c30169e2400cbd8cb0944b98f519508b7c7c23b9a5aa42ef25713c5c6ffa236e

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-09-2024 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Size

2.0MB
MD5

f660f8a8edb2b437363c590420ae04c1
SHA1

980e4dc7cc60282b3cd99a97eaa47073783371ed
SHA256

c30169e2400cbd8cb0944b98f519508b7c7c23b9a5aa42ef25713c5c6ffa236e
SHA512

d38ddaf2f940be37d9c38a4255110a6621e6ab0bfac9622507899af2b6f43b1d1bf5bd6c243174ec35f63cdb0af514af71f5658bfc013fd77b908f4ed912dfea
SSDEEP

24576:x5b8rFrYRFS7Iid6Nx7izcFsaWrtLTOITQA6kOStpbspT63cGnJ/2aDZM/2YH7Xo:crFrZDd6ziVTOITQAOpT63cGnJ/WbJfy

Score

7^/10

adware discovery evasion stealer trojan

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2728	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
1332	ietheword.exe
2508	Loader_forqd318.exe

Loads dropped DLL 4 IoCs

pid	Process
2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ietheword.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File created	C:\Program Files\Alisoft1\Internet Explorer\desktop.ini	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
File created	C:\Program Files\Alisoft1\È¥ÌÔ±¦ÌØÂô\desktop.ini	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
File created	C:\Program Files\Alisoft1\ºÃÍæÐ¡ÓÎÏ·\desktop.ini	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files\Alisoft1\Internet Explorer\desktop.ini	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Alisoft1\È¥ÌÔ±¦ÌØÂô	attrib.exe
File created	\??\c:\program files\C07116A0\Loader_forqd318.exe	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
File opened for modification	\??\c:\program files\ieworld\ietheword.exe	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
File opened for modification	C:\PROGRA~1\ieworld\theworld.ac	ietheword.exe
File opened for modification	C:\program files\ieworld\ietheword.ini	ietheword.exe
File created	C:\program files\ieworld\ietheword.ini.tmp	ietheword.exe
File opened for modification	C:\Program Files\Alisoft1\Internet Explorer	attrib.exe
File created	C:\Program Files\Alisoft1\ºÃÍæÐ¡ÓÎÏ·\target.lnk	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Alisoft1\ºÃÍæÐ¡ÓÎÏ·	attrib.exe
File created	\??\c:\program files\ieworld\ietheword.exe	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
File created	C:\PROGRA~1\ieworld\twcache.ini	ietheword.exe
File opened for modification	C:\PROGRA~1\ieworld\twcache.ini	ietheword.exe
File created	\??\c:\program files\ieworld\ietheword.ini	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
File created	C:\PROGRA~1\ieworld\theworld.ac	ietheword.exe
File created	C:\Program Files\Alisoft1\ºÃÍæÐ¡ÓÎÏ·\desktop.ini	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
File created	C:\Program Files\Alisoft1\Internet Explorer\target.lnk	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
File created	C:\Program Files\Alisoft1\È¥ÌÔ±¦ÌØÂô\desktop.ini	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
File created	C:\Program Files\Alisoft1\È¥ÌÔ±¦ÌØÂô\target.lnk	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\javalava.dll	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
File opened for modification	C:\Windows\javalava.dll	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader_forqd318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ietheword.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\ietheword.exe = "0"	ietheword.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\ietheword.exe = "1"	ietheword.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION	ietheword.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_INTERNET_SHELL_FOLDERS	ietheword.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	ietheword.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	ietheword.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE	ietheword.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\ietheword.exe = "1"	ietheword.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_INTERNET_SHELL_FOLDERS\ietheword.exe = "0"	ietheword.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	ietheword.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	ietheword.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT	ietheword.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\oyfile\shell\open\command\ = "explorer \"C:\\Program Files\\Alisoft%S\\Internet Explorer\""	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\otfile\shell\open\command\ = "explorer \"C:\\Program Files\\Alisoft%S\\È¥ÌÔ±¦ÌØÂô\""	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ogfile\DefaultIcon\ = "%1"	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}\ = "Java (TM)"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}\ProgID\ = "javalava.Java (TM)"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.iy\ = "oyfile"	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\oyfile\DefaultIcon	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\otfile\DefaultIcon	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\otfile\shell\open\command	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\otfile\shell\open	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ogfile\shell	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\javalava.Java (TM)	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\javalava.Java (TM)\Clsid\ = "{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\otfile\DefaultIcon\ = "%1"	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ogfile	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ogfile\shell\open	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ogfile\shell\open\command	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\javalava.Java (TM)\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\oyfile	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\oyfile\shell	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.it	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ogfile\DefaultIcon	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ogfile\shell\open\command\ = "explorer \"C:\\Program Files\\Alisoft%S\\ºÃÍæÐ¡ÓÎÏ·\""	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.iy	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ig\ = "ogfile"	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}\InprocServer32\ = "C:\\Windows\\javalava.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8DFD7EF6-AAF8-4C8F-A14F-FC93EB592B78}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\otfile	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.it\ = "otfile"	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\oyfile\DefaultIcon\ = "%1"	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\oyfile\shell\open	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\oyfile\shell\open\command	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\otfile\shell	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ig	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\javalava.Java (TM)\ = "Java (TM)"	regsvr32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1332	ietheword.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1332	ietheword.exe
1332	ietheword.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1332	ietheword.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1332	ietheword.exe
1332	ietheword.exe
1332	ietheword.exe
1332	ietheword.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 1332	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	30
PID 2124 wrote to memory of 1332	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	30
PID 2124 wrote to memory of 1332	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	30
PID 2124 wrote to memory of 1332	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	30
PID 2124 wrote to memory of 2916	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	33
PID 2124 wrote to memory of 2916	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	33
PID 2124 wrote to memory of 2916	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	33
PID 2124 wrote to memory of 2916	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	33
PID 2124 wrote to memory of 2472	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	35
PID 2124 wrote to memory of 2472	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	35
PID 2124 wrote to memory of 2472	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	35
PID 2124 wrote to memory of 2472	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	35
PID 2124 wrote to memory of 1848	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	37
PID 2124 wrote to memory of 1848	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	37
PID 2124 wrote to memory of 1848	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	37
PID 2124 wrote to memory of 1848	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	37
PID 2124 wrote to memory of 788	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	39
PID 2124 wrote to memory of 788	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	39
PID 2124 wrote to memory of 788	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	39
PID 2124 wrote to memory of 788	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	39
PID 2124 wrote to memory of 788	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	39
PID 2124 wrote to memory of 788	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	39
PID 2124 wrote to memory of 788	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	39
PID 2124 wrote to memory of 2508	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	40
PID 2124 wrote to memory of 2508	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	40
PID 2124 wrote to memory of 2508	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	40
PID 2124 wrote to memory of 2508	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	40
PID 2124 wrote to memory of 2728	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	41
PID 2124 wrote to memory of 2728	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	41
PID 2124 wrote to memory of 2728	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	41
PID 2124 wrote to memory of 2728	2124	f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe	41

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2916	attrib.exe
2472	attrib.exe
1848	attrib.exe

C:\Users\Admin\AppData\Local\Temp\f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f660f8a8edb2b437363c590420ae04c1_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2124
- C:\program files\ieworld\ietheword.exe
  "C:\program files\ieworld\ietheword.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1332
- C:\Windows\SysWOW64\attrib.exe
  attrib +s "C:\Program Files\Alisoft1\Internet Explorer"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:2916
- C:\Windows\SysWOW64\attrib.exe
  attrib +s "C:\Program Files\Alisoft1\È¥ÌÔ±¦ÌØÂô"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:2472
- C:\Windows\SysWOW64\attrib.exe
  attrib +s "C:\Program Files\Alisoft1\ºÃÍæÐ¡ÓÎÏ·"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:1848
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 "C:\Windows\javalava.dll" -s
  2⤵
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:788
- \??\c:\program files\C07116A0\Loader_forqd318.exe
  "c:\program files\C07116A0\Loader_forqd318.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2508
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\pipiuni.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\ieworld\ietheword.ini

Filesize
8KB

MD5
e3ff8d3cfdc159555abb8abe9834f611

SHA1
61e5c3f58bc97d63658f5927584bd073942ba053

SHA256
7af6ad94dc99df502aece61da80b7394f4fd44cec7bab9b43adacd7f723bf013

SHA512
86acc0da236344987065f12456097a634b478274fea38ac7cb12a1b5426edcc5fa3d82188964f83d04fe9a792b332f570c794deca34855d7ff300f7041cc7f49

Download Submit
C:\Users\Admin\AppData\Local\Temp\pipiuni.bat

Filesize
144B

MD5
e15e44a1859820fe7b917924cde4a492

SHA1
b7535f140b074a4d95e2c5e44e57aee004a832f9

SHA256
15c980faa0b5beab97c1e1edb62989417118806e3aae0707e4867d786377857c

SHA512
d6c04133d4233fe5da7fc8c962a77170a37b21750683a7a9f5ec92542b7b5a65915f7675ae317d559fc304de6e50622742263c7010f69e33dcaae01b850c18ac

Download Submit
C:\Windows\javalava.dll

Filesize
435KB

MD5
e3a178e006345581884d4b5dcd378605

SHA1
b869aa851a42aca6464938223b9afcbe5e10c639

SHA256
432b0371537c8ba6053db8184cb65d36da91010c94147a97381e33eda8becb9e

SHA512
85c751031223d07fe10be9d2c666836894526e2bcaeea8de48301a5ce5c462dc893272f57d7f8c49e805dbbaffd6594f78417cadbf3fb636d7798f4d7560a72b

Download Submit
C:\program files\ieworld\ietheword.ini

Filesize
8KB

MD5
7c5c7ef31c01be7dc9aab07197d59052

SHA1
1732f6eab1f5727362bbb25028afd760f777c770

SHA256
bfdb19348faace85b8eb971be8e6329a8defa94b7158bb0b32b274b09494077d

SHA512
0c3c0e648750df08041d555e843599375440c4762ceb2650d73a97868709a326b47c352decd79e5a5b44b604ed3cb28c46f41c8fa6bea9272a9ae0de68d3f5a9

Download Submit
\Program Files\C07116A0\Loader_forqd318.exe

Filesize
65KB

MD5
bef14d54106a5129182af8b04747adbf

SHA1
01fa77e1237e29f938b4c5d703946a559b2e563c

SHA256
49b6779a2221ee3658da0f906b26843b65826cfdf8263b2e438b43467259c603

SHA512
c304fb79824d8bfe30f927afed9abcc5d8b3349a1f2fd29f7b9d129918e42eeb84ab7c1fd9492c442bc50f6a047609843d8fbe3c59e02d1e58dcbbbaf0b9bea2

Download Submit
\Program Files\ieworld\ietheword.exe

Filesize
1.4MB

MD5
a1272a8305fa1f55de6701e9048a60f0

SHA1
90c5def58931ff14c84bba3826bff0aa065faea5

SHA256
3fc7c2588ebbadc9ef4710e936f44230a1147dfaa8d562fe3b6035ad5ffbbb6c

SHA512
510d2e2ac7cfd6930ac3a5ff9aa93df65795473de884162289edc6930315e93648b7cceedf7090a47025bcc0efb1497917441ba5023f459943b217992444eff2

Download Submit
memory/788-110-0x0000000002180000-0x00000000021F2000-memory.dmp

Filesize
456KB

Download
memory/1332-65-0x0000000074AE0000-0x0000000074B52000-memory.dmp

Filesize
456KB

Download
memory/1332-66-0x0000000077200000-0x0000000077324000-memory.dmp

Filesize
1.1MB

Download
memory/1332-20-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1332-13-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1332-58-0x0000000074B60000-0x0000000074B92000-memory.dmp

Filesize
200KB

Download
memory/1332-60-0x00000000751E0000-0x0000000075280000-memory.dmp

Filesize
640KB

Download
memory/1332-61-0x00000000763C0000-0x00000000763F5000-memory.dmp

Filesize
212KB

Download
memory/1332-19-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1332-64-0x0000000076160000-0x0000000076324000-memory.dmp

Filesize
1.8MB

Download
memory/1332-62-0x00000000764B0000-0x00000000770FA000-memory.dmp

Filesize
12.3MB

Download
memory/1332-63-0x00000000756B0000-0x000000007580C000-memory.dmp

Filesize
1.4MB

Download
memory/1332-21-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1332-75-0x0000000076160000-0x0000000076324000-memory.dmp

Filesize
1.8MB

Download
memory/1332-77-0x0000000077200000-0x0000000077324000-memory.dmp

Filesize
1.1MB

Download
memory/1332-74-0x00000000756B0000-0x000000007580C000-memory.dmp

Filesize
1.4MB

Download
memory/1332-14-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1332-16-0x0000000004AE0000-0x0000000004AE2000-memory.dmp

Filesize
8KB

Download
memory/1332-15-0x0000000075AD4000-0x0000000075AD5000-memory.dmp

Filesize
4KB

Download
memory/2124-111-0x0000000000400000-0x0000000000610000-memory.dmp

Filesize
2.1MB

Download
memory/2124-96-0x0000000000400000-0x0000000000610000-memory.dmp

Filesize
2.1MB

Download
memory/2124-56-0x0000000000400000-0x0000000000610000-memory.dmp

Filesize
2.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads