Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240910-en - resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system - submitted
04/10/2024, 03:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
11bbdd4a9680ae410a2ff53608ddef6d_JaffaCakes118.dll
Resource
win7-20240903-en
windows7-x64
22 signatures
150 seconds
General
- Target 11bbdd4a9680ae410a2ff53608ddef6d_JaffaCakes118.dll
- Size 148KB
- Sample241004-ehcgtstanm
- SHA256 21475aa008cd334f747a2933b2ac3aadae4ba11bfacdb296663a92e8622fe55a
- MD5 11bbdd4a9680ae410a2ff53608ddef6d
- SHA1 f074fa890b73d40f831dc055aed7ab1bac03a923
- SHA512 b03ee60492d819b899d9c0773e1dc92e2cf146869e1eb96d8c41319cb3e2d2ae1ecf1b83b1da558b542e9404e8aadb6ae54cfc8428975e55c2d82ae6e62bf1b8
- SSDEEP 3072:uQTEWTo0qWBGtMwfxEHOxqaIE7P6fAaYmAnuB8xaAX7d:uCToPWBQDj+Kmoza
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" beomvcvf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" beomvcvf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" beomvcvf.exe - Modifies security service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" beomvcvf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4" beomvcvf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Start = "4" beomvcvf.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" beomvcvf.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" beomvcvf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" beomvcvf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" beomvcvf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" beomvcvf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" beomvcvf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" beomvcvf.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation beomvcvf.exe Key value queried \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation rvtql1X1e - Executes dropped EXE 6 IoCs
pid Process 2084 rvtql1X1e 4044 rvtql1X1e 2420 beomvcvf.exe 2320 beomvcvf.exe 2484 beomvcvf.exe 2192 beomvcvf.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" beomvcvf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" beomvcvf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" beomvcvf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" beomvcvf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" beomvcvf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" beomvcvf.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" beomvcvf.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2084 set thread context of 4044 2084 rvtql1X1e 87 PID 2420 set thread context of 2320 2420 beomvcvf.exe 110 PID 2484 set thread context of 2192 2484 beomvcvf.exe 114 -
resource yara_rule behavioral2/memory/4044-11-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4044-16-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4044-20-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4044-14-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4044-26-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4044-27-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4044-30-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4044-33-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4044-34-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2320-61-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2192-77-0x0000000000400000-0x0000000000436000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvtql1X1e Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beomvcvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvtql1X1e Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beomvcvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beomvcvf.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135249" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1890278457" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434779152" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1886059819" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31135249" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135249" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9C1948EB-8204-11EF-B35C-E64C6368AA88} = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135249" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2086684839" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1886059819" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 664 Process not Found - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeSecurityPrivilege 4044 rvtql1X1e Token: SeDebugPrivilege 4044 rvtql1X1e Token: SeSecurityPrivilege 2320 beomvcvf.exe Token: SeSecurityPrivilege 2192 beomvcvf.exe Token: SeLoadDriverPrivilege 2192 beomvcvf.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1836 IEXPLORE.EXE 1836 IEXPLORE.EXE - Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 2084 rvtql1X1e 1836 IEXPLORE.EXE 1836 IEXPLORE.EXE 5088 IEXPLORE.EXE 5088 IEXPLORE.EXE 5088 IEXPLORE.EXE 5088 IEXPLORE.EXE 1836 IEXPLORE.EXE 1836 IEXPLORE.EXE 4500 IEXPLORE.EXE 4500 IEXPLORE.EXE 4500 IEXPLORE.EXE 4500 IEXPLORE.EXE 2420 beomvcvf.exe 2484 beomvcvf.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4136 wrote to memory of 4948 4136 rundll32.exe 84 PID 4136 wrote to memory of 4948 4136 rundll32.exe 84 PID 4136 wrote to memory of 4948 4136 rundll32.exe 84 PID 4948 wrote to memory of 2084 4948 rundll32.exe 85 PID 4948 wrote to memory of 2084 4948 rundll32.exe 85 PID 4948 wrote to memory of 2084 4948 rundll32.exe 85 PID 2084 wrote to memory of 4044 2084 rvtql1X1e 87 PID 2084 wrote to memory of 4044 2084 rvtql1X1e 87 PID 2084 wrote to memory of 4044 2084 rvtql1X1e 87 PID 2084 wrote to memory of 4044 2084 rvtql1X1e 87 PID 2084 wrote to memory of 4044 2084 rvtql1X1e 87 PID 2084 wrote to memory of 4044 2084 rvtql1X1e 87 PID 2084 wrote to memory of 4044 2084 rvtql1X1e 87 PID 4044 wrote to memory of 2344 4044 rvtql1X1e 88 PID 4044 wrote to memory of 2344 4044 rvtql1X1e 88 PID 4044 wrote to memory of 2344 4044 rvtql1X1e 88 PID 4044 wrote to memory of 2344 4044 rvtql1X1e 88 PID 4044 wrote to memory of 2344 4044 rvtql1X1e 88 PID 4044 wrote to memory of 2344 4044 rvtql1X1e 88 PID 4044 wrote to memory of 2344 4044 rvtql1X1e 88 PID 4044 wrote to memory of 2344 4044 rvtql1X1e 88 PID 4044 wrote to memory of 2344 4044 rvtql1X1e 88 PID 4044 wrote to memory of 2344 4044 rvtql1X1e 88 PID 4044 wrote to memory of 4596 4044 rvtql1X1e 99 PID 4044 wrote to memory of 4596 4044 rvtql1X1e 99 PID 4044 wrote to memory of 4596 4044 rvtql1X1e 99 PID 4596 wrote to memory of 1836 4596 iexplore.exe 100 PID 4596 wrote to memory of 1836 4596 iexplore.exe 100 PID 1836 wrote to memory of 5088 1836 IEXPLORE.EXE 101 PID 1836 wrote to memory of 5088 1836 IEXPLORE.EXE 101 PID 1836 wrote to memory of 5088 1836 IEXPLORE.EXE 101 PID 4044 wrote to memory of 1428 4044 rvtql1X1e 102 PID 4044 wrote to memory of 1428 4044 rvtql1X1e 102 PID 4044 wrote to memory of 1428 4044 rvtql1X1e 102 PID 4044 wrote to memory of 1428 4044 rvtql1X1e 102 PID 4044 wrote to memory of 1428 4044 rvtql1X1e 102 PID 4044 wrote to memory of 1428 4044 rvtql1X1e 102 PID 4044 wrote to memory of 1428 4044 rvtql1X1e 102 PID 4044 wrote to memory of 1428 4044 rvtql1X1e 102 PID 4044 wrote to memory of 1428 4044 rvtql1X1e 102 PID 4044 wrote to memory of 1428 4044 rvtql1X1e 102 PID 4044 wrote to memory of 1784 4044 rvtql1X1e 105 PID 4044 wrote to memory of 1784 4044 rvtql1X1e 105 PID 4044 wrote to memory of 1784 4044 rvtql1X1e 105 PID 1784 wrote to memory of 1048 1784 iexplore.exe 106 PID 1784 wrote to memory of 1048 1784 iexplore.exe 106 PID 1836 wrote to memory of 4500 1836 IEXPLORE.EXE 107 PID 1836 wrote to memory of 4500 1836 IEXPLORE.EXE 107 PID 1836 wrote to memory of 4500 1836 IEXPLORE.EXE 107 PID 4044 wrote to memory of 2420 4044 rvtql1X1e 109 PID 4044 wrote to memory of 2420 4044 rvtql1X1e 109 PID 4044 wrote to memory of 2420 4044 rvtql1X1e 109 PID 2420 wrote to memory of 2320 2420 beomvcvf.exe 110 PID 2420 wrote to memory of 2320 2420 beomvcvf.exe 110 PID 2420 wrote to memory of 2320 2420 beomvcvf.exe 110 PID 2420 wrote to memory of 2320 2420 beomvcvf.exe 110 PID 2420 wrote to memory of 2320 2420 beomvcvf.exe 110 PID 2420 wrote to memory of 2320 2420 beomvcvf.exe 110 PID 2420 wrote to memory of 2320 2420 beomvcvf.exe 110 PID 2320 wrote to memory of 4200 2320 beomvcvf.exe 111 PID 2320 wrote to memory of 4200 2320 beomvcvf.exe 111 PID 2320 wrote to memory of 4200 2320 beomvcvf.exe 111 PID 4200 wrote to memory of 2484 4200 cmd.exe 113 PID 4200 wrote to memory of 2484 4200 cmd.exe 113 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" beomvcvf.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\11bbdd4a9680ae410a2ff53608ddef6d_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\11bbdd4a9680ae410a2ff53608ddef6d_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\rvtql1X1e"rvtql1X1e"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\rvtql1X1e"rvtql1X1e"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵PID:2344
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1836 CREDAT:17410 /prefetch:27⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5088
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1836 CREDAT:17416 /prefetch:27⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4500
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵PID:1428
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"6⤵
- Modifies Internet Explorer settings
PID:1048
-
-
-
C:\Users\Admin\AppData\Local\Temp\beomvcvf.exe"C:\Users\Admin\AppData\Local\Temp\beomvcvf.exe" elevate5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\beomvcvf.exe"C:\Users\Admin\AppData\Local\Temp\beomvcvf.exe" elevate6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\beomvcvf.exe"" admin7⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\beomvcvf.exe"C:\Users\Admin\AppData\Local\Temp\beomvcvf.exe" admin8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\beomvcvf.exe"C:\Users\Admin\AppData\Local\Temp\beomvcvf.exe" admin9⤵
- Modifies firewall policy service
- Modifies security service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2192
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
2Windows Service
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RPQ9CKS7\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\rvtql1X1e
- Size 99KB
- SHA256 8bf10012bf59dbc3f6509bbf1dc12490779fc5962aa37fcebbcc434e2612371c
- MD5 33ace2a98e6aa56dbd6f1ae58a9af9ae
- SHA1 67de6edab77318d997f002c9884dd08069612570
- SHA512 ea77d71297f7ef842f0c1c7b6f8eb53f8d6d3f223d4f5d2bb4214102601a1197f038a1339d5245ed87671947e90910b78cbe7081d05c0e5cedd55b0726e362f5
- SSDEEP 1536:PpXNSNi6dZUDH/MxdJc+mKOv2OZd3rWO3BRQCo/dYx5VjHq1hJXEmPsMKQ75xax3:PdbYekJPOgO3Xd35NKtXZPsHQ20R
- MD5 SHA1 SHA512 SSDEEP