Analysis
-
max time kernel
94s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2024, 18:02
Static task
static1
Behavioral task
behavioral1
Sample
0ffe211e164a0a07cfec3790cab189e0_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
0ffe211e164a0a07cfec3790cab189e0_JaffaCakes118.dll
-
Size
614KB
-
MD5
0ffe211e164a0a07cfec3790cab189e0
-
SHA1
1febd666ccb79988f6483b3d76521abf9b93203c
-
SHA256
486d1f139f0396f4cc8e840babc60b0a3001246d53c4b4fed1356f8000618f81
-
SHA512
a66ab4775c7168cd60acb690224db16bda50ba1e4640cb4f2534f14580696fec9796b68775d4ee928f63ec27d24059e2c434d3ecca53bb364d8defeb6b35d6c5
-
SSDEEP
6144:80IEu0/l7rUdoqWMvjcw3sWSAoITM+NPUHFWnejpgPftu5m1t1vlem7Z88N069fi:t79qXvjRc5AoIY+NPUlWnk2Rl37Z7R2r
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 836 rundll32mgr.exe 1628 rundll32mgrmgr.exe 2904 rundll32mgrmgrmgr.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe File created C:\Windows\SysWOW64\rundll32mgrmgr.exe rundll32mgr.exe File created C:\Windows\SysWOW64\rundll32mgrmgrmgr.exe rundll32mgrmgr.exe -
resource yara_rule behavioral2/memory/1628-13-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral2/memory/1628-14-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral2/memory/836-27-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral2/memory/836-26-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral2/memory/1628-20-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral2/memory/1628-15-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral2/memory/836-23-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral2/memory/1628-39-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral2/memory/836-36-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral2/memory/2904-45-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral2/memory/836-47-0x0000000000400000-0x000000000041A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgrmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgrmgrmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2229944062" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135166" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31135166" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434743538" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B0392D0C-81B1-11EF-9A03-CE3473C70610} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B03469D9-81B1-11EF-9A03-CE3473C70610} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2225568964" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135166" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2228537826" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B03206B2-81B1-11EF-9A03-CE3473C70610} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31135166" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2225568964" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2228537826" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135166" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2225568964" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135166" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2225568964" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135166" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135166" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31135166" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2229944062" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 836 rundll32mgr.exe 836 rundll32mgr.exe 836 rundll32mgr.exe 836 rundll32mgr.exe 1628 rundll32mgrmgr.exe 1628 rundll32mgrmgr.exe 1628 rundll32mgrmgr.exe 1628 rundll32mgrmgr.exe 2904 rundll32mgrmgrmgr.exe 2904 rundll32mgrmgrmgr.exe 836 rundll32mgr.exe 836 rundll32mgr.exe 2904 rundll32mgrmgrmgr.exe 2904 rundll32mgrmgrmgr.exe 836 rundll32mgr.exe 836 rundll32mgr.exe 1628 rundll32mgrmgr.exe 1628 rundll32mgrmgr.exe 1628 rundll32mgrmgr.exe 1628 rundll32mgrmgr.exe 2904 rundll32mgrmgrmgr.exe 2904 rundll32mgrmgrmgr.exe 2904 rundll32mgrmgrmgr.exe 2904 rundll32mgrmgrmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 836 rundll32mgr.exe Token: SeDebugPrivilege 1628 rundll32mgrmgr.exe Token: SeDebugPrivilege 2904 rundll32mgrmgrmgr.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2936 iexplore.exe 3412 iexplore.exe 4864 iexplore.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 2936 iexplore.exe 2936 iexplore.exe 4864 iexplore.exe 4864 iexplore.exe 3412 iexplore.exe 3412 iexplore.exe 3540 IEXPLORE.EXE 3540 IEXPLORE.EXE 2952 IEXPLORE.EXE 2952 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 2952 IEXPLORE.EXE 2952 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 3 IoCs
pid Process 1628 rundll32mgrmgr.exe 836 rundll32mgr.exe 2904 rundll32mgrmgrmgr.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 3788 wrote to memory of 1096 3788 rundll32.exe 82 PID 3788 wrote to memory of 1096 3788 rundll32.exe 82 PID 3788 wrote to memory of 1096 3788 rundll32.exe 82 PID 1096 wrote to memory of 836 1096 rundll32.exe 83 PID 1096 wrote to memory of 836 1096 rundll32.exe 83 PID 1096 wrote to memory of 836 1096 rundll32.exe 83 PID 836 wrote to memory of 1628 836 rundll32mgr.exe 84 PID 836 wrote to memory of 1628 836 rundll32mgr.exe 84 PID 836 wrote to memory of 1628 836 rundll32mgr.exe 84 PID 1628 wrote to memory of 2904 1628 rundll32mgrmgr.exe 85 PID 1628 wrote to memory of 2904 1628 rundll32mgrmgr.exe 85 PID 1628 wrote to memory of 2904 1628 rundll32mgrmgr.exe 85 PID 836 wrote to memory of 2936 836 rundll32mgr.exe 86 PID 836 wrote to memory of 2936 836 rundll32mgr.exe 86 PID 1628 wrote to memory of 3412 1628 rundll32mgrmgr.exe 87 PID 1628 wrote to memory of 3412 1628 rundll32mgrmgr.exe 87 PID 2904 wrote to memory of 4864 2904 rundll32mgrmgrmgr.exe 88 PID 2904 wrote to memory of 4864 2904 rundll32mgrmgrmgr.exe 88 PID 3412 wrote to memory of 2952 3412 iexplore.exe 91 PID 3412 wrote to memory of 2952 3412 iexplore.exe 91 PID 3412 wrote to memory of 2952 3412 iexplore.exe 91 PID 2936 wrote to memory of 3540 2936 iexplore.exe 90 PID 2936 wrote to memory of 3540 2936 iexplore.exe 90 PID 2936 wrote to memory of 3540 2936 iexplore.exe 90 PID 4864 wrote to memory of 3068 4864 iexplore.exe 89 PID 4864 wrote to memory of 3068 4864 iexplore.exe 89 PID 4864 wrote to memory of 3068 4864 iexplore.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ffe211e164a0a07cfec3790cab189e0_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ffe211e164a0a07cfec3790cab189e0_JaffaCakes118.dll,#12⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\SysWOW64\rundll32mgrmgr.exeC:\Windows\SysWOW64\rundll32mgrmgr.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\rundll32mgrmgrmgr.exeC:\Windows\SysWOW64\rundll32mgrmgrmgr.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4864 CREDAT:17410 /prefetch:27⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3068
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3412 CREDAT:17410 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2952
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:17410 /prefetch:25⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3540
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD56de4427d02d49cee2c46a8fead1fafa8
SHA1bee49bf0e4452ca72442face8e655bf4a8c3af17
SHA25646d5cd7ff558e5c788807eb674587359c6a660cef091eb420676977e49833d53
SHA512c80311bb92f9f49de96d06e9a76a3ef0310365999f00f401fd003d438b66744a88f093b5887e1723c6b8179798697ec24c4b2bda489323337f6cec6d28ef6434
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD507e9cbd2a190e74b437b18fc990d83f7
SHA11626408a6d0b00799e31460dcdb69bc84f95070e
SHA256bb440cd9e5aa5d997c2bfd40d56bcee202da3efd38438a32cc2fa3e4e8199710
SHA512ee1aa18fe30b63ec0894c0cb4f3b9eab5048c9c8e03c78e84ebdf9d5b74ed628102df25b79c555ed6bd99fde61afc9a93e819d1de6f2e10f29bdfd4f06d43266
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5568f695afd16ac3b8fbb88d8de34c27c
SHA19a5478dedcdd9fe947d4fdb11847ebf764b6e22e
SHA256e266affc22ca7f488529884c4157b1279037607581bcc012a775c7dccf0c5c1a
SHA5120f07d8913be939ee95ec478f4b1a15920adca305dcf604a4d806c9ce3de6cbac2bf942babdbd32486d159585477256c56e8ddbdfcc449d303e13896a7b1648f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5c32df5944cee799a1c783de6d949dc3b
SHA1ca94f3df879ed1e12124f8be91faf92da53f9d33
SHA2561c36932abc179576a55d7e732ed989987816c52dfd45484b0178f44aa6b3ff41
SHA512e11de91818e8d09add217a60de2f89111beeda01c46c85b931b76121f3451b73603fe936c06e4b5dd3bd87f7609cf714086b44f7a2db07f883c7e5d3909ba01a
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B03469D9-81B1-11EF-9A03-CE3473C70610}.dat
Filesize3KB
MD572ad745556f3c5fcacee104955abdd67
SHA1c80db3debeed29d52bf3aaca208a652889877c04
SHA256b91b7ce9e81d74d515cb490a90188fc4ac053ab8064051ccd35f12b9b17393b0
SHA5127fc3f5ddd77438e9cf774424fe1d22f0d8370b423e0dfd515b0e8d60d0cca60f3c4c8be7afed5ac2d60e3e983bcbf22cc9f177a20c1137434acdb23f7c4309df
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B0392D0C-81B1-11EF-9A03-CE3473C70610}.dat
Filesize3KB
MD544141538680c56555080fe3f533719e9
SHA12c3f9f7e911d266e061feae5c0922b4e9db8b308
SHA256175d940fe98d07d168d26140b72ff8ba09ce22f6266ff9df7e64ec7d842671c7
SHA5126e19c6d14c19cee17932f8165cc48ae5145cf8c0c7c0daf4515a7827f586c28a1628b44a5f6063d5ad3c331be4d03776122166c623c82e5992f4cb118277dc66
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B0392D0C-81B1-11EF-9A03-CE3473C70610}.dat
Filesize5KB
MD5a8d9550081936de540aaafed724e2520
SHA1f72b4dea10d09175c9f3d4390910777e00fdb0e4
SHA256bcc5bc992678caed77abda905991d1c0173e3bc51b51f922f51490b5cb748231
SHA512f4c5ad9c8687c9a8c8c02e58307c408d8b8af9a82cbf76a2dd4ea2e0d834193eca729d45af97e046d993a97b741a52880debb3ae13fe15a5063adede64f4192f
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
279KB
MD56cd9867676d7745d3d892b9b1eeb087c
SHA1e27cd410d1e1cd2795931b2e9b4525ef2535ce8a
SHA256372e00e34f497e57ddc1762cc01ed91ff77e3d6c6745b37f209d29da9c2c3d94
SHA5125ab8bc024bedf78e585940e9d4e2e8b287591deadd4fe97880008b94609e1518ad430fba934f2c22227723f48deb72053a49bcf48d40e4fd85fd38069eba99e2
-
Filesize
184KB
MD59f643774ee392ba1e6c40644a9aa7de6
SHA18c55f086c5610977b4a84c0e0d77bfdf95bbe0d5
SHA256307f2832c7cc23dfecff7b9787f454bed0fc1e31f63950cff5660fabae333003
SHA5124b0effc99a0baa1de5d2a7f310c8c628e5ae5553ff5e31c7408751baddd9fd88fb22a12098cac22ec51edae84437cbb9fc0bd5f2ed645e7c6f30bfd69c08925b
-
Filesize
91KB
MD5551161ba25d6c58cf6a4afe7587f7dcb
SHA13f36d947c0d082433bb121a9914b4841ffbfb5af
SHA256f676ab20252c6ff437c7e3db1a8a3875715bf1a5a59812439f296cb5cd724b58
SHA512f68a52bcfafccaf9b4390f7cdd9a57544d82a1f41656aeaf98f46ddc0198e636a790088cf8b734244cc5144a00704a8430e469c46284387d04c5a38cba17b00e