f62a1616b773c81151f79e31b12418e08cada68f552b5e5976f654888319c57f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 17:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

412de37826df742a7e69fe45764d2bf2_JaffaCakes118.exe
Size

160KB
MD5

412de37826df742a7e69fe45764d2bf2
SHA1

bb6017167e8551ead762e3bd3f369b420307dea6
SHA256

f62a1616b773c81151f79e31b12418e08cada68f552b5e5976f654888319c57f
SHA512

b03701c1205f50f40f5e6993657e2b217dfbf81911784577776ae77dd05777f81a2bc010a6d261e3fbce43119a9eb9f24446b116fcc4b0081448bbc097b6ad66
SSDEEP

1536:l/wS1UTIiOKi/g2ipYB94DPLY6xs/uwpEIxyMrFb4IuSmS+K:FaJVi/SiB6DHzwpDjrSf4

Score

8^/10

defense_evasion discovery evasion persistence

Malware Config

Signatures

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2524	attrib.exe
3160	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	412de37826df742a7e69fe45764d2bf2_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	inlE608.tmp

Executes dropped EXE 1 IoCs

pid	Process
1924	inlE608.tmp

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hsdfasd = "\"C:\\Users\\Admin\\AppData\\Roaming\\dataread\\tmp.\\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}\" hh.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe
File opened for modification	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runonce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	412de37826df742a7e69fe45764d2bf2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	inlE608.tmp

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31137174"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31137174"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9D460360-8989-11EF-B9D5-622000771059} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1906236901"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31137174"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1906236901"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1919049615"	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.82133.com/?o"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.82133.com/?o"	reg.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command\ = "wscript -e:vbs \"C:\\Users\\Admin\\AppData\\Roaming\\dataread\\3.bat\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\IsShortCut	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)	reg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	916	412de37826df742a7e69fe45764d2bf2_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1924	inlE608.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1704	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1704	iexplore.exe
1704	iexplore.exe
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 5008	916	412de37826df742a7e69fe45764d2bf2_JaffaCakes118.exe	90
PID 916 wrote to memory of 5008	916	412de37826df742a7e69fe45764d2bf2_JaffaCakes118.exe	90
PID 916 wrote to memory of 5008	916	412de37826df742a7e69fe45764d2bf2_JaffaCakes118.exe	90
PID 5008 wrote to memory of 2792	5008	cmd.exe	92
PID 5008 wrote to memory of 2792	5008	cmd.exe	92
PID 5008 wrote to memory of 2792	5008	cmd.exe	92
PID 2792 wrote to memory of 1704	2792	cmd.exe	94
PID 2792 wrote to memory of 1704	2792	cmd.exe	94
PID 2792 wrote to memory of 2328	2792	cmd.exe	95
PID 2792 wrote to memory of 2328	2792	cmd.exe	95
PID 2792 wrote to memory of 2328	2792	cmd.exe	95
PID 2792 wrote to memory of 1844	2792	cmd.exe	96
PID 2792 wrote to memory of 1844	2792	cmd.exe	96
PID 2792 wrote to memory of 1844	2792	cmd.exe	96
PID 1844 wrote to memory of 384	1844	cmd.exe	98
PID 1844 wrote to memory of 384	1844	cmd.exe	98
PID 1844 wrote to memory of 384	1844	cmd.exe	98
PID 1844 wrote to memory of 4592	1844	cmd.exe	99
PID 1844 wrote to memory of 4592	1844	cmd.exe	99
PID 1844 wrote to memory of 4592	1844	cmd.exe	99
PID 1844 wrote to memory of 3280	1844	cmd.exe	100
PID 1844 wrote to memory of 3280	1844	cmd.exe	100
PID 1844 wrote to memory of 3280	1844	cmd.exe	100
PID 1844 wrote to memory of 2232	1844	cmd.exe	101
PID 1844 wrote to memory of 2232	1844	cmd.exe	101
PID 1844 wrote to memory of 2232	1844	cmd.exe	101
PID 1704 wrote to memory of 3028	1704	iexplore.exe	102
PID 1704 wrote to memory of 3028	1704	iexplore.exe	102
PID 1704 wrote to memory of 3028	1704	iexplore.exe	102
PID 1844 wrote to memory of 4584	1844	cmd.exe	103
PID 1844 wrote to memory of 4584	1844	cmd.exe	103
PID 1844 wrote to memory of 4584	1844	cmd.exe	103
PID 1844 wrote to memory of 3160	1844	cmd.exe	104
PID 1844 wrote to memory of 3160	1844	cmd.exe	104
PID 1844 wrote to memory of 3160	1844	cmd.exe	104
PID 1844 wrote to memory of 2524	1844	cmd.exe	105
PID 1844 wrote to memory of 2524	1844	cmd.exe	105
PID 1844 wrote to memory of 2524	1844	cmd.exe	105
PID 1844 wrote to memory of 4768	1844	cmd.exe	107
PID 1844 wrote to memory of 4768	1844	cmd.exe	107
PID 1844 wrote to memory of 4768	1844	cmd.exe	107
PID 1844 wrote to memory of 5028	1844	cmd.exe	108
PID 1844 wrote to memory of 5028	1844	cmd.exe	108
PID 1844 wrote to memory of 5028	1844	cmd.exe	108
PID 4768 wrote to memory of 3368	4768	rundll32.exe	109
PID 4768 wrote to memory of 3368	4768	rundll32.exe	109
PID 4768 wrote to memory of 3368	4768	rundll32.exe	109
PID 916 wrote to memory of 1924	916	412de37826df742a7e69fe45764d2bf2_JaffaCakes118.exe	106
PID 916 wrote to memory of 1924	916	412de37826df742a7e69fe45764d2bf2_JaffaCakes118.exe	106
PID 916 wrote to memory of 1924	916	412de37826df742a7e69fe45764d2bf2_JaffaCakes118.exe	106
PID 916 wrote to memory of 748	916	412de37826df742a7e69fe45764d2bf2_JaffaCakes118.exe	110
PID 916 wrote to memory of 748	916	412de37826df742a7e69fe45764d2bf2_JaffaCakes118.exe	110
PID 916 wrote to memory of 748	916	412de37826df742a7e69fe45764d2bf2_JaffaCakes118.exe	110
PID 3368 wrote to memory of 1084	3368	runonce.exe	112
PID 3368 wrote to memory of 1084	3368	runonce.exe	112
PID 3368 wrote to memory of 1084	3368	runonce.exe	112
PID 1924 wrote to memory of 3244	1924	inlE608.tmp	114
PID 1924 wrote to memory of 3244	1924	inlE608.tmp	114
PID 1924 wrote to memory of 3244	1924	inlE608.tmp	114

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3160	attrib.exe
2524	attrib.exe

C:\Users\Admin\AppData\Local\Temp\412de37826df742a7e69fe45764d2bf2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\412de37826df742a7e69fe45764d2bf2_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\glk_300_211.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\dataread\1.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\PROGRA~1\INTERN~1\iexplore.exe
      C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://wWW.cnkankan.com/?82133
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1704
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:17410 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3028
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\dataread\1.inf
      4⤵
      System Location Discovery: System Language Discovery
      PID:2328
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\dataread\2.bat
      4⤵
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1844
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?o"" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:384
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?o"" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:4592
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\tmp" /v "key" /d ""http://www.82133.com/?o"" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3280
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2232
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\dataread\3.bat""" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4584
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\dataread\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}
        5⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:3160
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\dataread\tmp
        5⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2524
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\dataread\2.inf
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4768
      - C:\Windows\SysWOW64\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        6⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:3368
        
        C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1084
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 D:\VolumeDH\inj.dat,MainLoad
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5028
- C:\Users\Admin\AppData\Local\Temp\inlE608.tmp
  C:\Users\Admin\AppData\Local\Temp\inlE608.tmp
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\inlE608.tmp > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3244
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\412DE3~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\8km3blq\imagestore.dat

Filesize
15KB

MD5
4e971d457c747b902355b373479a7fd9

SHA1
93a114de3fe39803babb3abd3635098a3637acd6

SHA256
4731136bf6888b5277c728036cb7c76aba15610a3ae9cc3518c98aec1b6d51c3

SHA512
d02ccf7c1890ab9923fe55f62948a15560bcbd23ab1df5472f01b5fb844949d40d7cfebe5652769340b7aa16c954d93f1eb091fe3575f84e57c20e1d7a5de85c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\84KCLP1T\favicon[1].ico

Filesize
24KB

MD5
f4f57c4b91fbfbca9beea7f579db0c4c

SHA1
7164d2fccee5391cf9d1ae83277b8f6ca51d9025

SHA256
66626848a66a468c262673fbd3f4c1be58de232cbfe1d1d00043a02599c5b7e7

SHA512
560789d4a5ebd2de49231c498c47185ee14c47c277ecb6c763f0e497626ba11eac79714b975d32f913ead518b937a118f041ff198b1738359898f68ef498c383

Download Submit
C:\Users\Admin\AppData\Local\Temp\360moheInstall.exe

Filesize
794B

MD5
1bc415b31cdff50d79ea2a3d7b4ff2c1

SHA1
f5ebab61deebc3d7a4a6676a23b982f1418ae6a6

SHA256
582ea6421c80adc1de2dcb34fb8db1926e34b49219d99306693166a6b268d412

SHA512
ee9718e829fa7c6b2e3b208fe99acd390d704a4ad037fd9b5ae231db184f48146792fb1ac028a69224ddca2c3195ef2aa5353ee6bc7abe01157773f4a6e50e84

Download Submit
C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

Filesize
645B

MD5
4cafe2ab2ae87e0e3a16f6bd99e92437

SHA1
45757e5b258e3190ea4d4b092375bded4d5ea4fd

SHA256
90896bc5f40509bc3ed86e17cae17da22b4f4ab0e424dc4557b24eccc53429ce

SHA512
123a945a361a07a356361e796159406bff31dbfbe68afaa1f22e144dc2b4025d23112844db70e651b9ee41f674d8efb4cd10b23ee4992d9538de7ada6534f2ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\glk_300_211.bat

Filesize
55B

MD5
6f40aa13b4733d99a56ea538082114a1

SHA1
b267129b905c29bf1a74cad85bf6a31e6f5da4c1

SHA256
3f7525c06ba96afb5b39c5c84e229448cfe7da22474a6e351111bc13070e7413

SHA512
16d5b9f62cbff8063f9a1db44eb77e9981d659deb6b96603d9fa9365455ad41d6934d386c7740c4c53afa85b9a839b8a0d43db76090f125c9950fba608b3ab8c

Download Submit
C:\Users\Admin\AppData\Roaming\dataread\1.bat

Filesize
3KB

MD5
b21e4f653320b34a01a860b1cf00c861

SHA1
3de8c41f014512ec793c3452b3c96f832644b0f0

SHA256
29a23c064b35e49d619825b67bf8b01ad6ba4c65e50e167bd69416cdca92d4bf

SHA512
6f791ca6c1929779e8c72b4c5c3ec79c8bd134845679e17915a4758a03b847efe5454fefe3af8be1eb17277ba73612d1534d09734c171f82b7ac351893cd8d9c

Download Submit
C:\Users\Admin\AppData\Roaming\dataread\1.inf

Filesize
410B

MD5
66a1f0147fed7ddd19e9bb7ff93705c5

SHA1
9d803c81ea2195617379b880b227892ba30b0bf6

SHA256
4f45ce85e221352f7fe26e04968c7f7267dc24b55cf2b72b929b4c90e48cb764

SHA512
cfe51756ddec75d240249980a4d27870d15983add25058e4d0da4d8a3ea11384d4d228d6cbc95091f91e516e1ab4dfb1e315941dbd95bf717d4b31936311d597

Download Submit
C:\Users\Admin\AppData\Roaming\dataread\2.bat

Filesize
3KB

MD5
6b78cb8ced798ca5df5612dd62ce0965

SHA1
5a9c299393b96b0bf8f6770e3c7b0318a9e2e0cf

SHA256
81f64f42edfac2863a55db8fabd528c4eefc67f7e658cad6a57eeec862e444e3

SHA512
b387ba10021f3284d1406d520a2c8b3ba0c87922d67c79394c1aa50c631194519ac6bb5b898956533f040d48e1c7b202734e0075f8fc8c8bfab82c8ef359b28e

Download Submit
C:\Users\Admin\AppData\Roaming\dataread\2.inf

Filesize
249B

MD5
ddf8482343b38e425558a5ea06c99cdb

SHA1
1109e4d5ef572915cafa82327d4537696d746e53

SHA256
c054ba607ea2db904ef8bf8ab83a4e68dbf32c1b41cfd6e71fd550e886f44de7

SHA512
aacdc2702b58cbcbb73d11dc73c09caa84cbbc50438cbdaf46557ba38249b881bbe08487341a2deec5372b742b7055e8633f7f5008808a713c0f9611c8809e7b

Download Submit
C:\Users\Admin\AppData\Roaming\dataread\4.bat

Filesize
5.8MB

MD5
c46beeafd9b8174d246e813af5b43630

SHA1
6a1c4fd9d0eea98c4e079d61ab74b79f897f7cf0

SHA256
d21456ac21a5a30f804eb71a95422b5aa420e6fd05ee2cef06a482f283e63b48

SHA512
9c7f58996a428bb9af7c8df33a8948d82c0ccd8702d3797c441dc1038638f3c76d9097a9db671f3085932bf14fe5ddae129bb42d719ae701c53791fa33843b19

Download Submit
memory/916-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/916-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/916-130-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1704-90-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-92-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-71-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-70-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-69-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-68-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-66-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-63-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-62-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-59-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-58-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-56-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-52-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-84-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-82-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-87-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-89-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-74-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-88-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-91-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-86-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-93-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-98-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-99-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-94-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-72-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-100-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-101-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-104-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-108-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-115-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-113-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-116-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-114-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-119-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-117-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-77-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-73-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-64-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-152-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-154-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-158-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-159-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-157-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-156-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-153-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-161-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-60-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download
memory/1704-61-0x00007FFD31E30000-0x00007FFD31E9E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads