Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/11/2024, 05:08
Static task
static1
Behavioral task
behavioral1
Sample
b4eb7a6aa9cdc2756e4341dfe533200a_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
b4eb7a6aa9cdc2756e4341dfe533200a_JaffaCakes118.dll
-
Size
484KB
-
MD5
b4eb7a6aa9cdc2756e4341dfe533200a
-
SHA1
87b946776fb4c4ceb293c47192e48e06ec69b687
-
SHA256
e38554314edcbe634ffd5f845201c0ebbd362bf22e2680391231c6e3de9b9f7f
-
SHA512
9c93f25fafd8ceb5ede74c0c03a4bb93be03fd27d1766134e43976451fe920ada00dd4ffb9d3a9969d2dfe17366c18033db9fb548396bced9c38d7b1b5807ea0
-
SSDEEP
6144:mfFM4cw6a8t/q2bX5qpepfQTEJ+NNb8r5KYagw2F5YNEXkEmjOi4:Rw6a8YEJHFQAJ+NNbwkgw2FWNK/
Malware Config
Signatures
-
Ramnit family
-
Executes dropped EXE 6 IoCs
pid Process 2948 rundll32mgr.exe 3316 rundll32mgrmgr.exe 3016 WaterMark.exe 4476 WaterMarkmgr.exe 4372 WaterMark.exe 2864 WaterMark.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe File created C:\Windows\SysWOW64\rundll32mgrmgr.exe rundll32mgr.exe -
resource yara_rule behavioral2/memory/2948-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2948-17-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4476-39-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2864-73-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/4372-64-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/3316-63-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4476-53-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3016-51-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2948-19-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2948-16-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2948-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2948-11-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2948-10-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3016-81-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3016-84-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3016-86-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in Program Files directory 10 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe WaterMark.exe File created C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe WaterMark.exe File opened for modification C:\Program Files (x86)\Microsoft\pxA410.tmp rundll32mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe File created C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe WaterMark.exe File opened for modification C:\Program Files (x86)\Microsoft\pxA46E.tmp WaterMarkmgr.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe WaterMarkmgr.exe File opened for modification C:\Program Files (x86)\Microsoft\pxA47D.tmp rundll32mgrmgr.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgrmgr.exe -
Program crash 4 IoCs
pid pid_target Process procid_target 2016 3120 WerFault.exe 90 2120 4052 WerFault.exe 92 1972 1964 WerFault.exe 82 2912 3748 WerFault.exe 93 -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaterMark.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgrmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaterMarkmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaterMark.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaterMark.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31146725" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4224105466" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31146725" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4220355152" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "439708291" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{272B1F0A-AED9-11EF-A4B7-E6FB6C85BB83} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4220355152" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31146725" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 3016 WaterMark.exe 3016 WaterMark.exe 3016 WaterMark.exe 3016 WaterMark.exe 4372 WaterMark.exe 4372 WaterMark.exe 2864 WaterMark.exe 2864 WaterMark.exe 2864 WaterMark.exe 2864 WaterMark.exe 4372 WaterMark.exe 4372 WaterMark.exe 3016 WaterMark.exe 3016 WaterMark.exe 3016 WaterMark.exe 3016 WaterMark.exe 3016 WaterMark.exe 3016 WaterMark.exe 3016 WaterMark.exe 3016 WaterMark.exe 3016 WaterMark.exe 3016 WaterMark.exe 3016 WaterMark.exe 3016 WaterMark.exe 2864 WaterMark.exe 2864 WaterMark.exe 2864 WaterMark.exe 2864 WaterMark.exe 2864 WaterMark.exe 2864 WaterMark.exe 2864 WaterMark.exe 2864 WaterMark.exe 2864 WaterMark.exe 2864 WaterMark.exe 2864 WaterMark.exe 2864 WaterMark.exe 4372 WaterMark.exe 4372 WaterMark.exe 4372 WaterMark.exe 4372 WaterMark.exe 4372 WaterMark.exe 4372 WaterMark.exe 4372 WaterMark.exe 4372 WaterMark.exe 4372 WaterMark.exe 4372 WaterMark.exe 4372 WaterMark.exe 4372 WaterMark.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3016 WaterMark.exe Token: SeDebugPrivilege 4372 WaterMark.exe Token: SeDebugPrivilege 2864 WaterMark.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4772 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4772 iexplore.exe 4772 iexplore.exe 3108 IEXPLORE.EXE 3108 IEXPLORE.EXE 3108 IEXPLORE.EXE 3108 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 6 IoCs
pid Process 2948 rundll32mgr.exe 3016 WaterMark.exe 4476 WaterMarkmgr.exe 3316 rundll32mgrmgr.exe 4372 WaterMark.exe 2864 WaterMark.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 212 wrote to memory of 1964 212 rundll32.exe 82 PID 212 wrote to memory of 1964 212 rundll32.exe 82 PID 212 wrote to memory of 1964 212 rundll32.exe 82 PID 1964 wrote to memory of 2948 1964 rundll32.exe 83 PID 1964 wrote to memory of 2948 1964 rundll32.exe 83 PID 1964 wrote to memory of 2948 1964 rundll32.exe 83 PID 2948 wrote to memory of 3316 2948 rundll32mgr.exe 85 PID 2948 wrote to memory of 3316 2948 rundll32mgr.exe 85 PID 2948 wrote to memory of 3316 2948 rundll32mgr.exe 85 PID 2948 wrote to memory of 3016 2948 rundll32mgr.exe 86 PID 2948 wrote to memory of 3016 2948 rundll32mgr.exe 86 PID 2948 wrote to memory of 3016 2948 rundll32mgr.exe 86 PID 3016 wrote to memory of 4476 3016 WaterMark.exe 87 PID 3016 wrote to memory of 4476 3016 WaterMark.exe 87 PID 3016 wrote to memory of 4476 3016 WaterMark.exe 87 PID 4476 wrote to memory of 4372 4476 WaterMarkmgr.exe 88 PID 4476 wrote to memory of 4372 4476 WaterMarkmgr.exe 88 PID 4476 wrote to memory of 4372 4476 WaterMarkmgr.exe 88 PID 3316 wrote to memory of 2864 3316 rundll32mgrmgr.exe 89 PID 3316 wrote to memory of 2864 3316 rundll32mgrmgr.exe 89 PID 3316 wrote to memory of 2864 3316 rundll32mgrmgr.exe 89 PID 3016 wrote to memory of 3120 3016 WaterMark.exe 90 PID 3016 wrote to memory of 3120 3016 WaterMark.exe 90 PID 3016 wrote to memory of 3120 3016 WaterMark.exe 90 PID 3016 wrote to memory of 3120 3016 WaterMark.exe 90 PID 3016 wrote to memory of 3120 3016 WaterMark.exe 90 PID 3016 wrote to memory of 3120 3016 WaterMark.exe 90 PID 3016 wrote to memory of 3120 3016 WaterMark.exe 90 PID 3016 wrote to memory of 3120 3016 WaterMark.exe 90 PID 3016 wrote to memory of 3120 3016 WaterMark.exe 90 PID 2864 wrote to memory of 4052 2864 WaterMark.exe 92 PID 2864 wrote to memory of 4052 2864 WaterMark.exe 92 PID 2864 wrote to memory of 4052 2864 WaterMark.exe 92 PID 2864 wrote to memory of 4052 2864 WaterMark.exe 92 PID 2864 wrote to memory of 4052 2864 WaterMark.exe 92 PID 2864 wrote to memory of 4052 2864 WaterMark.exe 92 PID 2864 wrote to memory of 4052 2864 WaterMark.exe 92 PID 2864 wrote to memory of 4052 2864 WaterMark.exe 92 PID 2864 wrote to memory of 4052 2864 WaterMark.exe 92 PID 4372 wrote to memory of 3748 4372 WaterMark.exe 93 PID 4372 wrote to memory of 3748 4372 WaterMark.exe 93 PID 4372 wrote to memory of 3748 4372 WaterMark.exe 93 PID 4372 wrote to memory of 3748 4372 WaterMark.exe 93 PID 4372 wrote to memory of 3748 4372 WaterMark.exe 93 PID 4372 wrote to memory of 3748 4372 WaterMark.exe 93 PID 4372 wrote to memory of 3748 4372 WaterMark.exe 93 PID 4372 wrote to memory of 3748 4372 WaterMark.exe 93 PID 4372 wrote to memory of 3748 4372 WaterMark.exe 93 PID 3016 wrote to memory of 1692 3016 WaterMark.exe 101 PID 3016 wrote to memory of 1692 3016 WaterMark.exe 101 PID 3016 wrote to memory of 4772 3016 WaterMark.exe 102 PID 3016 wrote to memory of 4772 3016 WaterMark.exe 102 PID 2864 wrote to memory of 4068 2864 WaterMark.exe 103 PID 2864 wrote to memory of 4068 2864 WaterMark.exe 103 PID 2864 wrote to memory of 1740 2864 WaterMark.exe 104 PID 2864 wrote to memory of 1740 2864 WaterMark.exe 104 PID 4372 wrote to memory of 1304 4372 WaterMark.exe 105 PID 4372 wrote to memory of 1304 4372 WaterMark.exe 105 PID 4372 wrote to memory of 372 4372 WaterMark.exe 106 PID 4372 wrote to memory of 372 4372 WaterMark.exe 106 PID 4772 wrote to memory of 3108 4772 iexplore.exe 107 PID 4772 wrote to memory of 3108 4772 iexplore.exe 107 PID 4772 wrote to memory of 3108 4772 iexplore.exe 107
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b4eb7a6aa9cdc2756e4341dfe533200a_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b4eb7a6aa9cdc2756e4341dfe533200a_JaffaCakes118.dll,#12⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\rundll32mgrmgr.exeC:\Windows\SysWOW64\rundll32mgrmgr.exe4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵PID:4052
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 2047⤵
- Program crash
PID:2120
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"6⤵
- Modifies Internet Explorer settings
PID:4068
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"6⤵
- Modifies Internet Explorer settings
PID:1740
-
-
-
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe"C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe7⤵PID:3748
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 2048⤵
- Program crash
PID:2912
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵
- Modifies Internet Explorer settings
PID:1304
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵
- Modifies Internet Explorer settings
PID:372
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵PID:3120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 2046⤵
- Program crash
PID:2016
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
PID:1692
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4772 CREDAT:17410 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3108
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 6563⤵
- Program crash
PID:1972
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3120 -ip 31201⤵PID:2544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1964 -ip 19641⤵PID:1524
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4052 -ip 40521⤵PID:1148
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3748 -ip 37481⤵PID:3264
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5549aeb864011f0c57644853ec90cbab9
SHA1fd63ad25ed0824b3aa6c9bce49f55d85d0a88e3e
SHA2568c2c91480d44c8881a3cde343916de69bcddf67dff17588e9640c4d7b01437ea
SHA5126d6cacc4c938ff1cc53d4504fc8faa8ca2c4ddab8c0edfddfaee6039a12b9f845dca85b0ef06cad8b6a2a7f02c0b6cb47cf6ea0dda333ae21bb59d222247be7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD50248dd8927ae2e5be1120cdfc956cd66
SHA1c0fcac18cea591c5abbdaa10ba3fdb4f095f69ee
SHA256c8ce02792455e98bd5f0bb54e0331aad68797879a353f92f40eb52871c4f0748
SHA512a08e91cc0d6775ded31e32fcf1dbc57520db924262255dde31c721e3dd2624ed5e5b499d73925fe98a33071625644e41242331a6ea00801df3790de39e113a54
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
122KB
MD5c5255edf109342e3e1d1eb0990b2d094
SHA1ba029b47b9b3a5ccccae3038d90382ec68a1dd44
SHA256ea49164b416d1b900f80a14f30295ea7d546483a0d7ba8b3a9e48dbcb48a3dc5
SHA5126b6911ea424763af3ed4964e67aa75d1ffe74551e1e4e12e6220afcda720dbfdda00d744e23486c07701662bac3702220f760d1c86a188772e9bf8af7b64a3a3
-
Filesize
59KB
MD5f2c8b7e238a07cce22920efb1c8645a6
SHA1cd2af4b30add747e222f938206b78d7730fdf346
SHA2566b20b420e84a30df810d52a9b205a3af0f46cafe82bf378867542f15eb64461e
SHA512c4b9c8c3dccaa39b5ac1faea7e92b0e1d391f0943989178634992be07c40be15b8543f9c6746ab6a5a7136ea00e3c0818fc43bc2eee4e5d282c3cbf7ea279699