3136 attrib.exe 3016 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\defaaaf754d0ea2fe664e82061f56f74_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\disppdbfwc.exe"C:\Users\Admin\AppData\Local\Temp\disppdbfwc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1.tmp.cmd "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE""3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2640
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2176
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3368
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2312
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3352
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3444
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
PID:3504
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:4800
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1816
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:1536
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3992
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:4656
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:896
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:4056
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:688
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3492
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1832
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:856
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
PID:3280
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:4192
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1576
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3324
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4084
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3420
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1948
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3448
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3812
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- Views/modifies file attributes
PID:2752
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4132
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3492
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3388
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- Views/modifies file attributes
PID:3836
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4072
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:5064
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2984
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:5004
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4768
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2812
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4472
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2696
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3940
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3136
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
PID:1128
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- Views/modifies file attributes
PID:2948
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4564
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- Views/modifies file attributes
PID:3492
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1460
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:4908
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1504
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:5052
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:216
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:4584
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3684
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3528
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3504
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:5068
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4788
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:892
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2952
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2884
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
PID:3180
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:4412
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
PID:1400
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:1412
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4108
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3016
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5048
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\DISPPD~1.EXE"4⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:4044
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
PID:5012
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 5883⤵
- Program crash
PID:4564
-
-
C:\Windows\SysWOW64\regedit.exeregedit.exe /s C:\Users\Admin\AppData\Local\Temp\win5.tmp3⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Runs regedit.exe
PID:1332
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4288,i,12470628711992022444,7767535593390851522,262144 --variations-seed-version --mojo-platform-channel-handle=1432 /prefetch:81⤵PID:4132
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1028 -ip 10281⤵PID:692
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
- System Location Discovery: System Language Discovery
PID:2732
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:552 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1996
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Credential Access
Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD584231e6b703a4b64fa601076af9e016a
SHA1210e330be937e617085d28bf356c990a49dce0a5
SHA256e10b7b5f4f3291d340cebafd2d87bbec8689ffb1750a813a2887b6cd31ce61b3
SHA512e13fcb1e344dbd4cd9429faa51f61615ce602908e3eabb7ae9190e745f38747b62b563ca9c0c71abecff1fc398afd2652d32ec37511061d2dff2356aaad0b8d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD50f39c869e98f46066e2103b97d4afb15
SHA1e975038cc0fd3acb56ee5020eb428785fb685c38
SHA256125e260590e5b8a64faa0df42a13e9f6362c3c501e8c615695e2fb2af4c6c0f7
SHA5125568f71d60d281ef81789989d798fa7bdba2ccbc3a04d9905fda90b98103a686418e4acbccc342c76ec8bfb84f03897a70228d072d77f1289dd1df9b8d4acf02
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
2KB
MD52dc61eb461da1436f5d22bce51425660
SHA1e1b79bcab0f073868079d807faec669596dc46c1
SHA256acdeb4966289b6ce46ecc879531f85e9c6f94b718aab521d38e2e00f7f7f7993
SHA512a88becb4fbddc5afc55e4dc0135af714a3eec4a63810ae5a989f2cecb824a686165d3cedb8cbd8f35c7e5b9f4136c29dea32736aabb451fe8088b978b493ac6d
-
Filesize
1KB
MD5dfeabde84792228093a5a270352395b6
SHA1e41258c9576721025926326f76063c2305586f76
SHA25677b138ab5d0a90ff04648c26addd5e414cc178165e3b54a4cb3739da0f58e075
SHA512e256f603e67335151bb709294749794e2e3085f4063c623461a0b3decbcca8e620807b707ec9bcbe36dcd7d639c55753da0495be85b4ae5fb6bfc52ab4b284fd
-
Filesize
4KB
MD5d65ec06f21c379c87040b83cc1abac6b
SHA1208d0a0bb775661758394be7e4afb18357e46c8b
SHA256a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f
SHA5128a166d26b49a5d95aea49bc649e5ea58786a2191f4d2adac6f5fbb7523940ce4482d6a2502aa870a931224f215cb2010a8c9b99a2c1820150e4d365cab28299e
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
748B
MD5c4f558c4c8b56858f15c09037cd6625a
SHA1ee497cc061d6a7a59bb66defea65f9a8145ba240
SHA25639e7de847c9f731eaa72338ad9053217b957859de27b50b6474ec42971530781
SHA512d60353d3fbea2992d96795ba30b20727b022b9164b2094b922921d33ca7ce1634713693ac191f8f5708954544f7648f4840bcd5b62cb6a032ef292a8b0e52a44
-
Filesize
11KB
MD59234071287e637f85d721463c488704c
SHA1cca09b1e0fba38ba29d3972ed8dcecefdef8c152
SHA25665cc039890c7ceb927ce40f6f199d74e49b8058c3f8a6e22e8f916ad90ea8649
SHA51287d691987e7a2f69ad8605f35f94241ab7e68ad4f55ad384f1f0d40dc59ffd1432c758123661ee39443d624c881b01dcd228a67afb8700fe5e66fc794a6c0384
-
Filesize
168B
MD5e7efc2c945a798b4dab3fe50f1524592
SHA10bb937ccd89e40c91c0e58b376873ef909fe805b
SHA256624acac79fdcfe30592f5321b4ab73d360f393dbcdbe8daa50fcce63c710f5dc
SHA512e75840979404587aa15fd4d1e46707c33e32dca086ca72c7666045e14191e29857d06dc8ba737e69925c71b2e2d6a5ee3b63c36ecd2f32ae515f85a985d8f257
-
Filesize
4KB
MD53adea70969f52d365c119b3d25619de9
SHA1d303a6ddd63ce993a8432f4daab5132732748843
SHA256c9f5a19c7b11fd866483adc93aa5bc4bd3515bd995ca79297b227e3e5ef1a665
SHA512c4d836fcbdab4c859a6fc0f849d1e41e98c7e23fc0fe0fe0a09cb68e9a57d60b2ae9ad46762d7a5e05db28d6179bd431ef179ee1f9ff016db74cc3b1d74ed7f8
-
Filesize
112KB
MD5b84a148f40c3a694b930c5374f7a90cb
SHA1333f5acc35ea0206f7d1deadcb94ca6ec9564d02
SHA2567a3b78feba1670850602b7c33cb0968b4d89db609d98c81744b43cae23d563f5
SHA512032ba7ba40ed36cddbcd9cedaf53db82db98ac35a122a3cf37fb95452cdc62f1a7cde68d232525114cafe0cab36451ea977e1ae3912449cc738b8b99797bee3b
-
Filesize
18KB
MD5b3624dd758ccecf93a1226cef252ca12
SHA1fcf4dad8c4ad101504b1bf47cbbddbac36b558a7
SHA2564aaa74f294c15aeb37ada8185d0dead58bd87276a01a814abc0c4b40545bf2ef
SHA512c613d18511b00fa25fc7b1bdde10d96debb42a99b5aaab9e9826538d0e229085bb371f0197f6b1086c4f9c605f01e71287ffc5442f701a95d67c232a5f031838
-
Filesize
233B
MD5ba947d6bdd19e4f78a02678d9160fe2a
SHA133d3d9360345a5864690401e29bbb4e2d4f24b96
SHA2566b789d76092d99ea06c44f740d136c71b67624faf9ac3ef20d7014b3a3cb4a7c
SHA512e029d29b1dbf63c497bce1e72117b6c92309ac1d97e348ee63da5febdd6be130648e81b80388ec88193ffcf9092b376613ad7b698e94ee92745f68bcbdda2736
-
Filesize
1.7MB
MD5defaaaf754d0ea2fe664e82061f56f74
SHA1d83c4b6cce9d18c3400f472d5d7f6a36d7f19319
SHA256c0e1d9f27d5d57b7dd90853012e16106be85923796d74f15fafa7825007adcbf
SHA512cbb88febe57a203c1b581acc15b8f2a7681093d6d19bb77da90611380f26abfb9cf3454a768cba43cc8ebaec86a30768e7eb2bc7b5e06ddbb0f81f38b5c82865