8331e6ebc0e5a97a1a1d5a0f1d6bfe0b8e8d474b7f2ddbac3470535274c8f15c

Analysis

max time kernel
149s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 18:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f0645e5b020817c4c8a3ed44cce7a132_JaffaCakes118.exe
Size

160KB
MD5

f0645e5b020817c4c8a3ed44cce7a132
SHA1

b07d768f689b7b81f13c39fd775ae313ed70cce0
SHA256

8331e6ebc0e5a97a1a1d5a0f1d6bfe0b8e8d474b7f2ddbac3470535274c8f15c
SHA512

09eed4d605a2dc8b1789be84e692c38e67c2ca5f53e8adc468b5db30c71e3143c4df33ff22d0d9223a64cdea4df97645c93305d33ad50e6fb4477ff80a254327
SSDEEP

1536:+DyIKCj8jmMnWM0AFiEoznntjHJ0tI+I6edPgl+mMLky+s:wv9YmbM0AFiTMoYiX

Score

8^/10

defense_evasion discovery evasion persistence

Malware Config

Signatures

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
640	attrib.exe
2308	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	f0645e5b020817c4c8a3ed44cce7a132_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	inlD7DF.tmp

Executes dropped EXE 1 IoCs

pid	Process
4308	inlD7DF.tmp

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hsdfasd = "\"C:\\Users\\Admin\\AppData\\Roaming\\redload\\tmp.\\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}\" hh.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe
File opened for modification	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f0645e5b020817c4c8a3ed44cce7a132_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runonce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	inlD7DF.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "155752108"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31132756"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31132756"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31132756"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31132756"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3499E6A0-7847-11EF-818E-F2CBF1DCE4A5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "156689175"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "156689175"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "155752108"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.71628.com/?s"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.71628.com/?s"	reg.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\IsShortCut	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command\ = "wscript -e:vbs \"C:\\Users\\Admin\\AppData\\Roaming\\redload\\3.bat\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command	reg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4044	f0645e5b020817c4c8a3ed44cce7a132_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	4308	inlD7DF.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2292	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2292	iexplore.exe
2292	iexplore.exe
4744	IEXPLORE.EXE
4744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 3640	4044	f0645e5b020817c4c8a3ed44cce7a132_JaffaCakes118.exe	91
PID 4044 wrote to memory of 3640	4044	f0645e5b020817c4c8a3ed44cce7a132_JaffaCakes118.exe	91
PID 4044 wrote to memory of 3640	4044	f0645e5b020817c4c8a3ed44cce7a132_JaffaCakes118.exe	91
PID 3640 wrote to memory of 4500	3640	cmd.exe	93
PID 3640 wrote to memory of 4500	3640	cmd.exe	93
PID 3640 wrote to memory of 4500	3640	cmd.exe	93
PID 4500 wrote to memory of 2292	4500	cmd.exe	95
PID 4500 wrote to memory of 2292	4500	cmd.exe	95
PID 4500 wrote to memory of 4492	4500	cmd.exe	96
PID 4500 wrote to memory of 4492	4500	cmd.exe	96
PID 4500 wrote to memory of 4492	4500	cmd.exe	96
PID 4500 wrote to memory of 1088	4500	cmd.exe	97
PID 4500 wrote to memory of 1088	4500	cmd.exe	97
PID 4500 wrote to memory of 1088	4500	cmd.exe	97
PID 2292 wrote to memory of 4744	2292	iexplore.exe	99
PID 2292 wrote to memory of 4744	2292	iexplore.exe	99
PID 2292 wrote to memory of 4744	2292	iexplore.exe	99
PID 1088 wrote to memory of 3232	1088	cmd.exe	100
PID 1088 wrote to memory of 3232	1088	cmd.exe	100
PID 1088 wrote to memory of 3232	1088	cmd.exe	100
PID 1088 wrote to memory of 2724	1088	cmd.exe	101
PID 1088 wrote to memory of 2724	1088	cmd.exe	101
PID 1088 wrote to memory of 2724	1088	cmd.exe	101
PID 1088 wrote to memory of 1472	1088	cmd.exe	102
PID 1088 wrote to memory of 1472	1088	cmd.exe	102
PID 1088 wrote to memory of 1472	1088	cmd.exe	102
PID 1088 wrote to memory of 2232	1088	cmd.exe	103
PID 1088 wrote to memory of 2232	1088	cmd.exe	103
PID 1088 wrote to memory of 2232	1088	cmd.exe	103
PID 1088 wrote to memory of 4448	1088	cmd.exe	104
PID 1088 wrote to memory of 4448	1088	cmd.exe	104
PID 1088 wrote to memory of 4448	1088	cmd.exe	104
PID 1088 wrote to memory of 640	1088	cmd.exe	105
PID 1088 wrote to memory of 640	1088	cmd.exe	105
PID 1088 wrote to memory of 640	1088	cmd.exe	105
PID 1088 wrote to memory of 2308	1088	cmd.exe	106
PID 1088 wrote to memory of 2308	1088	cmd.exe	106
PID 1088 wrote to memory of 2308	1088	cmd.exe	106
PID 1088 wrote to memory of 4464	1088	cmd.exe	107
PID 1088 wrote to memory of 4464	1088	cmd.exe	107
PID 1088 wrote to memory of 4464	1088	cmd.exe	107
PID 1088 wrote to memory of 4356	1088	cmd.exe	108
PID 1088 wrote to memory of 4356	1088	cmd.exe	108
PID 1088 wrote to memory of 4356	1088	cmd.exe	108
PID 4464 wrote to memory of 3504	4464	rundll32.exe	109
PID 4464 wrote to memory of 3504	4464	rundll32.exe	109
PID 4464 wrote to memory of 3504	4464	rundll32.exe	109
PID 3504 wrote to memory of 2772	3504	runonce.exe	111
PID 3504 wrote to memory of 2772	3504	runonce.exe	111
PID 3504 wrote to memory of 2772	3504	runonce.exe	111
PID 4044 wrote to memory of 4308	4044	f0645e5b020817c4c8a3ed44cce7a132_JaffaCakes118.exe	110
PID 4044 wrote to memory of 4308	4044	f0645e5b020817c4c8a3ed44cce7a132_JaffaCakes118.exe	110
PID 4044 wrote to memory of 4308	4044	f0645e5b020817c4c8a3ed44cce7a132_JaffaCakes118.exe	110
PID 4044 wrote to memory of 3780	4044	f0645e5b020817c4c8a3ed44cce7a132_JaffaCakes118.exe	113
PID 4044 wrote to memory of 3780	4044	f0645e5b020817c4c8a3ed44cce7a132_JaffaCakes118.exe	113
PID 4044 wrote to memory of 3780	4044	f0645e5b020817c4c8a3ed44cce7a132_JaffaCakes118.exe	113
PID 4308 wrote to memory of 3468	4308	inlD7DF.tmp	115
PID 4308 wrote to memory of 3468	4308	inlD7DF.tmp	115
PID 4308 wrote to memory of 3468	4308	inlD7DF.tmp	115

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
640	attrib.exe
2308	attrib.exe

C:\Users\Admin\AppData\Local\Temp\f0645e5b020817c4c8a3ed44cce7a132_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f0645e5b020817c4c8a3ed44cce7a132_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\s_Mg_l_219.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3640
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\redload\1.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4500
  - - C:\PROGRA~1\INTERN~1\iexplore.exe
      C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://www.cnkankan.com/?71628
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2292
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:17410 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4744
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\redload\1.inf
      4⤵
      System Location Discovery: System Language Discovery
      PID:4492
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\redload\2.bat
      4⤵
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1088
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.71628.com/?s"" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:3232
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.71628.com/?s"" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:2724
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\tmp" /v "key" /d ""http://www.71628.com/?s"" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1472
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2232
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\redload\3.bat""" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4448
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\redload\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}
        5⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:640
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\redload\tmp
        5⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2308
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\redload\2.inf
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4464
      - C:\Windows\SysWOW64\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        6⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:3504
        
        C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2772
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 D:\VolumeDH\inj.dat,MainLoad
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4356
- C:\Users\Admin\AppData\Local\Temp\inlD7DF.tmp
  C:\Users\Admin\AppData\Local\Temp\inlD7DF.tmp
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\inlD7DF.tmp > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3468
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\F0645E~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
ba5272488c731e383b4533d3012739c4

SHA1
92b90312575c98fd0397405c3243749ded02c09f

SHA256
edef86ccf6698ef9998425a9a7ae5498253c0ab740957764e187a81853f66a82

SHA512
5aef3b6102906041b2ea3c72fc27064080d90e5ebdd1da743d40e84dda1f897d5230d7e263b98830f960f2a0b154fc664215311bbac880139a1a3aedda2f45d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
0bac12cff46df657308f5a087ac77352

SHA1
23ab6ff6a4235b17c582e3b874166180a21a2632

SHA256
f61adfc27c9924cc2fbae10c9a2584271683de14b19bf00fde8c9dbadb811364

SHA512
661b1a7570643e95b92149dc84081cb8ed9359ffeb14d0273f75e10ab66a649137474f89c6ce278277ed722e762de5cdb58a521acfd55ea7476b1cecec45a4bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver5162.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VDS6YA2E\favicon[1].htm

Filesize
802B

MD5
b4f7d6a0d3f6605440a1f5574f90a30c

SHA1
9d91801562174d73d77f1f10a049c594f969172a

SHA256
e3b1510526757baa753c916ababce951be64146e04f74c631c6503531d83c6cd

SHA512
c852ff3b51db00184bcfb0d6609a2791cb81efdb0d8d5aaed1c5b9e576b17b19804affe6ea7b5db575179c166543db5dcd828b3fcbd90e8baabb47c166da7c3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\360mohesetup.exe

Filesize
88B

MD5
bcd8edb015ddc9e31e8e1b4657c3df43

SHA1
d320e044bc0ed73e557a885a1a47714b8c85200e

SHA256
37646c67c0e8429e6fbfc56678a20fd311cb48d0cb19bb5097078968f0673f37

SHA512
2a1497b35930c516a0f5bf75be460eff986b08d2ed0331dd702be5533b88198a59a41f39252809ef83b455bcf4d07ab0d9723494e8008a9578d0509a643cd6cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

Filesize
790B

MD5
b18422bf438bbb7798280375a7bc0976

SHA1
c1b77b35e3a38ff2ad119f25e548beb5ff68c2e2

SHA256
ee8709e751067193dccdfe218108bdae6a30919d7b6c860bc848c7cc4b242fa4

SHA512
23cb9c74905f514a2bf4ef91afc53ceb08230b3ce68e3eab17bb36c674260d143a7e7105958ff4ed5c2a416bddffb3c7e28dcf8060cbf323c7e4cab71f613176

Download Submit
C:\Users\Admin\AppData\Local\Temp\s_Mg_l_219.bat

Filesize
54B

MD5
504490369970f1c0eb580afbcdf91618

SHA1
b52f65cd538e6c998b2c7e3167f9c8e8fa6c7971

SHA256
a13a0579286521f0d7cb55fc7d28c6d33f14c0573e9e69f7584fa4008a8e7d43

SHA512
5495ce79abf0fc4ffbfaf9aefa484145f4e0d3e8457be0e2e4dfb1284fb5413016f2d9867e2386db5c4f7b51863bfffeae8ea6bd879053fdf6a928ab2a0857ad

Download Submit
C:\Users\Admin\AppData\Roaming\redload\1.bat

Filesize
3KB

MD5
3ffe7d55ea414adb988346925764a4a3

SHA1
3899a90cc844e7b170898936a1502f6ce0e88aa1

SHA256
e0ed46a071106638ba9b1d6f527c1595a948381ef521e9e27cae56cc43eef43c

SHA512
53f482913b9f563e190fc84693b3b41491f6c0248e6148a21ee4355174466d4b3a1f3b1e31e54d22443dd6653e333cc8c818ad4de1f9627024e2a476785d3590

Download Submit
C:\Users\Admin\AppData\Roaming\redload\1.inf

Filesize
362B

MD5
20b164889086c50e2be7e83799886b88

SHA1
e813f0d19584247fb44151ea97a212197c9b7828

SHA256
76b4794f3b5e9efa322ee0683977f1646501b441f286b89239fddf2c0c2d2fc3

SHA512
9ec551ba8254597ab09c733715a26b39c475503a40f020636e8ad727e5ef6cd3bf880d937a8970c36fdd9ed9c2dd3dccb127deef0991fad50eb5b83b38417d79

Download Submit
C:\Users\Admin\AppData\Roaming\redload\1.inf

Filesize
410B

MD5
66a1f0147fed7ddd19e9bb7ff93705c5

SHA1
9d803c81ea2195617379b880b227892ba30b0bf6

SHA256
4f45ce85e221352f7fe26e04968c7f7267dc24b55cf2b72b929b4c90e48cb764

SHA512
cfe51756ddec75d240249980a4d27870d15983add25058e4d0da4d8a3ea11384d4d228d6cbc95091f91e516e1ab4dfb1e315941dbd95bf717d4b31936311d597

Download Submit
C:\Users\Admin\AppData\Roaming\redload\2.bat

Filesize
3KB

MD5
54f23ec52c44483a7bce2706048c80f3

SHA1
2a32a29bc1270ec194ad2faa14007881fab037b7

SHA256
e3364764e027ef1df04b89961ceee6326cab364a7bc03c7b7002e9b6a8a94ce7

SHA512
d8492a687cd65629551b32c3a64ef4dcc61d31635d83d60bddebf7a4f9bfaa0b97c2bc91a53eb801fa65f1c795a3bb37f1534c8cd941f073f8b310520494d637

Download Submit
C:\Users\Admin\AppData\Roaming\redload\2.inf

Filesize
248B

MD5
2197ffb407fb3b2250045c084f73b70a

SHA1
3d0efbacba73ac5e8d77f0d25d63fc424511bcf6

SHA256
a1a42f5a41ce65135b1ad525eabc04cce89ee07d2f51d06e5e1dea6047081591

SHA512
b35a99e144da3f02de71158f58a6b937435d1bce941126a554783c667654b880527b11ba8a5c0fcf093ce28863ea4f5e60f73f8f973a727f177d584d2e9c80fe

Download Submit
C:\Users\Admin\AppData\Roaming\redload\4.bat

Filesize
5.8MB

MD5
4c3e8024e0cebb573b4208dd8cf80124

SHA1
ac6a42ee517e22632b6527bc670d495487fcd44a

SHA256
75688ed06dbf70082faa2ee8daab11aafe43c96b849d12d98a4790bd1a8281ea

SHA512
f8551b7a9527f50a5c40b7859c886b5a328f7e9806c623a65c9e0ec0ab5775689cde6e6a21001acf1ef97b3deed839a6a9aa0c62cb7cdbcfb04d15f72c2a6302

Download Submit
memory/2292-60-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-107-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-86-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-78-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-76-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-87-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-89-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-88-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-85-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-83-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-82-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-84-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-71-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-70-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-69-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-68-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-66-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-64-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-61-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-75-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-58-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-56-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-55-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-102-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-106-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-80-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-108-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-110-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-111-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-116-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-120-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-121-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-124-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-122-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-119-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-118-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-59-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-62-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-63-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-72-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-152-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-154-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-156-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-159-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-158-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-160-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-157-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-153-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/2292-73-0x00007FFB70320000-0x00007FFB7038E000-memory.dmp

Filesize
440KB

Download
memory/4044-130-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4044-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4044-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads