Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
27-09-2024 20:19
Behavioral task
behavioral1
Sample
fad8f37c9bd5420f49cfd5960a60fa24_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
fad8f37c9bd5420f49cfd5960a60fa24_JaffaCakes118.exe
Resource
win10v2004-20240910-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
fad8f37c9bd5420f49cfd5960a60fa24_JaffaCakes118.exe
-
Size
224KB
-
MD5
fad8f37c9bd5420f49cfd5960a60fa24
-
SHA1
6c97f91f77e44fd7ada5d09e2bed16744a3efcc3
-
SHA256
b41747714910cee5eb306f61dfa61dd5c3c72450a60fc36280b8d7fd0643b54b
-
SHA512
e93ead6e855994c1024dba6a259b1630d6d247f639887877b8d47ddf4c7f42809fe903d4f185956f9f8b12b18bcd27d38b1c0c0ca87a4c7fc5d0056b226121a2
-
SSDEEP
3072:t78yHpYetDrHNsbqrf29rGHWwsMr7w2nu+PpAgxs9D/sv9Z:t78yHp9rQ85RZr0ku+cD/cZ
Score
7/10
Malware Config
Signatures
-
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\netmgr.lnk fad8f37c9bd5420f49cfd5960a60fa24_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ fad8f37c9bd5420f49cfd5960a60fa24_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\netmgr.lnk netmgr.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ netmgr.exe -
Executes dropped EXE 1 IoCs
pid Process 4500 netmgr.exe -
Loads dropped DLL 1 IoCs
pid Process 4500 netmgr.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fad8f37c9bd5420f49cfd5960a60fa24_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{CBE8312B-7D0D-11EF-B35C-7ACE5ACD028C} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31133978" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2688617373" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2752367372" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff720000001a000000f80400007f020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2753305087" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31133978" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{CFC0DC1F-7D0D-11EF-B35C-7ACE5ACD028C} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2688617373" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31133978" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31133978" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434233342" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1F3B8127-7D0E-11EF-B35C-7ACE5ACD028C} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4500 netmgr.exe 4500 netmgr.exe 4500 netmgr.exe 4500 netmgr.exe 4500 netmgr.exe 4500 netmgr.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 2412 fad8f37c9bd5420f49cfd5960a60fa24_JaffaCakes118.exe 4548 IEXPLORE.EXE 2232 IEXPLORE.EXE 4500 netmgr.exe 4440 IEXPLORE.EXE 4500 netmgr.exe 1516 IEXPLORE.EXE -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2412 fad8f37c9bd5420f49cfd5960a60fa24_JaffaCakes118.exe 4500 netmgr.exe 4500 netmgr.exe -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 4548 IEXPLORE.EXE 4548 IEXPLORE.EXE 2848 IEXPLORE.EXE 2848 IEXPLORE.EXE 2232 IEXPLORE.EXE 2232 IEXPLORE.EXE 3952 IEXPLORE.EXE 3952 IEXPLORE.EXE 3952 IEXPLORE.EXE 3952 IEXPLORE.EXE 4440 IEXPLORE.EXE 4440 IEXPLORE.EXE 3312 IEXPLORE.EXE 3312 IEXPLORE.EXE 3312 IEXPLORE.EXE 3312 IEXPLORE.EXE 1516 IEXPLORE.EXE 1516 IEXPLORE.EXE 2636 IEXPLORE.EXE 2636 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2412 wrote to memory of 4500 2412 fad8f37c9bd5420f49cfd5960a60fa24_JaffaCakes118.exe 85 PID 2412 wrote to memory of 4500 2412 fad8f37c9bd5420f49cfd5960a60fa24_JaffaCakes118.exe 85 PID 2412 wrote to memory of 4500 2412 fad8f37c9bd5420f49cfd5960a60fa24_JaffaCakes118.exe 85 PID 2412 wrote to memory of 2656 2412 fad8f37c9bd5420f49cfd5960a60fa24_JaffaCakes118.exe 88 PID 2412 wrote to memory of 2656 2412 fad8f37c9bd5420f49cfd5960a60fa24_JaffaCakes118.exe 88 PID 2412 wrote to memory of 2656 2412 fad8f37c9bd5420f49cfd5960a60fa24_JaffaCakes118.exe 88 PID 4500 wrote to memory of 4532 4500 netmgr.exe 94 PID 4500 wrote to memory of 4532 4500 netmgr.exe 94 PID 4500 wrote to memory of 4532 4500 netmgr.exe 94 PID 4532 wrote to memory of 4548 4532 iexplore.exe 95 PID 4532 wrote to memory of 4548 4532 iexplore.exe 95 PID 4548 wrote to memory of 2848 4548 IEXPLORE.EXE 96 PID 4548 wrote to memory of 2848 4548 IEXPLORE.EXE 96 PID 4548 wrote to memory of 2848 4548 IEXPLORE.EXE 96 PID 4500 wrote to memory of 4020 4500 netmgr.exe 100 PID 4500 wrote to memory of 4020 4500 netmgr.exe 100 PID 4500 wrote to memory of 4020 4500 netmgr.exe 100 PID 4020 wrote to memory of 2232 4020 iexplore.exe 101 PID 4020 wrote to memory of 2232 4020 iexplore.exe 101 PID 2232 wrote to memory of 3952 2232 IEXPLORE.EXE 102 PID 2232 wrote to memory of 3952 2232 IEXPLORE.EXE 102 PID 2232 wrote to memory of 3952 2232 IEXPLORE.EXE 102 PID 4500 wrote to memory of 1852 4500 netmgr.exe 108 PID 4500 wrote to memory of 1852 4500 netmgr.exe 108 PID 4500 wrote to memory of 1852 4500 netmgr.exe 108 PID 1852 wrote to memory of 4440 1852 iexplore.exe 109 PID 1852 wrote to memory of 4440 1852 iexplore.exe 109 PID 4440 wrote to memory of 3312 4440 IEXPLORE.EXE 110 PID 4440 wrote to memory of 3312 4440 IEXPLORE.EXE 110 PID 4440 wrote to memory of 3312 4440 IEXPLORE.EXE 110 PID 4500 wrote to memory of 3496 4500 netmgr.exe 122 PID 4500 wrote to memory of 3496 4500 netmgr.exe 122 PID 4500 wrote to memory of 3496 4500 netmgr.exe 122 PID 3496 wrote to memory of 1516 3496 iexplore.exe 123 PID 3496 wrote to memory of 1516 3496 iexplore.exe 123 PID 1516 wrote to memory of 2636 1516 IEXPLORE.EXE 124 PID 1516 wrote to memory of 2636 1516 IEXPLORE.EXE 124 PID 1516 wrote to memory of 2636 1516 IEXPLORE.EXE 124
Processes
-
C:\Users\Admin\AppData\Local\Temp\fad8f37c9bd5420f49cfd5960a60fa24_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fad8f37c9bd5420f49cfd5960a60fa24_JaffaCakes118.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\netmgr.exe"C:\Users\Admin\AppData\Local\Temp\netmgr.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe-nohome3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4548 CREDAT:17410 /prefetch:25⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2848
-
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe-nohome3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:17410 /prefetch:25⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3952
-
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe-nohome3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4440 CREDAT:17410 /prefetch:25⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3312
-
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe-nohome3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1516 CREDAT:17410 /prefetch:25⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2636
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\fad8f37c9bd5420f49cfd5960a60fa24_JaffaCakes118.exe2⤵
- System Location Discovery: System Language Discovery
PID:2656
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{CBE8312B-7D0D-11EF-B35C-7ACE5ACD028C}.dat
Filesize5KB
MD516886327399771beb20897df8f623714
SHA12aa3f919d5198656cef604313cdae2e2278bc443
SHA256a50707775047d830c0e0d498542b85de784a279da9451d8a96a3bb2437668407
SHA51281f1ff9be21ace3b3d9376a2ccd48f8b7adb97f90cdc34aa542d3354673a24bcc6878f5e2067210cf3d506da60b4b72035a56fc94a82e9169df2cc5a58a9afab
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{CFC0DC1F-7D0D-11EF-B35C-7ACE5ACD028C}.dat
Filesize5KB
MD5877934e332efb8ef9d271ec9a34a514f
SHA16cde4b83abeadc6f814b521a567563d02bdb8b60
SHA2561eb8fbf15fde7d11650e889956b3480043ce576a46b72e509645f08606768b1c
SHA5123c1bcdbad80b4b3ed8e54420dcddc8dff774332da452fb0d8b377637b010a642e2cb859e8acf847dc5dd798d50091f6d700ce826796e3f00da70e37b55c9d862
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{CFC0DC1F-7D0D-11EF-B35C-7ACE5ACD028C}.dat
Filesize4KB
MD5c6c76594b7cf65098acae9517418cda9
SHA13a4eae821a66a1dea1d343dd398d0522bcd83491
SHA256b66b3d1f9d1b46ca280680cf442f97444ba9431558faf3e3e1b8d614f2628778
SHA512bac09b1fd5b558c10bf659b8586c699398469e739875341b08e4506bd5998c8a035aa1eea1f363f3cca2ec03cfa6ba81eb5c94b394976ddb427d590fa47fbc74
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
130KB
MD53fdd7a1ac800d5f0ea46e3a5bd46a6d5
SHA13e68e322fb1eb8489fdfbfb91edc4839076d7b0a
SHA2564c84d0c716dca56e0c4b7974895e2c65672760f4dc6df77824cc23419911d993
SHA5129d249c39b48c843c489b6f03978f0b7bbb19868be1f231871b2502ee20ab2a81c8be6f9c446cdfdcbc96a2cad2526329f8636b4992b5b009499568d361f6c9c2
-
Filesize
16KB
MD55e7c5e8d9f5864488ddf04b662d1ad8e
SHA184068ec5e2f11f8fe80ac91f04fed2493c97243d
SHA2564f55446d65578f9c0ac2694ab2f07af60694a8d96e0acb484aac192d58e819b6
SHA512c8cb92ae47280392b81ed1b6182ebfa3e7015b718ab8e18f60b8887671ae4f11a956f47c5d8b285107103149680b115f7894aa5c7ed9e1874d5d5524d721a17d
-
Filesize
150B
MD573b3ad270f45c5b8e5297b5d96c52e83
SHA1edbd267780fdf12a5813588fcfeeda4673913835
SHA256e2113254c4ce66927e35873a0d8034e0f153bee13da136194420a76e55771505
SHA512d815d6f8181736ed3d1849c696e32dd733bf6d81f77365b7a0dafb43c1dd480e2915593e1a68e5e339d0884014c1440f381911acc397b9a9c7cbcf41d1b9165a