628584470054ce6376e9dbaac5ebb1b5477beb1d60a2faab6a20704fb96a18d6

Analysis

max time kernel
133s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

429727607f19019d28c55c673bc3f0ab_JaffaCakes118.exe
Size

250KB
MD5

429727607f19019d28c55c673bc3f0ab
SHA1

fabf52a135c4ae4a6376190da7b7ed0b9243798f
SHA256

628584470054ce6376e9dbaac5ebb1b5477beb1d60a2faab6a20704fb96a18d6
SHA512

ef594f1f57dea45437f39d3f2af414d4f4895c29eba227146a0067a61e6e1103a136f382ce9e2972165a3281b61a0f52a790592112f714f05519a525bea6b5b7
SSDEEP

6144:ihieuJDr5T8b2ufqBLjSB/MS7irtIa6cwoD8ZroSfjGFA:feKrJJuf86AYcwoaoSbr

Score

8^/10

discovery execution persistence upx

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Deletes itself 1 IoCs

pid	Process
2780	cmd.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2012-36-0x0000000000400000-0x00000000004B1000-memory.dmp	autoit_exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2012-0-0x0000000000400000-0x00000000004B1000-memory.dmp	upx
behavioral1/memory/2012-36-0x0000000000400000-0x00000000004B1000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\WinRAR\winrar.jse	429727607f19019d28c55c673bc3f0ab_JaffaCakes118.exe
File opened for modification	C:\Program Files\WinRAR\winrar.jse	429727607f19019d28c55c673bc3f0ab_JaffaCakes118.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	429727607f19019d28c55c673bc3f0ab_JaffaCakes118.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2780	cmd.exe
1616	PING.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f542000000000200000000001066000000010000200000008d00879dc39c2df83376fade99292b35c09b0523785003bbe76009f20a07a4b7000000000e8000000002000020000000fdc14a52d310c6282506a9aa5c4a9b077f23270fdb2719adaea89014c758e2a890000000ef5ac824af6c950ac500c47c3d748fe2bb97f6ee4d32f186c687e24f4fb12c3023917cd8c7af6f61b70d28211a18b54c343ac17d074f69b2071bbbb11cff6f214f251eb510ea23042d39a1d81bdb48d01709fb662c0033eff499ea9aed48c5b8e11e8fc63dc5f86357143a1d064d6ef1d86454401e04408d36a365869921f95978e5f5d66bc4bcda79c2ceb46fcd54cb400000009a871b32a3a6edee4af303a3d823810c896b1b5a91b2d74ad64012a451b1ba7a377d0cc55f6a7e5d438a4e251ab1fdf5318106ddc9ddc0e40555f27115617e5b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0dcebe43e1edb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f5420000000002000000000010660000000100002000000098b5759321792e51ad86cf6622b7ffd7638d1a3e99d7f368ec5c3da528033e39000000000e8000000002000020000000014448a504ed7e7efd81bcdb808a2245fb040c48009172a16ac0d8e96b876793200000001d769103d964fb3a6956db0596cb1d627343ee507af00c1beb8a6b376ddd59fd4000000097c39026e32b5eabd31bf8257097a56833ad74d8de5f69e5fa981a85ffd76883cb67e6e5a6082360bc9aeca22be570a3c3d7d0c324e2ddf8fbfa43d1574521e7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435075196"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1B0837C1-8A32-11EF-AAC7-FE6EB537C9A6} = "0"	iexplore.exe

Modifies registry class 26 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shell\open	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shellex\IconHandler\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\IsShortcut	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\NeverShowExt	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\CLSID	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\CLSID\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shell\open\command	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shellex\ContextMenuHandlers\	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mmc	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\ = "¿ì½Ý·½Ê½"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\DefaultIcon	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\DefaultIcon\ = "%SystemRoot%\\SysWow64\\url.dll,0"	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shell\open\CLSID = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shell\open\command\ = "WScript.exe \"C:\\Program Files (x86)\\Winrar\\winrar.jse\" \"%1\""	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shellex\IconHandler	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shellex\ContextMenuHandlers	WScript.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mmc\ = "mmcfile"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shell	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shell\ = "open"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mmcfile\shellex	WScript.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1616	PING.EXE

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeShutdownPrivilege	348	explorer.exe
Token: SeShutdownPrivilege	348	explorer.exe
Token: SeShutdownPrivilege	348	explorer.exe
Token: SeShutdownPrivilege	348	explorer.exe
Token: SeShutdownPrivilege	348	explorer.exe
Token: SeShutdownPrivilege	348	explorer.exe
Token: SeShutdownPrivilege	348	explorer.exe
Token: SeShutdownPrivilege	348	explorer.exe
Token: SeShutdownPrivilege	348	explorer.exe
Token: SeShutdownPrivilege	348	explorer.exe
Token: SeShutdownPrivilege	348	explorer.exe
Token: SeShutdownPrivilege	348	explorer.exe
Token: SeShutdownPrivilege	348	explorer.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
2012	429727607f19019d28c55c673bc3f0ab_JaffaCakes118.exe
2012	429727607f19019d28c55c673bc3f0ab_JaffaCakes118.exe
2012	429727607f19019d28c55c673bc3f0ab_JaffaCakes118.exe
2012	429727607f19019d28c55c673bc3f0ab_JaffaCakes118.exe
2760	iexplore.exe
2760	iexplore.exe
2760	iexplore.exe
2760	iexplore.exe
2760	iexplore.exe
2760	iexplore.exe
2760	iexplore.exe
2760	iexplore.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
2012	429727607f19019d28c55c673bc3f0ab_JaffaCakes118.exe
2012	429727607f19019d28c55c673bc3f0ab_JaffaCakes118.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe
348	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2760	iexplore.exe
2760	iexplore.exe
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1976	2012	429727607f19019d28c55c673bc3f0ab_JaffaCakes118.exe	30
PID 2012 wrote to memory of 1976	2012	429727607f19019d28c55c673bc3f0ab_JaffaCakes118.exe	30
PID 2012 wrote to memory of 1976	2012	429727607f19019d28c55c673bc3f0ab_JaffaCakes118.exe	30
PID 2012 wrote to memory of 1976	2012	429727607f19019d28c55c673bc3f0ab_JaffaCakes118.exe	30
PID 1976 wrote to memory of 2760	1976	WScript.exe	33
PID 1976 wrote to memory of 2760	1976	WScript.exe	33
PID 1976 wrote to memory of 2760	1976	WScript.exe	33
PID 1976 wrote to memory of 2760	1976	WScript.exe	33
PID 2012 wrote to memory of 2780	2012	429727607f19019d28c55c673bc3f0ab_JaffaCakes118.exe	34
PID 2012 wrote to memory of 2780	2012	429727607f19019d28c55c673bc3f0ab_JaffaCakes118.exe	34
PID 2012 wrote to memory of 2780	2012	429727607f19019d28c55c673bc3f0ab_JaffaCakes118.exe	34
PID 2012 wrote to memory of 2780	2012	429727607f19019d28c55c673bc3f0ab_JaffaCakes118.exe	34
PID 2760 wrote to memory of 2636	2760	iexplore.exe	36
PID 2760 wrote to memory of 2636	2760	iexplore.exe	36
PID 2760 wrote to memory of 2636	2760	iexplore.exe	36
PID 2760 wrote to memory of 2636	2760	iexplore.exe	36
PID 2780 wrote to memory of 1616	2780	cmd.exe	37
PID 2780 wrote to memory of 1616	2780	cmd.exe	37
PID 2780 wrote to memory of 1616	2780	cmd.exe	37
PID 2780 wrote to memory of 1616	2780	cmd.exe	37

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\429727607f19019d28c55c673bc3f0ab_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\429727607f19019d28c55c673bc3f0ab_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files\WinRAR\winrar.jse"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://www.go2000.com/?g8
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2760 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 4 127.1>nul &del /q "C:\Users\Admin\AppData\Local\Temp\429727607f19019d28c55c673bc3f0ab_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 4 127.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1616

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\WinRAR\winrar.jse

Filesize
11KB

MD5
9208c38b58c7c7114f3149591580b980

SHA1
8154bdee622a386894636b7db046744724c3fc2b

SHA256
cb1b908e509020904b05dc6e4ec17d877d394eb60f6ec0d993ceba5839913a0c

SHA512
a421c6afa6d25185ec52a8218bddf84537407fd2f6cabe38c1be814d97920cfff693a48b4f48eb30c98437cbbb8ad30ccd28c3b4b7c24379ef36ac361ddfdbf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c9b2fa6ba64b8640c507fa13f0acf17

SHA1
0670e303f37303cd1410af3bfdb907fd87e9517e

SHA256
4bb65175fe7ca1f502acedb41a4034235c4f4b539e59a9d8a26a2b51766d6e01

SHA512
bd8663ea3e192089f34e9d6bc85c8239ef666fbcc82e6d8e63893578ccd86ac13cfcdbcecfed6e5c09462e1810c40380a52edd8eac7a6c4b2620635bf735a80a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
811e862a2323d18561bb4f421c86cbf1

SHA1
8f2a83933fe6ee49653ac75950931f6184888aa9

SHA256
651073bb837555445c409bf7ec0b327475b084f69ed1c90103a0c1f7ec82c692

SHA512
644483238e7fbe9d43f32df075d11acdb5236d71a084fb532c7b3a3bfdf6bd2b9f078aba5890fe744c72028123e159a0098d51f1988e10c5d98ed0cb6ec96e9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32bf129291f6da15ceee4af22ebda27d

SHA1
dcc36b8cd41ba163f5e2c0e76e0fd7a298fdfa83

SHA256
6c30b00ffcf86c2ae8acf92d2490979a53298ba5af6cc4fac70cab25748bb0af

SHA512
e22c28044e7f25600ea2587e18e5abcbf9ba535172827809e5e6188f75df83a4d7c8a8a0dbf942821ad4083c4bc85f823a740ce1cbbb8cd7e70dfd0d144cc960

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10734be2da6960c80556d966c4aac200

SHA1
6c34dd570994b6dc682b40e4ca88fabea9240672

SHA256
3a270f59ac22b9cbbc9bb018c965e3f49e48562ef0789d886b51d836b04f9e77

SHA512
20210d3bc31cb5a199131bd1588c34a1b8dff1c35c864339e37208290baed4edad2f4ede3082caf5d0cce360cac4cfad1de84047ba8c53df7de08a3dcb3e42f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b37fa8f641d4c51b89fd2f633a4595ac

SHA1
f8ab44cf691b67c867a2c5c40beff5b943b1ad87

SHA256
45d4279ba56f09da76468535f871f5da1fc1e5ddbb3e6ebaf3c3a852f09ebccf

SHA512
f433cf5d14db380e8e992339ffe08d8794f7084b4530c254cb6286d3407c466b37107d4de63ceddad191a35ad8c8c0bd29e1b127918226a25fe6de6598c9213f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a643bcbd90efdc8c02e43d987f89d7bb

SHA1
246c5874981d31d9a6fa713efd8d50a85860fccb

SHA256
595e1cba61c76c76602ffbce224a8bf78679790e69e7d4a49df5a09c84b50d82

SHA512
f3d0388a31ed1468ac192412719d27429d287b82d4b75af65ed79250b297aee1a32509d745eda32e7a5fd3ecbcf1b0e539c680830dd2c9d17ccc55e312bee82c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
584a8518b811eb00af9080f0b74d47cd

SHA1
9a357a86a4f93a387b5d921f874395bba00a61b9

SHA256
34ed1fd617c5348077ecc167845cf4cb1d550dff403ea7cbaec63bccc9beb022

SHA512
e32ff9e34b3884126e59b70aea3391383cf10a6630c7c19419e1d21d72d46daae5af5a16219ae70a672a398835c3a5c6d3f009d9783ab687f809c2d4f5f1c80a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78416305e6b83b9aee5fbc070b54fa1e

SHA1
1c3c2293307dd9d54fa8a35d7afd2777afa679d7

SHA256
c3184df022f95c750e17c721e9b29bdb82a65f2738e33cb9a2cf38750e6b4975

SHA512
9fa6d340afd08a7ac96c3b81f97622291420454cb72e7375a75091a7df5160a8318b6865cf1964a02888ce4e7326caaee1bbd2276460f55a0e52f51b4dc36245

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dce187080b36ae5d2984ec6e058486f6

SHA1
a077dbe9c55173c61f3d911ae235b09e422f0ff5

SHA256
adec4b291075bb769b1fbb0ea3a76d0fb3d97982ab35f642777807407eb8a5e1

SHA512
9366f85f5bccd5d3f4a04cc3f8f482d91d3fa1715777564c855ef52f5d0cb59165823d4a8bf73d2d68ff74285efad422b2a6902f270cc4e82f4af9247581487b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a20964370f1f54d68b316e05269ad3a5

SHA1
8456036d88d876a59e307f14559e3f2396af05c7

SHA256
23efa2e96c25cc60fa55f7aca1e87066257087d96bcc4baa550c2f0b75b9f2dc

SHA512
1f5b70a43e5132b86758cb3c6958b4bcb35151895ebfac6a840d7135e832e80050c0fe79b537da6bfb506ce49eea0c21868e27f6cf7b701bb5453ed72346db10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71ae6c4aee506d52014f64bd57534c4f

SHA1
fa666a141c806062c5d87fee70fbd5005e7341f6

SHA256
70c2704fcd1f872aa715939311c3a774028adfccedef4c60e08c274e66344553

SHA512
1204135779f1d65cf18fc3ba9c3a54ebdf2188eefadbe39bdb92b7642b9784c43f4717e12bd181dc76f6038d14f56a5ed52bb8978cdb9f9892fa20aeb1dff836

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34c3579e9ca505a0b1181c8206050301

SHA1
b2342638dae28768a1b95ab60e7587703379739e

SHA256
ee27c500ee7b9f446cfb04a2b38beec39447b54a64246d93277037e7bd2e706e

SHA512
e021ce0ab42a3dd044ca95d5afaf9521cdcee230a2dde40421bba687e7ee199c6ec55a7d2b0c7ba0399777dc39e5400228fc8eda5d412d749baf3d8fe6cd25d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
674e470ab90d8e5b8f21709eefc6b4db

SHA1
7c4e405968bca70184dd96042f83a0b5f46db31d

SHA256
86991e2df72ef7c95287cb7620df5f4ba3e77a04f59ce9217190b71392df634f

SHA512
1ca9b1a69a3215a00c7165547dc9cf855c8a069b2b23fbe38201867d48826a6970c86f8c56abfd21701dabc54b24e9a1fa9a10c99ffc2293766deb61de9574ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e5119cbf541125b1a0ea009275475cf

SHA1
9f27abbf86463831cbcad17f7dccbc1b8699a174

SHA256
c100f0e49fe7a10087eab5177d9d7ca87009587be460584eade6fff1c1e5701d

SHA512
b30a26cabe67fe23d1683159c44b93d77776fe66096a652fe658a7ce34ee1a8b08d7873731a841a040df5a29cfb2a8af5c6569edced77c9ceba7b90ea3fb5905

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fde96f2fac6354e07b07c0cadcbf9cce

SHA1
7d2f826e83715b4c35235349d312f2b07e541938

SHA256
07a46db7668f28fa4ca81cc4c8e45d4856c812f24692856c7241c0bc55f34fef

SHA512
25ba6b9d9f25f26a623e4ed51dd5cebfdebcb62162875d6f9061550992118008765891be53a1eae8db92ba4280c0398f74c573f62e43ca9870b35707ac55e295

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86b9e10ab0a4a0768d6a288d0aaa22da

SHA1
12367c7ed915e4cc9bc9195a742e406834ae13e3

SHA256
d976694db2fb9a6cd051f60c0c8bc47c12dcd29e5561fe5df10892777743b4be

SHA512
f13899aa08be540ddc8469fecfbf90b0b3b1e68e78751b3d03ce0e9b3ba4366b86156ad60204184b3843ea8caa91c69924dd52a644c9835f039a8f0a70cbf909

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0372fb88942bbc37ffeff097034754df

SHA1
8be63fb02b2793d457f1f9bd41ec6432488484ed

SHA256
8b28f085315132defea691015140719f6c7864068d6dc8e995b29077b638366e

SHA512
ade403f84931a96dcf370474d91db2096f8fcfcd2e588555e142c6f8f4ad93f9c1c892768294732bdb433892b48fde62d3a73e9c64ddc2d6f2e080e196f4f36a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ec8c1506c62b0a451bc1496d7ec2e26

SHA1
de67ec87f23163f7482aa4145f38f7930a124bce

SHA256
f7ecded7e8e4e13ea2282ea361344a9488cd4d31ba66776fbd0518bef7e4443b

SHA512
a5fc276e2f3802331b694c8ce5a49aafca44f5be5c8492f7d99e0965473536e30d8bf55317ef75b77fa560f675ad02ef99477cbc63e82f500e906060570f08a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ae833b5dff31b449a30470e3655c7ef

SHA1
a3cd7c27418a91318451c21a729760f9210ac494

SHA256
c749cef5a6c78e2e4bba5816a57b2c85685099b50478fbbb9cb005956311633e

SHA512
5bc9a0d3eacdaaf3c996082b2d1416c0e9d41e4e28091ff2c7985a80f4d636dfcba6db77918f078c858a783dbdb7e5e133b7cb8bb7f40f41589d17ba5a9fd647

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49643648794946f1cd3c8fb46ff1922a

SHA1
0b59b540ebfcb1fcabb9f9b7ca95612bfcbd601d

SHA256
7bb2b043cdb16d3cbd7e59973555940390de3f7691af8405b62674b724511285

SHA512
2f04adb57ba87ee5113daad063885e38c863648d8658533acff028bbefe29621d7019cb35b20e39f20b354e3f13abceea47f54efeea75bfd729b2f1715822dac

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE42A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE45B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.mmc

Filesize
255B

MD5
a0c4d2f989198272c1e2593e65c9c6cb

SHA1
0fa5cf2c05483bb89b611e0de9db674e9d53389c

SHA256
f3170aeec265cc49ff0f5dcb7ed7897371b0f7d1321f823f53b9b0e3a30e1d23

SHA512
209798b5b153283bea29974c1433fe8b6c14f2a54e57237d021ecc1013b8dc6931dedcc2fe173d121c719901045fdf2215177ba164c05d703f2e88a196252ec4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.mmc

Filesize
149B

MD5
b0ad7e59754e8d953129437b08846b5f

SHA1
9ed0ae9bc497b3aa65aed2130d068c4c1c70d87a

SHA256
cf80455e97e3fede569ea275fa701c0f185eeba64f695286647afe56d29e2c37

SHA512
53e6ce64ad4e9f5696de92a32f65d06dbd459fd12256481706d7e6d677a14c15238e5351f97d2eb7bfb129a0d39f2603c4d14305a86821ed56e9face0bc252b6

Download Submit
memory/348-1092-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

Filesize
64KB

Download
memory/2012-0-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2012-36-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads