fb73f3eeec877bca2a0b3a9cce8416ce11ceec7aee82277896a11c08686d2f16

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Size

2.0MB
MD5

eabc72853fb8f18c4899eb163dfa2415
SHA1

23e00f54e9dd89a8ee3830913b4fc676910cbf75
SHA256

fb73f3eeec877bca2a0b3a9cce8416ce11ceec7aee82277896a11c08686d2f16
SHA512

556f47de7441fdb0a15a3dd62d2ce4326228ba3b726e6921a6430d77f0eb966cc5700d9112a24da81cacf7bf048039243a75762f654852e063703827b6251c3f
SSDEEP

24576:x5b8rFrYRFS7Iid6Nx7izcFsaWrtLTOITQA6kOStpbspT63cGnJ/2aDZM/2YH7Xf:crFrZDd6ziVTOITQAOpT63cGnJ/WbJfx

Score

7^/10

adware discovery evasion stealer trojan

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2836	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2956	ietheword.exe
2820	Loader_forqd318.exe

Loads dropped DLL 4 IoCs

pid	Process
1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ietheword.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File created	C:\Program Files\Alisoft1\Internet Explorer\desktop.ini	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
File created	C:\Program Files\Alisoft1\È¥ÌÔ±¦ÌØÂô\desktop.ini	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
File created	C:\Program Files\Alisoft1\ºÃÍæÐ¡ÓÎÏ·\desktop.ini	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files\Alisoft1\Internet Explorer\target.lnk	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
File created	C:\Program Files\Alisoft1\È¥ÌÔ±¦ÌØÂô\desktop.ini	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ieworld\ietheword.exe	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
File created	C:\program files\ieworld\ietheword.ini.tmp	ietheword.exe
File created	C:\Program Files\Alisoft1\Internet Explorer\desktop.ini	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
File opened for modification	C:\Program Files\Alisoft1\ºÃÍæÐ¡ÓÎÏ·	attrib.exe
File created	\??\c:\program files\ieworld\ietheword.exe	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
File opened for modification	C:\PROGRA~1\ieworld\theworld.ac	ietheword.exe
File created	C:\Program Files\Alisoft1\ºÃÍæÐ¡ÓÎÏ·\desktop.ini	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
File created	\??\c:\program files\ieworld\ietheword.ini	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
File created	C:\Program Files\Alisoft1\È¥ÌÔ±¦ÌØÂô\target.lnk	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
File opened for modification	C:\Program Files\Alisoft1\Internet Explorer	attrib.exe
File opened for modification	C:\program files\ieworld\ietheword.ini	ietheword.exe
File created	C:\Program Files\Alisoft1\ºÃÍæÐ¡ÓÎÏ·\target.lnk	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
File opened for modification	C:\Program Files\Alisoft1\È¥ÌÔ±¦ÌØÂô	attrib.exe
File created	\??\c:\program files\C07116A0\Loader_forqd318.exe	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
File created	C:\PROGRA~1\ieworld\theworld.ac	ietheword.exe
File created	C:\PROGRA~1\ieworld\twcache.ini	ietheword.exe
File opened for modification	C:\PROGRA~1\ieworld\twcache.ini	ietheword.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\javalava.dll	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
File opened for modification	C:\Windows\javalava.dll	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader_forqd318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ietheword.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT	ietheword.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	ietheword.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\ietheword.exe = "0"	ietheword.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_INTERNET_SHELL_FOLDERS	ietheword.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	ietheword.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	ietheword.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	ietheword.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE	ietheword.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\ietheword.exe = "1"	ietheword.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION	ietheword.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\ietheword.exe = "1"	ietheword.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_INTERNET_SHELL_FOLDERS\ietheword.exe = "0"	ietheword.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\oyfile	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\otfile\shell\open\command\ = "explorer \"C:\\Program Files\\Alisoft%S\\È¥ÌÔ±¦ÌØÂô\""	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ig	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ig\ = "ogfile"	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.iy	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.iy\ = "oyfile"	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\otfile\DefaultIcon	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ogfile\shell\open\command\ = "explorer \"C:\\Program Files\\Alisoft%S\\ºÃÍæÐ¡ÓÎÏ·\""	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\oyfile\shell\open\command\ = "explorer \"C:\\Program Files\\Alisoft%S\\Internet Explorer\""	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\otfile\shell\open\command	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ogfile\DefaultIcon\ = "%1"	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\javalava.Java (TM)\ = "Java (TM)"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.it	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\otfile	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\javalava.Java (TM)\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\oyfile\shell\open\command	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.it\ = "otfile"	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\javalava.Java (TM)	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}\InprocServer32\ = "C:\\Windows\\javalava.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\javalava.Java (TM)\Clsid\ = "{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}\ProgID\ = "javalava.Java (TM)"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\oyfile\shell	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ogfile	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ogfile\shell	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ogfile\DefaultIcon	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ogfile\shell\open	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ogfile\shell\open\command	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\oyfile\DefaultIcon\ = "%1"	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\otfile\shell	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\otfile\shell\open	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}\ = "Java (TM)"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\oyfile\DefaultIcon	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\oyfile\shell\open	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\otfile\DefaultIcon\ = "%1"	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2956	ietheword.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2956	ietheword.exe
2956	ietheword.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2956	ietheword.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2956	ietheword.exe
2956	ietheword.exe
2956	ietheword.exe
2956	ietheword.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2956	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	30
PID 1848 wrote to memory of 2956	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	30
PID 1848 wrote to memory of 2956	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	30
PID 1848 wrote to memory of 2956	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	30
PID 1848 wrote to memory of 1756	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	32
PID 1848 wrote to memory of 1756	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	32
PID 1848 wrote to memory of 1756	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	32
PID 1848 wrote to memory of 1756	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	32
PID 1848 wrote to memory of 2100	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	34
PID 1848 wrote to memory of 2100	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	34
PID 1848 wrote to memory of 2100	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	34
PID 1848 wrote to memory of 2100	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	34
PID 1848 wrote to memory of 1072	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	36
PID 1848 wrote to memory of 1072	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	36
PID 1848 wrote to memory of 1072	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	36
PID 1848 wrote to memory of 1072	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	36
PID 1848 wrote to memory of 2172	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	38
PID 1848 wrote to memory of 2172	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	38
PID 1848 wrote to memory of 2172	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	38
PID 1848 wrote to memory of 2172	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	38
PID 1848 wrote to memory of 2172	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	38
PID 1848 wrote to memory of 2172	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	38
PID 1848 wrote to memory of 2172	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	38
PID 1848 wrote to memory of 2820	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	40
PID 1848 wrote to memory of 2820	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	40
PID 1848 wrote to memory of 2820	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	40
PID 1848 wrote to memory of 2820	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	40
PID 1848 wrote to memory of 2836	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	41
PID 1848 wrote to memory of 2836	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	41
PID 1848 wrote to memory of 2836	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	41
PID 1848 wrote to memory of 2836	1848	eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe	41

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2100	attrib.exe
1072	attrib.exe
1756	attrib.exe

C:\Users\Admin\AppData\Local\Temp\eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eabc72853fb8f18c4899eb163dfa2415_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1848
- C:\program files\ieworld\ietheword.exe
  "C:\program files\ieworld\ietheword.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2956
- C:\Windows\SysWOW64\attrib.exe
  attrib +s "C:\Program Files\Alisoft1\Internet Explorer"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:1756
- C:\Windows\SysWOW64\attrib.exe
  attrib +s "C:\Program Files\Alisoft1\È¥ÌÔ±¦ÌØÂô"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:2100
- C:\Windows\SysWOW64\attrib.exe
  attrib +s "C:\Program Files\Alisoft1\ºÃÍæÐ¡ÓÎÏ·"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:1072
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 "C:\Windows\javalava.dll" -s
  2⤵
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2172
- \??\c:\program files\C07116A0\Loader_forqd318.exe
  "c:\program files\C07116A0\Loader_forqd318.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2820
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\pipiuni.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\ieworld\ietheword.ini

Filesize
8KB

MD5
e3ff8d3cfdc159555abb8abe9834f611

SHA1
61e5c3f58bc97d63658f5927584bd073942ba053

SHA256
7af6ad94dc99df502aece61da80b7394f4fd44cec7bab9b43adacd7f723bf013

SHA512
86acc0da236344987065f12456097a634b478274fea38ac7cb12a1b5426edcc5fa3d82188964f83d04fe9a792b332f570c794deca34855d7ff300f7041cc7f49

Download Submit
C:\Users\Admin\AppData\Local\Temp\pipiuni.bat

Filesize
144B

MD5
fee8dafce13cf2ebebc5f4faa5ff4813

SHA1
12111abcc674ca5ea8eb62671d51a1fb6a2d2bb2

SHA256
48409b540f04ef8b8e603001f4542c0e7f930e6fe4ad8fcac494e4841fed5d09

SHA512
a85588b8a45d22135d966ad8a329f476e5172263e26912668aa64edeee6c01894bd065be807598bdf7d704973b91e71e317f4d6597322b0692b00640bee1417e

Download Submit
C:\Windows\javalava.dll

Filesize
435KB

MD5
7ade9cfa995166027f90d0aa790582a5

SHA1
764273527ef34ff1a107bb777da7f65dac2eb48f

SHA256
af4f38bf92a4bd1a30e5ee2cf92b05f70549fc7d87842abcce7fda8bf1a525a2

SHA512
a96feb280c511141f264f408374c700c64acf91c38cd7266866d2878dedbaa098a2eca3e2e10a9f80f43bffabf2421cad19e1aa065ade5ffb71c64a97ad6d54e

Download Submit
C:\program files\ieworld\ietheword.ini

Filesize
8KB

MD5
7c5c7ef31c01be7dc9aab07197d59052

SHA1
1732f6eab1f5727362bbb25028afd760f777c770

SHA256
bfdb19348faace85b8eb971be8e6329a8defa94b7158bb0b32b274b09494077d

SHA512
0c3c0e648750df08041d555e843599375440c4762ceb2650d73a97868709a326b47c352decd79e5a5b44b604ed3cb28c46f41c8fa6bea9272a9ae0de68d3f5a9

Download Submit
\Program Files\C07116A0\Loader_forqd318.exe

Filesize
65KB

MD5
bef14d54106a5129182af8b04747adbf

SHA1
01fa77e1237e29f938b4c5d703946a559b2e563c

SHA256
49b6779a2221ee3658da0f906b26843b65826cfdf8263b2e438b43467259c603

SHA512
c304fb79824d8bfe30f927afed9abcc5d8b3349a1f2fd29f7b9d129918e42eeb84ab7c1fd9492c442bc50f6a047609843d8fbe3c59e02d1e58dcbbbaf0b9bea2

Download Submit
\Program Files\ieworld\ietheword.exe

Filesize
1.4MB

MD5
a1272a8305fa1f55de6701e9048a60f0

SHA1
90c5def58931ff14c84bba3826bff0aa065faea5

SHA256
3fc7c2588ebbadc9ef4710e936f44230a1147dfaa8d562fe3b6035ad5ffbbb6c

SHA512
510d2e2ac7cfd6930ac3a5ff9aa93df65795473de884162289edc6930315e93648b7cceedf7090a47025bcc0efb1497917441ba5023f459943b217992444eff2

Download Submit
memory/1848-56-0x0000000000400000-0x0000000000610000-memory.dmp

Filesize
2.1MB

Download
memory/1848-111-0x0000000000400000-0x0000000000610000-memory.dmp

Filesize
2.1MB

Download
memory/1848-96-0x0000000000400000-0x0000000000610000-memory.dmp

Filesize
2.1MB

Download
memory/1848-80-0x0000000000400000-0x0000000000610000-memory.dmp

Filesize
2.1MB

Download
memory/2172-110-0x0000000000960000-0x00000000009D2000-memory.dmp

Filesize
456KB

Download
memory/2956-63-0x0000000075A20000-0x0000000075B7C000-memory.dmp

Filesize
1.4MB

Download
memory/2956-77-0x0000000076680000-0x00000000767A4000-memory.dmp

Filesize
1.1MB

Download
memory/2956-58-0x0000000074DF0000-0x0000000074E22000-memory.dmp

Filesize
200KB

Download
memory/2956-60-0x00000000768D0000-0x0000000076970000-memory.dmp

Filesize
640KB

Download
memory/2956-64-0x0000000075850000-0x0000000075A14000-memory.dmp

Filesize
1.8MB

Download
memory/2956-66-0x0000000076680000-0x00000000767A4000-memory.dmp

Filesize
1.1MB

Download
memory/2956-65-0x0000000074D70000-0x0000000074DE2000-memory.dmp

Filesize
456KB

Download
memory/2956-62-0x0000000076970000-0x00000000775BA000-memory.dmp

Filesize
12.3MB

Download
memory/2956-75-0x0000000075850000-0x0000000075A14000-memory.dmp

Filesize
1.8MB

Download
memory/2956-61-0x0000000075530000-0x0000000075565000-memory.dmp

Filesize
212KB

Download
memory/2956-74-0x0000000075A20000-0x0000000075B7C000-memory.dmp

Filesize
1.4MB

Download
memory/2956-21-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2956-20-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2956-19-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2956-16-0x0000000004490000-0x0000000004492000-memory.dmp

Filesize
8KB

Download
memory/2956-13-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2956-129-0x0000000075A20000-0x0000000075B7C000-memory.dmp

Filesize
1.4MB

Download
memory/2956-15-0x0000000075CB4000-0x0000000075CB5000-memory.dmp

Filesize
4KB

Download
memory/2956-14-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads