1a9548c6fb85af9485422a214f0507491bafb0dfe773667c36f60ec15d8686bf

Analysis

max time kernel
150s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 08:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

004b20e782c8f948b0a51da40ff6ccb0_JaffaCakes118.dll
Size

199KB
MD5

004b20e782c8f948b0a51da40ff6ccb0
SHA1

8b6601be92b1f0dc2605f3e69b53c95260cbbc94
SHA256

1a9548c6fb85af9485422a214f0507491bafb0dfe773667c36f60ec15d8686bf
SHA512

f20f357fe142a6644cc6f53fc36b2e17ee0fb1e8fa5d24f71edd11b30f40248833d63305959cf18cc19c88a2a2bac257ca84457c9262f556944d6b1418ce6179
SSDEEP

3072:gaaRZAquViVMgq+x+9zKfgTjVJ/yh4WXBxD7QUnN/dNvnrOQxJy4tJsxRKRckR0A:ZMn8zxyh5LQUNnOQxE4t+K3RP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Modifies Internet Explorer Protected Mode 1 TTPs 15 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	rundll32.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 3 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 40 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000008c71522cf0c7bee423950ea374fc156703d9aa898fc02269a69dfbec0ceef633000000000e800000000200002000000085ab814338a14f5e4e36d5547be85869e904370d22e207e13533fea2e216ac3690000000695f65c2af0fb24bda9363f74aa986a9a444c1e3ea987c93a7deea7eef7f822df260bc8cf569bcb71de7d4bbc681a351e09f2b12845a437e2631a721ff34a86d6058ca1292062e5191be23af06927694e083390164b7955a537b00913973ad0fcd58c4176062a8ec4e331cb6f02be404464d27d03662131fa093dd0863f081fe2cb90ffaee623da42026e22080e1ef014000000014d6647024ebaa31a487d15a5a9c900e3b020d0fd2818c99a35370ce106626dd7fdb8cd745354ca2995f51577c88d5268ca7638f43b99fe5ea620ab0e815fab5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000008da9b783ac10f8bfaf1e65771b444c76a5055213f06916802fea3608e6fc1156000000000e8000000002000020000000c30aad3955b13cfb5b687820b1ecd187371188ff7ad54b43296b4cb82f986b7d20000000cdc2361f17354365725cc33509d453f3522445d9471085e70635f158fca1b63a400000008d4fa0e77d3ba3aedd84f364f07d3f0ff7f4af57e811c3c0d87c20f64a2c1cd310cddb2b48e88c94a84d88bd29c6758ad7c018b5b88871015e720d6f48d4542e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8256B771-7F02-11EF-BA5A-5EE01BAFE073} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433845290"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d086a1710f13db01	iexplore.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
2848	rundll32.exe
2848	rundll32.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe
1020	notepad.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
2544	iexplore.exe
2544	iexplore.exe
2544	iexplore.exe
2544	iexplore.exe
2544	iexplore.exe
2544	iexplore.exe
2544	iexplore.exe
2544	iexplore.exe
2544	iexplore.exe
2544	iexplore.exe
3052	ctfmon.exe
3052	ctfmon.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2544	iexplore.exe
2544	iexplore.exe
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2848	1872	rundll32.exe	28
PID 1872 wrote to memory of 2848	1872	rundll32.exe	28
PID 1872 wrote to memory of 2848	1872	rundll32.exe	28
PID 1872 wrote to memory of 2848	1872	rundll32.exe	28
PID 1872 wrote to memory of 2848	1872	rundll32.exe	28
PID 1872 wrote to memory of 2848	1872	rundll32.exe	28
PID 1872 wrote to memory of 2848	1872	rundll32.exe	28
PID 2848 wrote to memory of 2788	2848	rundll32.exe	29
PID 2848 wrote to memory of 2788	2848	rundll32.exe	29
PID 2848 wrote to memory of 2788	2848	rundll32.exe	29
PID 2848 wrote to memory of 2788	2848	rundll32.exe	29
PID 2848 wrote to memory of 1020	2848	rundll32.exe	30
PID 2848 wrote to memory of 1020	2848	rundll32.exe	30
PID 2848 wrote to memory of 1020	2848	rundll32.exe	30
PID 2848 wrote to memory of 1020	2848	rundll32.exe	30
PID 1884 wrote to memory of 3052	1884	explorer.exe	32
PID 1884 wrote to memory of 3052	1884	explorer.exe	32
PID 1884 wrote to memory of 3052	1884	explorer.exe	32
PID 2848 wrote to memory of 1020	2848	rundll32.exe	30
PID 2544 wrote to memory of 2684	2544	iexplore.exe	34
PID 2544 wrote to memory of 2684	2544	iexplore.exe	34
PID 2544 wrote to memory of 2684	2544	iexplore.exe	34
PID 2544 wrote to memory of 2684	2544	iexplore.exe	34
PID 2848 wrote to memory of 1536	2848	rundll32.exe	35
PID 2848 wrote to memory of 1536	2848	rundll32.exe	35
PID 2848 wrote to memory of 1536	2848	rundll32.exe	35
PID 2848 wrote to memory of 1536	2848	rundll32.exe	35
PID 2848 wrote to memory of 1536	2848	rundll32.exe	35
PID 2848 wrote to memory of 2544	2848	rundll32.exe	33

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\004b20e782c8f948b0a51da40ff6ccb0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\004b20e782c8f948b0a51da40ff6ccb0_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer Protected Mode
  - Modifies Internet Explorer Protected Mode Banner
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2788
- - C:\Windows\SysWOW64\notepad.exe
    notepad.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer Protected Mode
    - Modifies Internet Explorer Protected Mode Banner
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    PID:1020
- - C:\Windows\SysWOW64\notepad.exe
    notepad.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer Protected Mode
    - Modifies Internet Explorer Protected Mode Banner
    - Modifies Internet Explorer settings
    PID:1536

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\system32\ctfmon.exe
  ctfmon.exe
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:3052

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2544 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5a76611bfd79a8bb922ce995600688f

SHA1
efcd13f6ef230245720964922ba63369bf7f34c6

SHA256
40a54c0e511ec5f6f31c0a63d76846820bf2444542a8b8b4d916d126b385aa50

SHA512
fd51afc5aaf5d31029f27e7da65e852c928cebad4dd35e91e7988e8583c9eff55fe4a67b0d1c9d13ce1facddcd9230868055b0704926fcfe48c07c05c8d56233

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
240c3aaa06bf36659bb9fd1cbaae1ca1

SHA1
defb5314d8e8eacc69d4e08458f2536d1b2a73e8

SHA256
848519d185c9b657ad8b252bef82e96654feb548b2be7ddca871594a5e76539d

SHA512
d8c6a4e8b98303335b3eedb57a673a8ac5c2d1dc74c2264b0dd40079e56a8851752d236a8314d9ec9680bd83091cc8ba973aa091f5214747d1d8c93fc6f4ea94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5c63445847fcf8bf54996a71342b278

SHA1
d6ac9f21650ae75c857ad47b9a331f31bbdebf57

SHA256
cd33295b5177ea2ea9d478a0d0c41ef8072bb642ad452555f107823e9c7696a6

SHA512
7c70100a2895d09bdfb447e6902a44890552ba30146b13cdc32d8cccd7422b3e9f399915ad1d328533a0ec8ded1007028a09afec4d5388ad936592e5f04e6a4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36a2a599dd5f74fc40b70c32a7e4a66b

SHA1
efa7d55245af14b1f56f9eccbb24db888811de9c

SHA256
38c4765494ecc8c07a2ba8158a638bef1d77c1076c47c2d544beef5a7b76b66c

SHA512
67cfddf20179f1d2483409d2d1a53588efba3574e517623c98349d91fed70a68a138563cfd4fa8c8c64297d0e918401573784734ef9c5fcd8e0c1b776e2f7e19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a43f8fb9a0f99515312a132f6dcc4c2

SHA1
6d91a74c0f45495decde9573ef6605fcf86af59b

SHA256
2624622cccf0567eb7cdda07dfacce40be9479f2f5e29cf1752071184f7c8ffe

SHA512
2e082775b7f714cd3ceeef37099e0efb31b72f8b1178d7e0d806c209501f0d2e36a2cb53931105b693019a7e82aeba9d8d702ea1e2ab205f3fdf30d902349da3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c6fb8ed50bfd41c6cc87dfc33db5d65

SHA1
fb28049fbbe93d6579e8f463cef58a510391a1e9

SHA256
21bed950030cb3b2b7ed2895f838f7dc8dc8b107c7e3c7b438791724fd4c67bc

SHA512
9811460befea473198b713385d483ff0ef7ef19d057a85e0dab5fba6eccb5786a958bda357aaee080b9c1cb374299ee2ae4b5aa4da05153cc86708ee96681464

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb3fe8471810c5081450e3c71199646a

SHA1
e82fda9c2c0fb328c36c16963054c8b784e95bdf

SHA256
6be357815e62d6a83e5ede7f25c3f7ca46c97dd72e9ccbc4e44a77481675bfdf

SHA512
4c62b258ea391d9365ee540d29c34d2440d658cd1ca4c1a9b3fb243826a878e9a3c6417041ae88dbe365f60f6adefdc1c3c88917cfffa9097078561e5e43dc19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
918c569f447090888e8c16c87d5368ab

SHA1
0e5a639f965c28beebfd6639e93661786f6fbab7

SHA256
d8b2ca986d88c3cd441d5442fd59281572fc20b84e7795e176e76daafd6c4fc6

SHA512
263a0f3dc81ac8d86a8c1630b5fc4ed7ede85313be0e3d9a8301f1aa806c14bba7c58c27e36250cb73523021e0cb53ba588885cb5ca48070879c7c03bd7ff32a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ba7ed312e4a53af589e8854e6838f08

SHA1
398000dd7237e1064433f6df1bb7b84994dce149

SHA256
20647a942f5d38b654c72efaec297c6467307460907a1da2961920584cbb5668

SHA512
7be5c8cdd7a7d4c51333be009a9d2fb560ea1a87b154317299371b7904e2eaa02f5544a3935eb3f6adfd7da67c1ab4473dbfd86db8c1b88280afc63b9f8ff015

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf090ccfb72829bb30ae4498be968b7d

SHA1
74c155561d343228ae7b2217b13b4e6fc149e08c

SHA256
4330d329e38fc8eb8ade938eb44b03aa3ec6e5189c2b0e8fa26f568b66140bce

SHA512
0a8d65feed9f12147648c5492979321d14804a56bf4f4b429acc15635f41281353c5e5af51e02a2c277782610888d92f118bd2090ab3c26d41801a1cdb774521

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c93824e93e08fcb0e807930147998af6

SHA1
2feb9232829eae8a965451c0a7ed211dec63db18

SHA256
07dc91a46e7681d843272d3db77d20eb623a2f8ce426e3963d63bf0a639e9d30

SHA512
9b523b336c73f0ab6a350be29ba25b996f1c99127bc18eceb2110ead3dc530f81b33bbf7f7b7380ea886eaf703aae26a750d8f7707a14dd1c8ba82b697eb8f55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e515fca27073326e7db727e8cad3700

SHA1
1edbfd1a53dbe221147f4f2c9681cd47861e2a7b

SHA256
00d180b5c5a19d8072cc431d5cec16797f1ee937574d7444fc5a5ea2677f5b0c

SHA512
d4ef6d314491a9506bd2f8520194d051916dd0495fcdb394210b1cfc5de5a00ab655bafbe36071dcce75feb639c2a4524038e8d1dcbf1a078c57754d34888b6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
825058a0500f4ca558048991988bb2ce

SHA1
bc8248f5100761e8cb566c32084a905c95536afc

SHA256
39e1f4e79ecc782d855914bb382e9bf77d322cde374eb78d67de18032fe0c00f

SHA512
e790cab06bda334a4ef7cf5a2f70d6d07f23285dca6b60697762133d31ed82df891b21ee355d6dac3c0b58ca5c8a8069aee6ff142e55c25fdec3f12048b21257

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b0fd4231714b46a338ee7c6953886a0

SHA1
8079e032416e3c9e349fc6d58a0b2b7614985e5b

SHA256
6852f101bcd3302d7ce81f190ee0f15a2bd126a13cc6af1a64f2d2af045b87da

SHA512
981e8801fad6d68e542dc389a0f525feeb0dc5e265e8030996514200a517212d31b671256927badf94489477c173af462abdb037b507545955493d4133853d8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d717dc7580e87d1a85a751c9f93d01fa

SHA1
be64587817a9374b983e0b11815ae395080865ca

SHA256
834fc192dd13a6cc8e2e560eb8dfe6781eed958344908e9de24eac4e20fe87a3

SHA512
43fbfb60dd6f4d16ab5c4008e09e6acdeed5aab82114dfd6f2bbad9ace7479faf3e94eadfc495145455f6dd79cf790b4bf73d01c111f9910ae1cc37d5f97ec74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ebf8a7c51fa74b747614b5341bdb8f9

SHA1
1e3776c951bd8ca0448ba50580a984da5410c1e2

SHA256
48cc72b469ed5c96f64f53bc1e589c5ffc87e475dad2a88092f67ac1170113e8

SHA512
01edb4c013051853081f542998e021824f34816e716ff55bcb1ff133f7705fe28f1b91a78b117209baaae2905cd181a799810f33b8927713aa41315a1a655436

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b33e720c7f1b1f563290aa884bad541

SHA1
c611c53efd61324ca30fc35d01e48be6a2a2be5a

SHA256
91fb47c4bee1c65a7614d1245880d6f902e7cfed12672e8a6e2f15a06f628be6

SHA512
77a15c2be420a84f83595f24c13585b4a42a8810802d8b7cf88894324060917f5b8e3339030d3c662b8496f91786e57bbc626e0b58dbb90efd72bb590ff1eda0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20dc45313171f09288d76defe7fcb11f

SHA1
7bc85d4f549d25dd1b6d57c04b8d0066327f538c

SHA256
6d2279d590e695acf724ba62d29206670fe920011031322f771b39cc9aef9929

SHA512
0c39068be6e3eecb707e020cb8e17f5aea234d918469807faf7d7da9911b96965a7040360411dc3cc65f213fc7166b57d3d36b37f27b20a50977cad646ad7ef5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
411cd98a0527253cc60489b124983e7c

SHA1
4b1d2d0a284a8129c3641ae7c4077bf1a338e334

SHA256
255b70a9d626ba075eb00ac81f4938b2ea2145e35f52e54e9405272b1c7333a6

SHA512
26e2d5e00c7de1a09718118ea909ffc0b8a86bde5855cd07bf708279e1fee8366ae21fccdfe083e029da43d45dbf09ffd7ea96ec7c9a110437d1d35d891a280a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab54D6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5576.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/1020-14-0x0000000002F70000-0x0000000002FA2000-memory.dmp

Filesize
200KB

Download
memory/1020-12-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1020-17-0x0000000002F70000-0x0000000002FA2000-memory.dmp

Filesize
200KB

Download
memory/1020-16-0x0000000002F70000-0x0000000002FA2000-memory.dmp

Filesize
200KB

Download
memory/1020-15-0x0000000000240000-0x0000000000242000-memory.dmp

Filesize
8KB

Download
memory/1020-13-0x0000000002F70000-0x0000000002FA2000-memory.dmp

Filesize
200KB

Download
memory/1884-11-0x0000000003D90000-0x0000000003DA0000-memory.dmp

Filesize
64KB

Download
memory/2848-0-0x00000000002C0000-0x00000000002F2000-memory.dmp

Filesize
200KB

Download
memory/2848-19-0x0000000000490000-0x00000000004C2000-memory.dmp

Filesize
200KB

Download
memory/2848-3-0x0000000000490000-0x00000000004C2000-memory.dmp

Filesize
200KB

Download
memory/2848-7-0x0000000000490000-0x00000000004C2000-memory.dmp

Filesize
200KB

Download
memory/2848-9-0x0000000000490000-0x00000000004C2000-memory.dmp

Filesize
200KB

Download
memory/2848-5-0x0000000000490000-0x00000000004C2000-memory.dmp

Filesize
200KB

Download
memory/2848-1-0x0000000000300000-0x0000000000336000-memory.dmp

Filesize
216KB

Download
memory/2848-2-0x0000000000490000-0x00000000004C2000-memory.dmp

Filesize
200KB

Download