Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 05:20
Static task
static1
Behavioral task
behavioral1
Sample
1651bcc888424d427c01013e8e798903_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
1651bcc888424d427c01013e8e798903_JaffaCakes118.dll
-
Size
178KB
-
MD5
1651bcc888424d427c01013e8e798903
-
SHA1
9c41ee9dcfc7aef934bda221c5713598a8353107
-
SHA256
c13d67f1836cacca25cf768824de9f481d6cc3e862bcae2bb0e086189cecd03d
-
SHA512
89e3953e7de2f82182ce485d6840693591235bf9a4d58f558d0fee992d74c9ffe8dbf4154f80ad85a19702181475eb478c90f3eb29c345070ebacead6bb9e997
-
SSDEEP
3072:x4yriLc3IcqB0NljYUvfT/SmNp94Z7yifCKXZ5q1n3hApWQrIcH2zAn:1uLRcZBPvukp4lCKXZ5q1Rqr
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation p7q0EPZi Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation iivydijocjbosbgc.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation iivydijocjbosbgc.exe -
Executes dropped EXE 8 IoCs
pid Process 4344 p7q0EPZi 216 p7q0EPZi 3624 iivydijocjbosbgc.exe 1344 iivydijocjbosbgc.exe 4388 iivydijocjbosbgc.exe 4468 iivydijocjbosbgc.exe 4812 iivydijocjbosbgc.exe 1472 iivydijocjbosbgc.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4344 set thread context of 216 4344 p7q0EPZi 84 PID 3624 set thread context of 1344 3624 iivydijocjbosbgc.exe 108 PID 4388 set thread context of 4468 4388 iivydijocjbosbgc.exe 122 PID 4812 set thread context of 1472 4812 iivydijocjbosbgc.exe 135 -
resource yara_rule behavioral2/memory/216-9-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/216-10-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/216-12-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/216-17-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/216-6-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/216-20-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/216-22-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/216-27-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/216-28-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1344-61-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1344-66-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1344-78-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4468-93-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4468-97-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4468-101-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1472-116-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 7 IoCs
pid pid_target Process procid_target 1376 2484 WerFault.exe 85 4928 5008 WerFault.exe 97 4796 1944 WerFault.exe 109 1552 2932 WerFault.exe 115 2900 4376 WerFault.exe 123 332 2080 WerFault.exe 128 4940 1096 WerFault.exe 136 -
System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iivydijocjbosbgc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iivydijocjbosbgc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language p7q0EPZi Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language p7q0EPZi Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iivydijocjbosbgc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iivydijocjbosbgc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iivydijocjbosbgc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iivydijocjbosbgc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1546624625" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434870601" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{87A977B4-82D9-11EF-BFD9-DE20CD0D11AA} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3400000034000000ba04000099020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1545530980" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31135462" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135462" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1546624625" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135462" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff00000000000000008604000065020000 IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff1a0000001a000000a00400007f020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135462" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1545530980" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31135462" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1744593761" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff720000001a000000f80400007f020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeSecurityPrivilege 216 p7q0EPZi Token: SeDebugPrivilege 216 p7q0EPZi Token: SeSecurityPrivilege 1344 iivydijocjbosbgc.exe Token: SeDebugPrivilege 1344 iivydijocjbosbgc.exe Token: SeSecurityPrivilege 4468 iivydijocjbosbgc.exe Token: SeDebugPrivilege 4468 iivydijocjbosbgc.exe Token: SeSecurityPrivilege 1472 iivydijocjbosbgc.exe Token: SeDebugPrivilege 1472 iivydijocjbosbgc.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 184 IEXPLORE.EXE 184 IEXPLORE.EXE 184 IEXPLORE.EXE 184 IEXPLORE.EXE 184 IEXPLORE.EXE 184 IEXPLORE.EXE 184 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 42 IoCs
pid Process 184 IEXPLORE.EXE 184 IEXPLORE.EXE 1892 IEXPLORE.EXE 1892 IEXPLORE.EXE 1892 IEXPLORE.EXE 1892 IEXPLORE.EXE 184 IEXPLORE.EXE 184 IEXPLORE.EXE 3452 IEXPLORE.EXE 3452 IEXPLORE.EXE 3452 IEXPLORE.EXE 3452 IEXPLORE.EXE 184 IEXPLORE.EXE 184 IEXPLORE.EXE 4144 IEXPLORE.EXE 4144 IEXPLORE.EXE 4144 IEXPLORE.EXE 4144 IEXPLORE.EXE 184 IEXPLORE.EXE 184 IEXPLORE.EXE 5072 IEXPLORE.EXE 5072 IEXPLORE.EXE 5072 IEXPLORE.EXE 5072 IEXPLORE.EXE 184 IEXPLORE.EXE 184 IEXPLORE.EXE 3452 IEXPLORE.EXE 3452 IEXPLORE.EXE 3452 IEXPLORE.EXE 3452 IEXPLORE.EXE 184 IEXPLORE.EXE 184 IEXPLORE.EXE 2988 IEXPLORE.EXE 2988 IEXPLORE.EXE 2988 IEXPLORE.EXE 2988 IEXPLORE.EXE 184 IEXPLORE.EXE 184 IEXPLORE.EXE 4144 IEXPLORE.EXE 4144 IEXPLORE.EXE 4144 IEXPLORE.EXE 4144 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4936 wrote to memory of 2640 4936 regsvr32.exe 82 PID 4936 wrote to memory of 2640 4936 regsvr32.exe 82 PID 4936 wrote to memory of 2640 4936 regsvr32.exe 82 PID 2640 wrote to memory of 4344 2640 regsvr32.exe 83 PID 2640 wrote to memory of 4344 2640 regsvr32.exe 83 PID 2640 wrote to memory of 4344 2640 regsvr32.exe 83 PID 4344 wrote to memory of 216 4344 p7q0EPZi 84 PID 4344 wrote to memory of 216 4344 p7q0EPZi 84 PID 4344 wrote to memory of 216 4344 p7q0EPZi 84 PID 4344 wrote to memory of 216 4344 p7q0EPZi 84 PID 4344 wrote to memory of 216 4344 p7q0EPZi 84 PID 4344 wrote to memory of 216 4344 p7q0EPZi 84 PID 4344 wrote to memory of 216 4344 p7q0EPZi 84 PID 216 wrote to memory of 2484 216 p7q0EPZi 85 PID 216 wrote to memory of 2484 216 p7q0EPZi 85 PID 216 wrote to memory of 2484 216 p7q0EPZi 85 PID 216 wrote to memory of 2484 216 p7q0EPZi 85 PID 216 wrote to memory of 2484 216 p7q0EPZi 85 PID 216 wrote to memory of 2484 216 p7q0EPZi 85 PID 216 wrote to memory of 2484 216 p7q0EPZi 85 PID 216 wrote to memory of 2484 216 p7q0EPZi 85 PID 216 wrote to memory of 2484 216 p7q0EPZi 85 PID 216 wrote to memory of 1616 216 p7q0EPZi 89 PID 216 wrote to memory of 1616 216 p7q0EPZi 89 PID 216 wrote to memory of 1616 216 p7q0EPZi 89 PID 1616 wrote to memory of 184 1616 iexplore.exe 90 PID 1616 wrote to memory of 184 1616 iexplore.exe 90 PID 184 wrote to memory of 1892 184 IEXPLORE.EXE 91 PID 184 wrote to memory of 1892 184 IEXPLORE.EXE 91 PID 184 wrote to memory of 1892 184 IEXPLORE.EXE 91 PID 216 wrote to memory of 5008 216 p7q0EPZi 97 PID 216 wrote to memory of 5008 216 p7q0EPZi 97 PID 216 wrote to memory of 5008 216 p7q0EPZi 97 PID 216 wrote to memory of 5008 216 p7q0EPZi 97 PID 216 wrote to memory of 5008 216 p7q0EPZi 97 PID 216 wrote to memory of 5008 216 p7q0EPZi 97 PID 216 wrote to memory of 5008 216 p7q0EPZi 97 PID 216 wrote to memory of 5008 216 p7q0EPZi 97 PID 216 wrote to memory of 5008 216 p7q0EPZi 97 PID 216 wrote to memory of 4544 216 p7q0EPZi 104 PID 216 wrote to memory of 4544 216 p7q0EPZi 104 PID 216 wrote to memory of 4544 216 p7q0EPZi 104 PID 4544 wrote to memory of 3224 4544 iexplore.exe 105 PID 4544 wrote to memory of 3224 4544 iexplore.exe 105 PID 184 wrote to memory of 3452 184 IEXPLORE.EXE 106 PID 184 wrote to memory of 3452 184 IEXPLORE.EXE 106 PID 184 wrote to memory of 3452 184 IEXPLORE.EXE 106 PID 216 wrote to memory of 3624 216 p7q0EPZi 107 PID 216 wrote to memory of 3624 216 p7q0EPZi 107 PID 216 wrote to memory of 3624 216 p7q0EPZi 107 PID 3624 wrote to memory of 1344 3624 iivydijocjbosbgc.exe 108 PID 3624 wrote to memory of 1344 3624 iivydijocjbosbgc.exe 108 PID 3624 wrote to memory of 1344 3624 iivydijocjbosbgc.exe 108 PID 3624 wrote to memory of 1344 3624 iivydijocjbosbgc.exe 108 PID 3624 wrote to memory of 1344 3624 iivydijocjbosbgc.exe 108 PID 3624 wrote to memory of 1344 3624 iivydijocjbosbgc.exe 108 PID 3624 wrote to memory of 1344 3624 iivydijocjbosbgc.exe 108 PID 1344 wrote to memory of 1944 1344 iivydijocjbosbgc.exe 109 PID 1344 wrote to memory of 1944 1344 iivydijocjbosbgc.exe 109 PID 1344 wrote to memory of 1944 1344 iivydijocjbosbgc.exe 109 PID 1344 wrote to memory of 1944 1344 iivydijocjbosbgc.exe 109 PID 1344 wrote to memory of 1944 1344 iivydijocjbosbgc.exe 109 PID 1344 wrote to memory of 1944 1344 iivydijocjbosbgc.exe 109 PID 1344 wrote to memory of 1944 1344 iivydijocjbosbgc.exe 109
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1651bcc888424d427c01013e8e798903_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\1651bcc888424d427c01013e8e798903_JaffaCakes118.dll2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\p7q0EPZi"p7q0EPZi"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\p7q0EPZiC:\Users\Admin\AppData\Local\Temp\p7q0EPZi4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵PID:2484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 2046⤵
- Program crash
PID:1376
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:184 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:184 CREDAT:17410 /prefetch:27⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1892
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:184 CREDAT:17416 /prefetch:27⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3452
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:184 CREDAT:17422 /prefetch:27⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4144
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:184 CREDAT:17428 /prefetch:27⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5072
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:184 CREDAT:17438 /prefetch:27⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2988
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵PID:5008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 2046⤵
- Program crash
PID:4928
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"6⤵
- Modifies Internet Explorer settings
PID:3224
-
-
-
C:\Users\Admin\AppData\Local\Temp\iivydijocjbosbgc.exe"C:\Users\Admin\AppData\Local\Temp\iivydijocjbosbgc.exe" elevate5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\iivydijocjbosbgc.exeC:\Users\Admin\AppData\Local\Temp\iivydijocjbosbgc.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe7⤵PID:1944
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 2048⤵
- Program crash
PID:4796
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"7⤵
- System Location Discovery: System Language Discovery
PID:2636 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"8⤵
- Modifies Internet Explorer settings
PID:1556
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe7⤵PID:2932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 2168⤵
- Program crash
PID:1552
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"7⤵
- System Location Discovery: System Language Discovery
PID:2412 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"8⤵
- Modifies Internet Explorer settings
PID:3104
-
-
-
C:\Users\Admin\AppData\Local\Temp\iivydijocjbosbgc.exe"C:\Users\Admin\AppData\Local\Temp\iivydijocjbosbgc.exe" elevate7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\iivydijocjbosbgc.exeC:\Users\Admin\AppData\Local\Temp\iivydijocjbosbgc.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4468 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe9⤵PID:4376
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 20410⤵
- Program crash
PID:2900
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"9⤵
- System Location Discovery: System Language Discovery
PID:3900 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"10⤵
- Modifies Internet Explorer settings
PID:1752
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe9⤵PID:2080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 20810⤵
- Program crash
PID:332
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"9⤵
- System Location Discovery: System Language Discovery
PID:1944 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"10⤵
- Modifies Internet Explorer settings
PID:4584
-
-
-
C:\Users\Admin\AppData\Local\Temp\iivydijocjbosbgc.exe"C:\Users\Admin\AppData\Local\Temp\iivydijocjbosbgc.exe" elevate9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\iivydijocjbosbgc.exeC:\Users\Admin\AppData\Local\Temp\iivydijocjbosbgc.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1472 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe11⤵PID:1096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 20412⤵
- Program crash
PID:4940
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"11⤵
- System Location Discovery: System Language Discovery
PID:3904 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"12⤵
- Modifies Internet Explorer settings
PID:60
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2484 -ip 24841⤵PID:1576
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5008 -ip 50081⤵PID:4136
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1944 -ip 19441⤵PID:4268
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2932 -ip 29321⤵PID:3360
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4376 -ip 43761⤵PID:4576
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2080 -ip 20801⤵PID:4172
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1096 -ip 10961⤵PID:788
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5db7c83e09ebc4317f2bf2df7f66b8513
SHA129d58ef43f72ce7cf79ce6109d038a6c9b4873f0
SHA2561ae4c8aa37bf433bc5b3b45e017c95bf843c7dbbe348c78c7ab6f3cad0fda4b8
SHA5126eb46ae0c3e091ba13b1c0e3fb6de568882940df7968d0e1297568ea5356a4691f2a869c7c9ac9e9642bcc2e4e1388d00b15c663276143e8cb5015ab89c27867
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5bff60abf95b9474e77f9c49f0cb4f16c
SHA1a6e465103aceb723bef8eafa7882092643599339
SHA2567dcee6f463200b34291e580b32a6063a7e83c600f1e8569611d7d7aadeec040a
SHA5124ef58f36b16500731683eb6a5038257c6e301adcfcefad6ca173dd25bb1c869e7fc50ac7ff282f3f8d9a11921b598bc88578f212fcf9c7511c9cda52f3705e13
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
169KB
MD58d7fffdc5fa650429e06d7d7f9b9e639
SHA1f072366e3522f1ae05704410af710f95daab57a9
SHA2566f64930ab0dae493aa7adce4f1b8687b99d3b4a57b52f760acd1de61ce12a8e3
SHA51291c4a6760117be43ecf73e035e1a07009af82a81aafe8f78f86938c341018b49e8f20a7ec71a27882ca31719d42ca764702e0be13a378d53fbc2f4bb910da8cf