Analysis
- max time kernel
93s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
04/10/2024, 21:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1500fd885ac9073066ba718b4f1e5165_JaffaCakes118.dll
Resource
win7-20240708-en
windows7-x64
22 signatures
150 seconds
General
- Target 1500fd885ac9073066ba718b4f1e5165_JaffaCakes118.dll
- Size 256KB
- Sample241004-1hfp5sscmd
- SHA256 05d31efd70537890038e4e3f70f5aada6c211cc97acc252515987f4a809bc26d
- MD5 1500fd885ac9073066ba718b4f1e5165
- SHA1 89af83c4fb1535392ce42480ac87e3cc546bbe71
- SHA512 03567e8ac299a2aaf7364d91e8d6839ecfd86716154b32dec5e33853f3de2627c9aedd7f4a47bd6cef5fbf5ffd0745b63aa99e26dbe0b1cccbf1d2e487b0ed92
- SSDEEP 3072:J4vRJRkTcZ7fcxdl5CTVBoEBClwrnfJMtZbzOPrL97iTIHHgGCEmcz0ju7UTrTzr:JfHngrdiTIgGCEmcf7U5u
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" ratjkpvo.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" ratjkpvo.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" ratjkpvo.exe - Modifies security service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" ratjkpvo.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4" ratjkpvo.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Start = "4" ratjkpvo.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ratjkpvo.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ratjkpvo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ratjkpvo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ratjkpvo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ratjkpvo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ratjkpvo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ratjkpvo.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation t32KY8d5k Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation ratjkpvo.exe - Executes dropped EXE 6 IoCs
pid Process 3484 t32KY8d5k 4764 t32KY8d5k 5052 ratjkpvo.exe 4572 ratjkpvo.exe 4668 ratjkpvo.exe 1376 ratjkpvo.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ratjkpvo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ratjkpvo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ratjkpvo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ratjkpvo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ratjkpvo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ratjkpvo.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ratjkpvo.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3484 set thread context of 4764 3484 t32KY8d5k 84 PID 5052 set thread context of 4572 5052 ratjkpvo.exe 108 PID 4668 set thread context of 1376 4668 ratjkpvo.exe 112 -
resource yara_rule behavioral2/memory/4764-24-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4764-14-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4764-16-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4764-11-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4764-27-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4764-28-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4764-29-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4764-34-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4764-36-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4572-70-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1376-82-0x0000000000400000-0x0000000000436000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
pid pid_target Process procid_target 736 1480 WerFault.exe 4968 4748 WerFault.exe 99 - System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language t32KY8d5k Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ratjkpvo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ratjkpvo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ratjkpvo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language t32KY8d5k Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3846797035" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434842914" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3846797035" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135397" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135397" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{10E712A1-8299-11EF-98CC-DA2E3A28CA1B} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31135397" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135397" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3849766149" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4046640914" IEXPLORE.EXE - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 656 Process not Found - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeSecurityPrivilege 4764 t32KY8d5k Token: SeDebugPrivilege 4764 t32KY8d5k Token: SeSecurityPrivilege 4572 ratjkpvo.exe Token: SeSecurityPrivilege 1376 ratjkpvo.exe Token: SeLoadDriverPrivilege 1376 ratjkpvo.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3580 IEXPLORE.EXE 3580 IEXPLORE.EXE - Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 3484 t32KY8d5k 3580 IEXPLORE.EXE 3580 IEXPLORE.EXE 5048 IEXPLORE.EXE 5048 IEXPLORE.EXE 5048 IEXPLORE.EXE 5048 IEXPLORE.EXE 3580 IEXPLORE.EXE 3580 IEXPLORE.EXE 1976 IEXPLORE.EXE 1976 IEXPLORE.EXE 1976 IEXPLORE.EXE 1976 IEXPLORE.EXE 5052 ratjkpvo.exe 4668 ratjkpvo.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3076 wrote to memory of 2464 3076 rundll32.exe 82 PID 3076 wrote to memory of 2464 3076 rundll32.exe 82 PID 3076 wrote to memory of 2464 3076 rundll32.exe 82 PID 2464 wrote to memory of 3484 2464 rundll32.exe 83 PID 2464 wrote to memory of 3484 2464 rundll32.exe 83 PID 2464 wrote to memory of 3484 2464 rundll32.exe 83 PID 3484 wrote to memory of 4764 3484 t32KY8d5k 84 PID 3484 wrote to memory of 4764 3484 t32KY8d5k 84 PID 3484 wrote to memory of 4764 3484 t32KY8d5k 84 PID 3484 wrote to memory of 4764 3484 t32KY8d5k 84 PID 3484 wrote to memory of 4764 3484 t32KY8d5k 84 PID 3484 wrote to memory of 4764 3484 t32KY8d5k 84 PID 3484 wrote to memory of 4764 3484 t32KY8d5k 84 PID 4764 wrote to memory of 1480 4764 t32KY8d5k 85 PID 4764 wrote to memory of 1480 4764 t32KY8d5k 85 PID 4764 wrote to memory of 1480 4764 t32KY8d5k 85 PID 4764 wrote to memory of 1480 4764 t32KY8d5k 85 PID 4764 wrote to memory of 1480 4764 t32KY8d5k 85 PID 4764 wrote to memory of 1480 4764 t32KY8d5k 85 PID 4764 wrote to memory of 1480 4764 t32KY8d5k 85 PID 4764 wrote to memory of 1480 4764 t32KY8d5k 85 PID 4764 wrote to memory of 1480 4764 t32KY8d5k 85 PID 4764 wrote to memory of 1480 4764 t32KY8d5k 85 PID 4764 wrote to memory of 2276 4764 t32KY8d5k 92 PID 4764 wrote to memory of 2276 4764 t32KY8d5k 92 PID 4764 wrote to memory of 2276 4764 t32KY8d5k 92 PID 2276 wrote to memory of 3580 2276 iexplore.exe 93 PID 2276 wrote to memory of 3580 2276 iexplore.exe 93 PID 3580 wrote to memory of 5048 3580 IEXPLORE.EXE 95 PID 3580 wrote to memory of 5048 3580 IEXPLORE.EXE 95 PID 3580 wrote to memory of 5048 3580 IEXPLORE.EXE 95 PID 4764 wrote to memory of 4748 4764 t32KY8d5k 99 PID 4764 wrote to memory of 4748 4764 t32KY8d5k 99 PID 4764 wrote to memory of 4748 4764 t32KY8d5k 99 PID 4764 wrote to memory of 4748 4764 t32KY8d5k 99 PID 4764 wrote to memory of 4748 4764 t32KY8d5k 99 PID 4764 wrote to memory of 4748 4764 t32KY8d5k 99 PID 4764 wrote to memory of 4748 4764 t32KY8d5k 99 PID 4764 wrote to memory of 4748 4764 t32KY8d5k 99 PID 4764 wrote to memory of 4748 4764 t32KY8d5k 99 PID 4764 wrote to memory of 4748 4764 t32KY8d5k 99 PID 4764 wrote to memory of 2372 4764 t32KY8d5k 103 PID 4764 wrote to memory of 2372 4764 t32KY8d5k 103 PID 4764 wrote to memory of 2372 4764 t32KY8d5k 103 PID 2372 wrote to memory of 4552 2372 iexplore.exe 104 PID 2372 wrote to memory of 4552 2372 iexplore.exe 104 PID 3580 wrote to memory of 1976 3580 IEXPLORE.EXE 105 PID 3580 wrote to memory of 1976 3580 IEXPLORE.EXE 105 PID 3580 wrote to memory of 1976 3580 IEXPLORE.EXE 105 PID 4764 wrote to memory of 5052 4764 t32KY8d5k 107 PID 4764 wrote to memory of 5052 4764 t32KY8d5k 107 PID 4764 wrote to memory of 5052 4764 t32KY8d5k 107 PID 5052 wrote to memory of 4572 5052 ratjkpvo.exe 108 PID 5052 wrote to memory of 4572 5052 ratjkpvo.exe 108 PID 5052 wrote to memory of 4572 5052 ratjkpvo.exe 108 PID 5052 wrote to memory of 4572 5052 ratjkpvo.exe 108 PID 5052 wrote to memory of 4572 5052 ratjkpvo.exe 108 PID 5052 wrote to memory of 4572 5052 ratjkpvo.exe 108 PID 5052 wrote to memory of 4572 5052 ratjkpvo.exe 108 PID 4572 wrote to memory of 1220 4572 ratjkpvo.exe 109 PID 4572 wrote to memory of 1220 4572 ratjkpvo.exe 109 PID 4572 wrote to memory of 1220 4572 ratjkpvo.exe 109 PID 1220 wrote to memory of 4668 1220 cmd.exe 111 PID 1220 wrote to memory of 4668 1220 cmd.exe 111 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ratjkpvo.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1500fd885ac9073066ba718b4f1e5165_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1500fd885ac9073066ba718b4f1e5165_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\t32KY8d5k"t32KY8d5k"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\t32KY8d5k"t32KY8d5k"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵PID:1480
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 1966⤵
- Program crash
PID:736
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3580 CREDAT:17410 /prefetch:27⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5048
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3580 CREDAT:17416 /prefetch:27⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1976
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵PID:4748
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 2086⤵
- Program crash
PID:4968
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"6⤵
- Modifies Internet Explorer settings
PID:4552
-
-
-
C:\Users\Admin\AppData\Local\Temp\ratjkpvo.exe"C:\Users\Admin\AppData\Local\Temp\ratjkpvo.exe" elevate5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\ratjkpvo.exe"C:\Users\Admin\AppData\Local\Temp\ratjkpvo.exe" elevate6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\ratjkpvo.exe"" admin7⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\ratjkpvo.exe"C:\Users\Admin\AppData\Local\Temp\ratjkpvo.exe" admin8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\ratjkpvo.exe"C:\Users\Admin\AppData\Local\Temp\ratjkpvo.exe" admin9⤵
- Modifies firewall policy service
- Modifies security service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1376
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1480 -ip 14801⤵PID:4020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4748 -ip 47481⤵PID:3388
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
2Windows Service
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 471B
- SHA256 1ae4c8aa37bf433bc5b3b45e017c95bf843c7dbbe348c78c7ab6f3cad0fda4b8
- MD5 db7c83e09ebc4317f2bf2df7f66b8513
- SHA1 29d58ef43f72ce7cf79ce6109d038a6c9b4873f0
- SHA512 6eb46ae0c3e091ba13b1c0e3fb6de568882940df7968d0e1297568ea5356a4691f2a869c7c9ac9e9642bcc2e4e1388d00b15c663276143e8cb5015ab89c27867
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 404B
- SHA256 c376e16d44279ff34dbe6d5235385ab3fe1fedc6c751e7cd06f3c0284a75b97f
- MD5 128c76ec71973d2d34eed7b5e2849eb1
- SHA1 eb800c5452a46cea4121f47b963b1c6f486767e1
- SHA512 407ab103c710df28d04f89e4407063e95b572807c38b62fecfe4038e503d78af06560c394739b3679251782513a72962d5e84a442ca5d72de0c98e3b34e8ba5d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NUB8HZ4Z\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\t32KY8d5k
- Size 99KB
- SHA256 8bf10012bf59dbc3f6509bbf1dc12490779fc5962aa37fcebbcc434e2612371c
- MD5 33ace2a98e6aa56dbd6f1ae58a9af9ae
- SHA1 67de6edab77318d997f002c9884dd08069612570
- SHA512 ea77d71297f7ef842f0c1c7b6f8eb53f8d6d3f223d4f5d2bb4214102601a1197f038a1339d5245ed87671947e90910b78cbe7081d05c0e5cedd55b0726e362f5
- SSDEEP 1536:PpXNSNi6dZUDH/MxdJc+mKOv2OZd3rWO3BRQCo/dYx5VjHq1hJXEmPsMKQ75xax3:PdbYekJPOgO3Xd35NKtXZPsHQ20R
- MD5 SHA1 SHA512 SSDEEP