9b5245b3157d809659cba4330d1dd249087860c94c59d52a0bb4afe8bd47ac1e

Analysis

max time kernel
135s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 23:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

03952eda9be26b7c3d980920a4d69256_JaffaCakes118.exe
Size

250KB
MD5

03952eda9be26b7c3d980920a4d69256
SHA1

b7df6a50536d28886204a93aad7d6bb8fde780c0
SHA256

9b5245b3157d809659cba4330d1dd249087860c94c59d52a0bb4afe8bd47ac1e
SHA512

5b9514cbe08ee191c4c66656c43fdb3d26e94b302f667ca3ea2efd52f1d8b98e6aab86482ac0c63013214af7f081f8c19cec8135ea1ae8ba2ee2383c26259d3c
SSDEEP

6144:mhieuJDr5T8b2ufqBLjSB/MS7irtIa6cwoD8ZroSfjGFA:DeKrJJuf86AYcwoaoSbr

Score

8^/10

discovery execution persistence upx

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Deletes itself 1 IoCs

pid	Process
2840	cmd.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2976-36-0x0000000000400000-0x00000000004B1000-memory.dmp	autoit_exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2976-0-0x0000000000400000-0x00000000004B1000-memory.dmp	upx
behavioral1/memory/2976-36-0x0000000000400000-0x00000000004B1000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\WinRAR\winrar.jse	03952eda9be26b7c3d980920a4d69256_JaffaCakes118.exe
File opened for modification	C:\Program Files\WinRAR\winrar.jse	03952eda9be26b7c3d980920a4d69256_JaffaCakes118.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	03952eda9be26b7c3d980920a4d69256_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2560	PING.EXE
2840	cmd.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433899859"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 205e6f668e13db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000e70f5a34c3ba0fbad3effd172837d93f4e745882de1d4e1b4ec36b8b4e7f8ba0000000000e80000000020000200000000228801394366ab1bbaa3ddd3fd4ac1c99774a7f264478baa3463e252ea8cef5200000006e502b6c7c0d740b55ee50e5d25dd247a228b2240eec8b4fbc0a9056bbce4cf1400000001acf8d7bf02c4f59e9ae73d83c7f86d8cc3a978eae045714d215ada168bd3b9b1b8e396c819006fb289fddfae4afb009194257e7b432d02739d8f3eccdb2f930	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{90245681-7F81-11EF-82CE-E62D5E492327} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000dccd13b3bc7adf1f9711b253650a79111dc60216fded021ccffa86f50478357d000000000e80000000020000200000000648828e362298755baefc35adb52bc7b82f27e55da404cc164d0b2b73afe2ee90000000ed3d6f5f198fd6fd1c08833c00e2af8833ee983e9c13869d1f4dc484f59f04cf2169710e17bc7953d78b2edae8fd52ac4613c9779c8f0f5daa9ebb08eabe0356a7c30bc64b05dac07c359e8c61c762b67cca16856d4f53c585ea86abdd4020e9afe409b066bf4cb68275d4a685c6723b5de9e49240be9924e4d3a2a5d8761c89bf107f51b8fc3a726093bbb3c9a30671400000005f812549acdd65bafa3fbc4ba7532f1f94fa4cd99dd962cef8bf2eaac1d33412994523655b638dcb351750e132082c4b7f3a7429c8d5be39b2834f32f4d09482	iexplore.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shell\open\command\ = "WScript.exe \"C:\\Program Files (x86)\\Winrar\\winrar.jse\" \"%1\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shellex\IconHandler\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\CLSID\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shell\open\command	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shell\open	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\NeverShowExt	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\DefaultIcon	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shell	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shell\open\CLSID = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shellex\IconHandler	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shellex	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\IsShortcut	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\DefaultIcon\ = "%SystemRoot%\\SysWow64\\url.dll,0"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shell\ = "open"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\CLSID	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shellex\ContextMenuHandlers	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shellex\ContextMenuHandlers\	WScript.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mmc	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mmc\ = "mmcfile"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\ = "¿ì½Ý·½Ê½"	WScript.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2560	PING.EXE

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2068	explorer.exe
Token: SeShutdownPrivilege	2068	explorer.exe
Token: SeShutdownPrivilege	2068	explorer.exe
Token: SeShutdownPrivilege	2068	explorer.exe
Token: SeShutdownPrivilege	2068	explorer.exe
Token: SeShutdownPrivilege	2068	explorer.exe
Token: SeShutdownPrivilege	2068	explorer.exe
Token: SeShutdownPrivilege	2068	explorer.exe
Token: SeShutdownPrivilege	2068	explorer.exe
Token: SeShutdownPrivilege	2068	explorer.exe
Token: SeShutdownPrivilege	2068	explorer.exe
Token: SeShutdownPrivilege	2068	explorer.exe
Token: SeShutdownPrivilege	2068	explorer.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
2976	03952eda9be26b7c3d980920a4d69256_JaffaCakes118.exe
2976	03952eda9be26b7c3d980920a4d69256_JaffaCakes118.exe
2976	03952eda9be26b7c3d980920a4d69256_JaffaCakes118.exe
2976	03952eda9be26b7c3d980920a4d69256_JaffaCakes118.exe
2772	iexplore.exe
2772	iexplore.exe
2772	iexplore.exe
2772	iexplore.exe
2772	iexplore.exe
2772	iexplore.exe
2772	iexplore.exe
2772	iexplore.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe

Suspicious use of SendNotifyMessage 21 IoCs

pid	Process
2976	03952eda9be26b7c3d980920a4d69256_JaffaCakes118.exe
2976	03952eda9be26b7c3d980920a4d69256_JaffaCakes118.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe
2068	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2772	iexplore.exe
2772	iexplore.exe
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2476	2976	03952eda9be26b7c3d980920a4d69256_JaffaCakes118.exe	30
PID 2976 wrote to memory of 2476	2976	03952eda9be26b7c3d980920a4d69256_JaffaCakes118.exe	30
PID 2976 wrote to memory of 2476	2976	03952eda9be26b7c3d980920a4d69256_JaffaCakes118.exe	30
PID 2976 wrote to memory of 2476	2976	03952eda9be26b7c3d980920a4d69256_JaffaCakes118.exe	30
PID 2476 wrote to memory of 2772	2476	WScript.exe	33
PID 2476 wrote to memory of 2772	2476	WScript.exe	33
PID 2476 wrote to memory of 2772	2476	WScript.exe	33
PID 2476 wrote to memory of 2772	2476	WScript.exe	33
PID 2976 wrote to memory of 2840	2976	03952eda9be26b7c3d980920a4d69256_JaffaCakes118.exe	34
PID 2976 wrote to memory of 2840	2976	03952eda9be26b7c3d980920a4d69256_JaffaCakes118.exe	34
PID 2976 wrote to memory of 2840	2976	03952eda9be26b7c3d980920a4d69256_JaffaCakes118.exe	34
PID 2976 wrote to memory of 2840	2976	03952eda9be26b7c3d980920a4d69256_JaffaCakes118.exe	34
PID 2772 wrote to memory of 2604	2772	iexplore.exe	36
PID 2772 wrote to memory of 2604	2772	iexplore.exe	36
PID 2772 wrote to memory of 2604	2772	iexplore.exe	36
PID 2772 wrote to memory of 2604	2772	iexplore.exe	36
PID 2840 wrote to memory of 2560	2840	cmd.exe	37
PID 2840 wrote to memory of 2560	2840	cmd.exe	37
PID 2840 wrote to memory of 2560	2840	cmd.exe	37
PID 2840 wrote to memory of 2560	2840	cmd.exe	37

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\03952eda9be26b7c3d980920a4d69256_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03952eda9be26b7c3d980920a4d69256_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files\WinRAR\winrar.jse"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://www.go2000.com/?g8
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2772 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 4 127.1>nul &del /q "C:\Users\Admin\AppData\Local\Temp\03952eda9be26b7c3d980920a4d69256_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 4 127.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2560

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\WinRAR\winrar.jse

Filesize
11KB

MD5
9208c38b58c7c7114f3149591580b980

SHA1
8154bdee622a386894636b7db046744724c3fc2b

SHA256
cb1b908e509020904b05dc6e4ec17d877d394eb60f6ec0d993ceba5839913a0c

SHA512
a421c6afa6d25185ec52a8218bddf84537407fd2f6cabe38c1be814d97920cfff693a48b4f48eb30c98437cbbb8ad30ccd28c3b4b7c24379ef36ac361ddfdbf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b583f95b80b1448d2492845d38adabc2

SHA1
9b357cd1cc3337be075dfeaa0b742fd16fa36363

SHA256
1557c4a2cd229608d9404a831782e3c1ef2987852ae01fcd27d51b10c6d049f1

SHA512
b207e346dff521968b38d5aa17a4fc893e1c5465d6bc65a3498fde1bca0f963f72a46debfc3482e79f532fe8e65a2a59d58e0958ad2f1eacd21292ba17ec3351

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b23e082d53b86786d021bcfd43defa7

SHA1
760b7989b746fb4102a500dc139de95b80bf2e23

SHA256
75764cda6ba5dd6791f0471bdcc708622fcc87aba5c9c6465410be8461d1efa2

SHA512
771e300348e8b73508f525367e48419ffb0830f93527275f9fc86fb4b39974f655b4857a6c55c87f15008e3353f75f752411fb994f5d152a131209864ea7f824

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a40d164fc875562cd704b2dc26c36d5

SHA1
8894c4906cbac5f38a75ea47139558931e91426d

SHA256
21519845f4a2bb9c5b406690203ffb1e07212d19cde6b2dc1b579179963a0334

SHA512
4f6d21d5903fb4b8ea9b04208e3d2f813611757584d35627a0cddd8a9d8b28c83b1fc85a55bcf52ec7a1f873388c5686f556d9bd7841a6794b6c7ba36c7cde4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fddfddae1787a3e07bf55ccffc795d77

SHA1
76dc4f5d864dc7b02d8de2355bb80a16ce7d9ac8

SHA256
50be835fec9263170042736e3ed17f38044a5a0a53d9dd0cd3cd435009324544

SHA512
48fab0acbb876866c09d9c6fc5c7129cfd7ead2d8fab558076a9e10691f6434bc6c6372657dd3a3130890af00ee10cbf3883c751a442801e74a987dd9327bd24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2539fc8a8d16d2b397358ba61bb15fd9

SHA1
f392a41d1bae040384f227b7769ad72d473ca970

SHA256
3c340d976fc83349983f098dfef9d35b64ed22afac13a7a0b1ff0b141d5ff6c2

SHA512
d520716cf5ea99d6bb988988cc36bb367b18f90ee83c03b040a1dce87da2bebc007507888a6081885951fb63788e2315b9731d9234b06fe0ccb9ae47f24a5da5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9268ae2c0f09bb02eeaf4a9923e3737

SHA1
e5cc91470d650a71c12376eb3f7270d9c4e617fe

SHA256
b1e7ccd009288bc17a13a043da78a0b4f090399750ae2bd4466081e6e1fa5f3b

SHA512
e73ea8ffe62c3f2f7baf6a22180b3b869818d91c4af2f7432625234875f2df9efde509d0b8efc19dcfac6a0939d3f8a5ba2869565b30f371c9287f79a1285818

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2dff2a3d33c25c98eaa3e8482fc36198

SHA1
070fb99a8bce9a3d4f74c5b298d6f96e21be6643

SHA256
fcdbf43e040649d03bf8087a29ab67072b20ad0e3da11f779bcea173da3f9ab6

SHA512
63142698f7fd7307ee23ce285d000985a2e6ff63227de4666bc6d13502dde645db84172cfcd34428cceefb327a18bdf90b38882eb28baaf21467d73207077065

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95ea24fffc7320e5b7efbb086da65107

SHA1
423e2433029e66d4945f9044cf084e17e52257d1

SHA256
7c810aa41660db04eeaf73449895cdf96851a58a846f3c8de21ce14cd1f20153

SHA512
1a178e2df6cb048f245159467760e071d3f3d6b3b0500c4ac4a832a9d5f5669385f35ca6823e7001de384e3419daf8f719c0450f091a56a5d7efe01f0e5600cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3560620dc7836fcf2907ad59be0761f

SHA1
9a929441aebec86633f35ac729a3955251a1f98c

SHA256
3458d81b8aacc53d1fddf0c68a75b327e97f1a434363025f778b2162d4955845

SHA512
b72fb9ed78ba2b88b084f404c201305bc0722a2c93323d8dc8f8ddb8bf0df8bb8733a2998b740d70aafe8694bab0eaacc134f7a69d054847eee9bf44a215f88d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa93575212544b3d6427e577aa445fa9

SHA1
4fc11cb2299c4bbb724aed4966cc241a2ff66299

SHA256
18f9c611e4fc480f728b5beb20ffba7384f47cd36577abe1213a687870ea69d1

SHA512
716a03fc89b62c3d94e088ac0a80b47e8811f8d196903d8fd57f19d55798a0a30c9894391193aaafaf40aa40d448548c63c8c3cad65a92dc34b3e3457bf7ee55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cb9109fb0e6882433d896cf199380c1

SHA1
a3cefaf92f113e29efefde7b29f02d3e12943912

SHA256
7db7e3096e38ef7ee101b746196bdc491dbae61db573c09e9f557b34531cd4a5

SHA512
1d1e44311d5e0ca2e5b3336c08201d7079f12a980596a2ed4fe7e71be68d8d7654b7bf15c9c3a2b4c0fc503cb43e93c0e8409eb9bd2c37702e5853d3a16e9ecc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ee06f7f887e05f02b86331f0ad7656a

SHA1
835eb1d8f84d4d3cbddcf94397f79c0068b1ac82

SHA256
140796cc1d37c8d5b2aae64e23464f0255c908152e00d81e419229f433ff7a9e

SHA512
b0c9a5ad99a49052b9c4561592b972939dd43b7d0df139b6a111d0d31f96394247bf380062431b831e78a77c3b34bed5121dbbd8f4c9cab009e6a12d6b6c0674

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45b977daa069cd8369398b9d5179ff59

SHA1
145b70a466d8ac13e7e6aae6e293269efedd1488

SHA256
499789ccf881ad6fd199d5c972f6738dba13dbaefb517e4a5d723d0c813937a6

SHA512
a0b3ceeaab01c23cee08924617fa38553e9a6e5142b7c32242e3fd0f88d3defadc7b4c9f225cee70d833a06a3e4e1fc3eec01c38dd3992a8cbf0232397fc8fb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9821c0f6392f28bac8bd26ccdd222997

SHA1
fbac9d813da3d3b29a99baa7f7ebe7e72014dd15

SHA256
7557d8cf791d349efe47a8314a4c343bfcdd9857ec383e17eae490e0800eb6a9

SHA512
ff584aee38a43287ff17c5f0eafef9027e8467560074ff75eaad92423c04449f319535e5a2faadc4e9a35b7bf351c7be5d1ced97aff250a4dd080cf00b4315b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ac74003083947bc34965337b3045988

SHA1
d6fda997763fc815890736673f58ca62f39be2a1

SHA256
6e26f4d96741862ba7f43d7ee62b448ff6ebc55213d8f047d6c76d1bde795fb7

SHA512
0ca721087310ead30e1d60475e049ff1eb482b56fd94fa3ecb4949ee06736a39eda705d4d8bd58ead67df87702785e0c9e68409f22e4e9a29fd76762dc921a9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53aa60835046556a7e99abe18c421ee2

SHA1
b8cd61fe1baa06903b8c19d8bf7d71db75c1938e

SHA256
6419159c31973508194cb7eddef4a43e68353c2fa3bd2aa31ce38cb32898666a

SHA512
46b4a472832f6b6ac38a37c3cc7b10933e79bce44fe0199c13574c923ed321f8873ec9e477e5cfbae8065e5fadc1aadb17e1785149d8630e3c27fd99e7f0c81f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3567b3a27c5d29eec06a676f9053cf5

SHA1
c9a0c2ffa0fbe047624bf3d89b772167d28a8222

SHA256
9ad26744a3d447bec6bebe20ecc954322a969332afd18819e6e1a24b14a18e13

SHA512
23f84d516332f3733970ca91615e73aff06091e52fc1e739ff5b87653905efea522bf144a9943f93aeba4affaa95131b0d5b1dc86f754a657f1c5dedfc351a88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2cfe79966ac8d1fdc77d1f468640bf5

SHA1
067f480bc876fe1dcc44781d4b21f419deda1171

SHA256
cadf4134ffb8c60b631e76488ffce07d26a5b866e6754b622ca1323ecc2cd6ab

SHA512
1632503b22825ef389673900bb9a84232f730e9ef286224c420c4b2d01473169cf9b4602955df50f76daa3d246d12263ea85ead968809d8e7fecdc7b55673346

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88886d6a5c6fe7f2150d6d53c48f01d0

SHA1
dea4d8f815362195ad6e9031cd6d52410a3716b1

SHA256
e176d2d66a5b6f74a19c93ec72ea13c8a8478344cc07d202cb8607bd46f07ff8

SHA512
7c46b4b8164f83ff419091a0360adf0652e561a81d7378a5c0160f35033f4e34adf7801b9e0e15b8a03e11411851175c5c1c7b5c3fae8b7f00672e026471a936

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03c7fc64b5e57f0cdf260c4d5acb348b

SHA1
8b11d3bf8c24b14e46a3ea49553143fb5ea520cf

SHA256
02be77e7f75be43beb460ab9a0bceafe17bd92bce97630e2920ae60c9a614c4d

SHA512
cd6cfdd41af9b9ccd75bf4b28f405b6f616e773fbe763c42e0596e1f3878e09e8fb240e8fdc555ceac3494f4b4e836694cc5035915f9df23753de87084bdefe4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8635280a6a787c528e1e84f95b3aa6b

SHA1
9c47591d8e3b046ddfe0f81141162d087faf16da

SHA256
12d7f144e0421d04aefa9db8c3f3486243b9de6249aa4643b5c5156f723694e3

SHA512
4232dc7c43eea358529c2ea0e12ba9a35b30328dab80ecebc42ea10651b581072ffab4a9a7d114ac59233b7b3cc2eb1adc76730066644657021ecdea8d3a5feb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42d2f64653724a8dbdb100f85fe97d73

SHA1
8e08a909b0b8a36f255e8d882e15d3d49fd1869d

SHA256
73f2b60d83115d17983aecd4774b9295c2c0e61bb6698f8b05c64ce18adada6a

SHA512
76ce1682417c655f5132c852cd3b25f550a46d099be016550ec7716fcae24639e327bd07b6d03d16bb86e10efc30f692978a0556e0f60764e365a2440af1f983

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD886.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD916.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.mmc

Filesize
255B

MD5
a0c4d2f989198272c1e2593e65c9c6cb

SHA1
0fa5cf2c05483bb89b611e0de9db674e9d53389c

SHA256
f3170aeec265cc49ff0f5dcb7ed7897371b0f7d1321f823f53b9b0e3a30e1d23

SHA512
209798b5b153283bea29974c1433fe8b6c14f2a54e57237d021ecc1013b8dc6931dedcc2fe173d121c719901045fdf2215177ba164c05d703f2e88a196252ec4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.mmc

Filesize
149B

MD5
b0ad7e59754e8d953129437b08846b5f

SHA1
9ed0ae9bc497b3aa65aed2130d068c4c1c70d87a

SHA256
cf80455e97e3fede569ea275fa701c0f185eeba64f695286647afe56d29e2c37

SHA512
53e6ce64ad4e9f5696de92a32f65d06dbd459fd12256481706d7e6d677a14c15238e5351f97d2eb7bfb129a0d39f2603c4d14305a86821ed56e9face0bc252b6

Download Submit
memory/2068-1089-0x0000000003CE0000-0x0000000003CF0000-memory.dmp

Filesize
64KB

Download
memory/2976-36-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2976-0-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads