dbaa97788298e8872189a66cdebe2762d1b456d7e7555d7bcda9c1ea37ef87b4

Analysis

max time kernel
150s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 06:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef39e90ac47ad5d59cd228e5b0ae1cc6_JaffaCakes118.exe
Size

1.8MB
MD5

ef39e90ac47ad5d59cd228e5b0ae1cc6
SHA1

0d663fe95c454487c8f4f37477cc29ab04e5210d
SHA256

dbaa97788298e8872189a66cdebe2762d1b456d7e7555d7bcda9c1ea37ef87b4
SHA512

e14ede991caf23f6c2846e40578f3edda44b5fd6178c4f97bd1cb745b83458bdf98b60e60668c58c3411d8fce19a47a059fd29a5aa5c645b861cfbee649ed299
SSDEEP

24576:VwSfA1080Xk2CJJCAiW5RpsKc4/ahweeOrA3tKM0e2LmHTVfD0bZbNxh4kF3DJws:/fB8wkNrMvhwYsJ0eOmHF0bZZx6U5yO

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2964	ts.exe

Loads dropped DLL 11 IoCs

pid	Process
3040	ef39e90ac47ad5d59cd228e5b0ae1cc6_JaffaCakes118.exe
3040	ef39e90ac47ad5d59cd228e5b0ae1cc6_JaffaCakes118.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe

UPX packed file 30 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3040-4-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-32-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-53-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-55-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-54-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-52-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-51-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-48-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-46-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-44-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-42-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-40-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-38-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-36-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-34-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-30-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-28-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-26-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-24-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-22-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-20-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-18-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-16-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-14-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-12-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-10-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-9-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-8-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-7-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/3040-6-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ts.exe	ef39e90ac47ad5d59cd228e5b0ae1cc6_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DNFÊäÈë·¨.ime	ts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef39e90ac47ad5d59cd228e5b0ae1cc6_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0c085e2ee0bdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{18380F01-77E2-11EF-B36A-E62D5E492327} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433061709"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd30000000002000000000010660000000100002000000094909658c16047bf8a891951303576f7a27e68a710ca63d902205eafadfef3de000000000e8000000002000020000000e76718b7cd21466391cc26ad4da00d925ddfc8ff7d81aa7486f04b657c4c4a5e2000000091d2abfb2e29f92cb4948f5a80fc2c137118b0819f6082594a6e5767a1ab965940000000e3f85638f709e5869cdb9ca96bb4e98c1060879f6b0bf57453ee5ab09771bf78b752ae99977a7fd8dc695a05daaf139640266e0b84585e2eb6f8472ba28bd235	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000e5c45839365b97c859f754c9fddc4989fb114ce78be851e1855e4bc926fb6352000000000e8000000002000020000000025b2402f5c404313646ffd6430c8c490d00bf3339be3c138934d3aec178d4e390000000fe7d7fd791c4bad93af589a258d05c410fc5b5e032806a76af0d1b89101ee3c0940ed4a444f7bc202fdb2be754eaf35a15fcb9f9bf107041f0d9165a4c60c6f63c298f07f45b7e54e49a5967bbabe00dce6aa1d49493b792bc99ce3b8a9ab4c96ac588c535f96f682625c5e3fe38a01258b8550d129b8b089bcddc77af8981c9d98b2f9c7c23ea47dfd9939e792d15c94000000037ad6e4c24a23991aa284ae8999b0956eebf6b1e8ef9006498ca1c927ff283af45d38ddf377b5e088400b3596e9b6f9631ed6a0f1a0acb39cadc7dcd43624f20	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	ts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe
2964	ts.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	3040	ef39e90ac47ad5d59cd228e5b0ae1cc6_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3040	ef39e90ac47ad5d59cd228e5b0ae1cc6_JaffaCakes118.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe
Token: 33	2964	ts.exe
Token: SeIncBasePriorityPrivilege	2964	ts.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2808	iexplore.exe
2808	iexplore.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
3040	ef39e90ac47ad5d59cd228e5b0ae1cc6_JaffaCakes118.exe
3040	ef39e90ac47ad5d59cd228e5b0ae1cc6_JaffaCakes118.exe
3040	ef39e90ac47ad5d59cd228e5b0ae1cc6_JaffaCakes118.exe
2808	iexplore.exe
2808	iexplore.exe
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE
2808	iexplore.exe
2808	iexplore.exe
2964	ts.exe
2964	ts.exe
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2964	ts.exe
2964	ts.exe
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2808	3040	ef39e90ac47ad5d59cd228e5b0ae1cc6_JaffaCakes118.exe	31
PID 3040 wrote to memory of 2808	3040	ef39e90ac47ad5d59cd228e5b0ae1cc6_JaffaCakes118.exe	31
PID 3040 wrote to memory of 2808	3040	ef39e90ac47ad5d59cd228e5b0ae1cc6_JaffaCakes118.exe	31
PID 3040 wrote to memory of 2808	3040	ef39e90ac47ad5d59cd228e5b0ae1cc6_JaffaCakes118.exe	31
PID 2808 wrote to memory of 2844	2808	iexplore.exe	32
PID 2808 wrote to memory of 2844	2808	iexplore.exe	32
PID 2808 wrote to memory of 2844	2808	iexplore.exe	32
PID 2808 wrote to memory of 2844	2808	iexplore.exe	32
PID 3040 wrote to memory of 3004	3040	ef39e90ac47ad5d59cd228e5b0ae1cc6_JaffaCakes118.exe	34
PID 3040 wrote to memory of 3004	3040	ef39e90ac47ad5d59cd228e5b0ae1cc6_JaffaCakes118.exe	34
PID 3040 wrote to memory of 3004	3040	ef39e90ac47ad5d59cd228e5b0ae1cc6_JaffaCakes118.exe	34
PID 3040 wrote to memory of 3004	3040	ef39e90ac47ad5d59cd228e5b0ae1cc6_JaffaCakes118.exe	34
PID 3040 wrote to memory of 2964	3040	ef39e90ac47ad5d59cd228e5b0ae1cc6_JaffaCakes118.exe	35
PID 3040 wrote to memory of 2964	3040	ef39e90ac47ad5d59cd228e5b0ae1cc6_JaffaCakes118.exe	35
PID 3040 wrote to memory of 2964	3040	ef39e90ac47ad5d59cd228e5b0ae1cc6_JaffaCakes118.exe	35
PID 3040 wrote to memory of 2964	3040	ef39e90ac47ad5d59cd228e5b0ae1cc6_JaffaCakes118.exe	35
PID 2808 wrote to memory of 2944	2808	iexplore.exe	36
PID 2808 wrote to memory of 2944	2808	iexplore.exe	36
PID 2808 wrote to memory of 2944	2808	iexplore.exe	36
PID 2808 wrote to memory of 2944	2808	iexplore.exe	36

C:\Users\Admin\AppData\Local\Temp\ef39e90ac47ad5d59cd228e5b0ae1cc6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ef39e90ac47ad5d59cd228e5b0ae1cc6_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://bbs.h5dao.com/?u=187434
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2808 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2844
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2808 CREDAT:275471 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2944
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://yezhishu.uueasy.com/
  2⤵
  PID:3004
- C:\Windows\SysWOW64\ts.exe
  C:\Windows\system32\ts.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14dd6be15f269ca06ca1434ee099c2c2

SHA1
74a15092e2b565b2aec7e16e2f252c31c4d654b0

SHA256
a01e0f7a661a98b6e7ad99d6c0a0e26c879269a0a925450e647a1962a6d96e4e

SHA512
089f8f6d81bf1f38e35419199dc0a6a3a10df61bf9cd4d9630ff8a558004d5fd6862ebd876d8e64b76b126fc1ada178a15423b0089a8fbbb77938054425ba807

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97b64d338ca59f89df119abf3372299a

SHA1
9bbd48b9c49bb8525c8a38f2023d1050eb480b30

SHA256
87ffcb3c3235927a75830ad3e47e84c40e6aebf30b675812c2b8f09af309b49b

SHA512
4e91c84230912efd132e57006a0cf95081300751d4be0d3125aff913b7021b3f1786522ce5aa985d8cbc81b8d0ba1860158c3310445c093ce73a85733c746bc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58cb83fe4fc44c6a5ad95911b97fbc09

SHA1
6d36b9207b27d8f32e804ed5ba2968ef66e5d225

SHA256
259b92725616d91fc0c0625cd154257bbd20f7947b6698c60660bcf7ad05be3d

SHA512
969276e989c66708cc4f55f65c4df950add48a752a4608cc7a2d1512d45e6ced90f4fb5780b9a65da2018a89c9d9e1e9f2543b1801f85faa1f27a6119c51461f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf421eb7e2eaa0b2818ae5026c4f1d6a

SHA1
746fcad15453fd6aee0430f0777e6741c80461a8

SHA256
a8a2a17c11d3ffe2440e3750218c12571b1415b63b884c5be36a98640198e0c7

SHA512
44435e002820b71e0f1ce90e019f2368833f2d15b6cc9fd085975eac3b1e894d1125fcc118b1be528963d3fecf07b0326a8de838c7ae8dc18e7e24a6c47f5154

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8a682394e82663a432f21368e1cba2b

SHA1
526edc3b0abce86a2eebec6c7f241029eb27e620

SHA256
a250430444da5922292869d999bf2edfcacaea21d99d452226b31b260f5f5f68

SHA512
4c9bf41e8921630bdcb86a5b8682ea4ebda04735f724c0fff2237203b9593f4946883828e38e3c4859d581bf8842fe58b341a4b28cab52d4e8a1e5de00f78a3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d12d188429cbc7fcf97c94bb59d442ca

SHA1
2e05dc7b87a00cd270aadf9fdd9f608c9c513315

SHA256
c39a48704413a909ad1a0c32ee28ff2ccf429894c7aa7e0562ade54bec727ed4

SHA512
0a61ea43d467f94d07d667692ae5aa87bb64271c86764481dd2bbfeb7a08b6887ea97aa23a0ef6ce328fbc244bfa4554a3c7be3235752f5152bd20298924edb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5000166c8e49419a494973b572b27d0e

SHA1
f37f93b91502399bdd43502c4849a92cd16699f1

SHA256
83eaecffe6cc871cc415d6a66cc18a11f7db7a356c866125963091b8982e817f

SHA512
f32af43a2379a777807689fa4174039dd9f69b4849e8dd03e2bd8f69e088672d4d56cbda9575947fe2fab79ce0eda7e6757cdd1284a6040518107ced71e20eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19432552cdf2825ccb5e733e204062ef

SHA1
114e0925d9f2fb6cff49cabd3d5e7fccc0638d42

SHA256
39fe5e8d694e63212fd0bbc7fbde62587ce6f6c10868ba4efd8197479914f729

SHA512
60e1c2bbc342fc6ba89d5d0495ced343c1f168110abd89d38f75f7f1cbda546fce859a1d9800886de80ee98343ea6ac27213685b32b0ba30f02cb5455ae5ff5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcc06d67cf89a5897b7a24f868bb15d0

SHA1
12b2f741a565578456a2791925c14aee9ff96932

SHA256
2cba1ac805dacb5f1b71e2bf36575b607db5f2b1c416398c665bc202ae15a49b

SHA512
f7903a6e5d737b8c3b2ffe72a36729fe5e786c2f885995bd98fbd140db0c27631a57b7f9711a5d505dce9fb1c8dec1107025fe716610e0d479559802a3d61038

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1be12e85c2c00a8f42b02b239eb78f01

SHA1
c4e9e4b46f76b73271fd08d1ea2fa5f02374c71f

SHA256
98f6a0d6bd43396f8efbea3f27c33f4222be21ed235d4ea0bea72038306f86cc

SHA512
e8b3fe0d38101bae88ac9d49fdab83763b87bf3cb3a17d216727b774944e26b7c0c4ae8bc12784c9148869f991b2b64f6267fa732b1ea82d98f28abfb2f0823f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7499c5ec47afa9bdc972107d3ea82723

SHA1
d4a39c8f9f87ee30c55877d9fb151b4040e2c90b

SHA256
43da25f5ee16bd8be6bb9f8e29931e03d82f3b75027e48d135c53685a405dd0d

SHA512
e7c401969750aef8ab9750f03e47f7834ec48eda6aa5fc31024d65995ec967d4757a061ae9b60e96566024b28e362ef8e6a88e08594376bfa297b13dd7312928

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67c17fd11da7e70606ca35c75b888125

SHA1
3334ba35c4be20ade67ce443fa50928546145583

SHA256
66a483605cf41b3c74cf1bff3d4bc6e72734b0c7feca3d945f70215271c30f62

SHA512
838362da13fc71b2c4e6ce9ba969217e4bec22fd564caeff9a9532af2e12c8e2ce78107671f400bb677fb05f6fde2bb8cc88bff5bab6dfd21d19e64bbe175e9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fcd1de7b387a140a055ed0861b6583c

SHA1
1e0e2ef9b512765db9f4caf8127ac7732084cb9e

SHA256
f76e00f92b8e8bfa3330c32c304bf36eba78d76c05eae6f7644e72c3c030594f

SHA512
d4daae45d96d32aa4133ff403f1e11bc42e9e6ffb831439c06af71658b7bb9ec0c7c931793060ed6aea939f3981b8d7c5343360fca53f5bc8a7e1921f156631f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86d3dae2e9c5b4a512a73092d5ac2cd7

SHA1
89da95c565fada7579891073709417225c306d25

SHA256
a69c515b491f08055d804b3b2af9e42b8da2788638d130ee3f1cb0a33566bc6f

SHA512
700c95f80a3be43ccb4e7e42e6547a35f4ae50925a3ebfa14dd0f23401efbb776f77cd52f44b4a4e5b4cda803b164cd51032fa94e7a2fbb65d130fa6bd355e7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99437f0e240a6125bd2ce68e1e3210ea

SHA1
9782fe6e937ae11d21044fb6a96bca559418630a

SHA256
31f61171038733dd3dd5e286e32b77d0a0aaf09927e6fc828c219d9eca8cb45e

SHA512
906247e9b9613d11cc363e586c50f7569d4c1211b05a9b81ad3b3fa6a4ca9569d7a11527e8708dbe3e1fc10ef842e393daa2039324c0f5e30b622ddd3ac08bcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbdd0c25799088bda960d4851c309117

SHA1
28a47762e194747908e05d207efd6ebe28454ee8

SHA256
98a476cbdf65e89ded6a782320a9d5af7860227fcbb928102b8647a48c760c65

SHA512
44d1d0a7ec7fbb536b67ce0104b0f45a8fdfbfc7fb39d913fe32d93df24801942cf84d701f6a0b77178eeee97b986eaa31bf1e43321e24c9b028e882eee39dc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a1205c40603b02d02f189f22e921617

SHA1
5e350c4448a1f0774ad0cc5c51dbf69bda819de9

SHA256
d69e0a3b81a2b3a2c6b87c9bf866174f1c8ae6b48194a9f3bc7f239edcbdcdd9

SHA512
b1bd0eae542d9aa2cf737c94ea280a88330d18233059c8c05046c7207db6dce65b3ca350cfa0fb90ff2001229160a42ec624c3081e19039fde751e8771522b58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef8d9356167dd1c9db2cbf5bc8b51171

SHA1
476564f8e363eded9fbd06343c81a4ae5dd78ed7

SHA256
9f97d1e717df11f6a9f7459d6af7275863adef134bf1a3bcee2ddbbed6fd932d

SHA512
c17d8ee9ab37fd373ed1d90a237422a66d2979440ef8038b7a473e157a4345f77bde0050bd2943067f3dc1ed9df08a19e03d8430d7842d59faf30a649c1fcd69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78770fb01d2ce2db2dc0a9ddeee2c4e2

SHA1
0b4e005eca591047db33903644b33425b8449cce

SHA256
48de15b95119606270a7ced6d2f6b47f2409255307e979723b989526b62e3785

SHA512
5786b7e75fdca52bd5153df2c3531356e5dfd0a91b905d458f1c46984e6effca050d774129d54ed30b61a80d6482cb575f8fc349aea6b59ab3bd88ff4f3678d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b40fa440f9d2ee02d0bb87cbf3bdf02

SHA1
bf08efffffa74a8e69630930a6858e11ace0daaf

SHA256
61303725731e913b0382c8c7ab32ac1e9aface364c8b7f6578460ef705029103

SHA512
4590e4af1ba1da6ce2d3764481fa30302642ab261e01a7f56bbc69480098701b47d3c540bc24f0893141598864ce911b66ca8191ad11f503ea4ec321a4b75b67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WUBCGJ0A\favicon[1].ico

Filesize
94B

MD5
514eb157c352678fe6e6ffb103579bfa

SHA1
5892249a4b53845b0761623aefa1c0d251ccf7da

SHA256
5e0f936c52cb1e65ccda6fe580472f66166fa4687aeb931c2f0b25bf8c858daf

SHA512
91832b7b508d3386e65bea57a42c5b8af73f5cee55efa0b05ffb8dc9a60473cec718f2d28a9d8c7420ae92ec6ba43a1df598541571ffed4726a61fa4b8703edc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF0F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF81.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\SysWOW64\ts.exe

Filesize
960KB

MD5
a62e0ebefc894cbb76b262eeaa6c6759

SHA1
1afbd81df4975de9c8fe9bc3dedefffbd65c46f8

SHA256
e57f4cd1f8461107e7631e83b9156fcfbe432717fae1685e2b91af0bb2c088f6

SHA512
f648559ae5b4b5b9bb533e2a7a746e0de9b058b6024143d93a7279fe92a208522e6380f0104fc906beae9282bf049edd62ec17a76d6bbdda2b55302ae039fade

Download Submit
\Windows\SysWOW64\DNFÊäÈë·¨.ime

Filesize
52KB

MD5
b60da4e2e5aceba3ce3d87ee2cd872ee

SHA1
9bbdbf1f3ce2c000a86e0473da756a4b1031db41

SHA256
b581fcc82c0462d60286a80912ab2ce5aca7d7b11c5cff0b5f74716dbb7dc453

SHA512
664d6f893484252b339ff8f413a4cf9da9b0ef82ed74b097ba86a5f00b4d9740eef6e8a5b81e8be7e82ae4009928097baf15e65a03f31c4b92e44f593ce39874

Download Submit
memory/2964-984-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2964-986-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2964-982-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2964-548-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2964-983-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2964-546-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2964-985-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2964-981-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2964-987-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2964-988-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2964-547-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2964-73-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2964-544-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2964-545-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/3040-28-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-70-0x0000000003820000-0x0000000003971000-memory.dmp

Filesize
1.3MB

Download
memory/3040-72-0x0000000003820000-0x0000000003971000-memory.dmp

Filesize
1.3MB

Download
memory/3040-57-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/3040-56-0x0000000000400000-0x0000000000824000-memory.dmp

Filesize
4.1MB

Download
memory/3040-6-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-7-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-8-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-9-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-10-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-12-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-14-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-410-0x0000000000400000-0x0000000000824000-memory.dmp

Filesize
4.1MB

Download
memory/3040-16-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-18-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-20-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-22-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-24-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-26-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/3040-30-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-34-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-36-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-38-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-40-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-42-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-44-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-46-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-48-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-51-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-52-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-54-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-55-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-53-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-32-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-4-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/3040-2-0x0000000000400000-0x0000000000824000-memory.dmp

Filesize
4.1MB

Download
memory/3040-0-0x0000000000400000-0x0000000000824000-memory.dmp

Filesize
4.1MB

Download