Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/09/2026, 03:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_de8fe83b3d3562ba2e47048cfb916127c2f9f74bba2406252c31eaa105d3eb16.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_de8fe83b3d3562ba2e47048cfb916127c2f9f74bba2406252c31eaa105d3eb16.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target jaffacakes118_de8fe83b3d3562ba2e47048cfb916127c2f9f74bba2406252c31eaa105d3eb16.exe
- Size 64KB
- Sample260924-ee2mjsdd92
- SHA256 de8fe83b3d3562ba2e47048cfb916127c2f9f74bba2406252c31eaa105d3eb16
- MD5 19bf337b88e92c9a0c752f2198b418f9
- SHA1 e08691c5756701b27aa7fefa9feb8b1ebafdd418
- SHA512 d4a500ce32a0e8b594a8dcb66367d9ce45be748bd80bedccae5e86a71975920d82e1310aa47854d3c264c9b923c2834c488dec899127ba7c0022848bca9dcf38
- SSDEEP 768:/sb9mzj71UIB7ww1fYJxLTU3tkAIDmjDDLBLF4OHQlxnGuB8UNyqZ/a7Z0aFCyR8:/sbM1fDH4Owlxg10a7jvPC2W
- TLSH T169535F16A725D82FF58080B13839D1AE28193E330181ED27FB856B6871756E7BDF4B1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 208 svchost.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "C:\\Program Files\\Internet Explorer\\svchost.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "C:\\Program Files\\Internet Explorer\\svchost.exe" jaffacakes118_de8fe83b3d3562ba2e47048cfb916127c2f9f74bba2406252c31eaa105d3eb16.exe - Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\iexplore.exe jaffacakes118_de8fe83b3d3562ba2e47048cfb916127c2f9f74bba2406252c31eaa105d3eb16.exe File created C:\Program Files\Internet Explorer\svchost.exe jaffacakes118_de8fe83b3d3562ba2e47048cfb916127c2f9f74bba2406252c31eaa105d3eb16.exe File opened for modification C:\Program Files\Internet Explorer\svchost.exe jaffacakes118_de8fe83b3d3562ba2e47048cfb916127c2f9f74bba2406252c31eaa105d3eb16.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe svchost.exe File created C:\Program Files\Internet Explorer\svchost.exe svchost.exe - System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_de8fe83b3d3562ba2e47048cfb916127c2f9f74bba2406252c31eaa105d3eb16.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{90976F50-B7CB-11F1-B5F1-56B788D469C5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c7304824aa2b6428e255c2f0c9d765a00000000020000000000106600000001000020000000c48a263a8eeab90398ba90eb30f04dcc3df57abb265cb6b6a632a5236e53ec34000000000e80000000020000200000003bf4335ee36fc0b1c25c3c70259e42a61add68d8b884480a458a363614471f3150000000a76f1d851dfa20a3fae4f5e5a1d8ed965c4f31af4c75c73304b7cfe3c933a38b54c20be7520c49fe979c81de13106a1cfff7015debd20021989c5f7506839ec479ed74a6756278c00d48d0584897680d4000000066c4ad68d40777729593fb9352f49d173f35c916299717caa645fc66a819cdb66712cf5a02eef22d4633263e680f8344fef899daadb654489cef00a0c1665228 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff7200000072000000f8040000d7020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31280088" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1702687612" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\User Preferences iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31280088" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "5" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = 3b57edeb3942dd01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31280088" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "496987010" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5800000058000000de040000bd020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffffa6000000a60000002c0500000b030000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IENTSS" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1695031392" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2000031583" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff8c0000008c00000012050000f1020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c7304824aa2b6428e255c2f0c9d765a00000000020000000000106600000001000020000000014f53408762a5e1ad3d49b3750555433a9935ba34610578193d4be502d8a3f2000000000e8000000002000020000000ac0a6a0b679356436f516e9d40cd50753af8f0512f3334b0b1573bb3dab0a98610000000ab7ce438c0d672775a0313341325ec34400000002f62675843e05526e587477549a9613f2b4e39293b4721311c914fb3ee525396b084e259c6e48cf6cf048d718c479307470edbac8525af518779e27eb598ac84 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe - Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1520 iexplore.exe 1520 iexplore.exe 1520 iexplore.exe 1520 iexplore.exe 1520 iexplore.exe 1520 iexplore.exe - Suspicious use of SetWindowsHookEx 34 IoCs
pid Process 1228 jaffacakes118_de8fe83b3d3562ba2e47048cfb916127c2f9f74bba2406252c31eaa105d3eb16.exe 1520 iexplore.exe 1520 iexplore.exe 2412 IEXPLORE.EXE 2412 IEXPLORE.EXE 2412 IEXPLORE.EXE 2412 IEXPLORE.EXE 1520 iexplore.exe 1520 iexplore.exe 524 IEXPLORE.EXE 524 IEXPLORE.EXE 208 svchost.exe 1520 iexplore.exe 1520 iexplore.exe 2768 IEXPLORE.EXE 2768 IEXPLORE.EXE 2768 IEXPLORE.EXE 2768 IEXPLORE.EXE 1520 iexplore.exe 1520 iexplore.exe 3836 IEXPLORE.EXE 3836 IEXPLORE.EXE 1520 iexplore.exe 1520 iexplore.exe 524 IEXPLORE.EXE 524 IEXPLORE.EXE 524 IEXPLORE.EXE 524 IEXPLORE.EXE 1520 iexplore.exe 1520 iexplore.exe 1692 IEXPLORE.EXE 1692 IEXPLORE.EXE 1692 IEXPLORE.EXE 1692 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1228 wrote to memory of 1520 1228 jaffacakes118_de8fe83b3d3562ba2e47048cfb916127c2f9f74bba2406252c31eaa105d3eb16.exe 87 PID 1520 wrote to memory of 2412 1520 iexplore.exe 88 PID 1228 wrote to memory of 4120 1228 jaffacakes118_de8fe83b3d3562ba2e47048cfb916127c2f9f74bba2406252c31eaa105d3eb16.exe 100 PID 1520 wrote to memory of 524 1520 iexplore.exe 101 PID 208 wrote to memory of 4204 208 svchost.exe 106 PID 1520 wrote to memory of 2768 1520 iexplore.exe 107 PID 1228 wrote to memory of 1868 1228 jaffacakes118_de8fe83b3d3562ba2e47048cfb916127c2f9f74bba2406252c31eaa105d3eb16.exe 116 PID 1520 wrote to memory of 3836 1520 iexplore.exe 117 PID 208 wrote to memory of 3960 208 svchost.exe 119 PID 208 wrote to memory of 5924 208 svchost.exe 121 PID 1520 wrote to memory of 1692 1520 iexplore.exe 122
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_de8fe83b3d3562ba2e47048cfb916127c2f9f74bba2406252c31eaa105d3eb16.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_de8fe83b3d3562ba2e47048cfb916127c2f9f74bba2406252c31eaa105d3eb16.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1520 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2412
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1520 CREDAT:17416 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:524
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1520 CREDAT:17420 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2768
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1520 CREDAT:17426 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3836
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1520 CREDAT:17434 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1692
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
- Modifies Internet Explorer settings
PID:4120
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
- Modifies Internet Explorer settings
PID:1868
-
-
C:\Program Files\Internet Explorer\svchost.exe"C:\Program Files\Internet Explorer\svchost.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
- Modifies Internet Explorer settings
PID:4204
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
- Modifies Internet Explorer settings
PID:3960
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
- Modifies Internet Explorer settings
PID:5924
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Internet Explorer\svchost.exe
- Size 64KB
- SHA256 de8fe83b3d3562ba2e47048cfb916127c2f9f74bba2406252c31eaa105d3eb16
- MD5 19bf337b88e92c9a0c752f2198b418f9
- SHA1 e08691c5756701b27aa7fefa9feb8b1ebafdd418
- SHA512 d4a500ce32a0e8b594a8dcb66367d9ce45be748bd80bedccae5e86a71975920d82e1310aa47854d3c264c9b923c2834c488dec899127ba7c0022848bca9dcf38
- SSDEEP 768:/sb9mzj71UIB7ww1fYJxLTU3tkAIDmjDDLBLF4OHQlxnGuB8UNyqZ/a7Z0aFCyR8:/sbM1fDH4Owlxg10a7jvPC2W
- TLSH T169535F16A725D82FF58080B13839D1AE28193E330181ED27FB856B6871756E7BDF4B1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 08511289c08287b60d3de6815e0cdcfd976b76b4ed1fe052982d80b6c9cc3acf
- MD5 1b3bf1878b48e342615e88278c16912b
- SHA1 c03506a3fb6436b214e1adf8334537e30c16e9d6
- SHA512 0738abcb2be78e40a86a93c99dc4468279496d66d2351d02a564eb5d97c7b65e1aa01ac5562971f4fbbe65d56087e56b83b10335b5f724eedc942a429b2160af
- TLSH T1B0F0D414567C9D71399098DC27E816BF34B2E17F10451415B17945E40164FBADB1D035
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 546ca7b88a274bcc932227aceae339b7ca806fd8b12d6bab7c6b5b774cebc18c
- MD5 ea4037a46f8418210f8aae91de1874b1
- SHA1 852349bb2ba4b810c9d019edf0e05655f6b665a5
- SHA512 4469dc3c486ec5806c0a47f91fcd9ef9019dd3a141cf1fea9895f2fe9f0a57265fb13028df75f9af1977234ba6f410ac7feab561b6ab27a1526c1cc3c75159e9
- TLSH T18BE0C03413F6411FF0F5F4784BD5B422465DF026592993B839C49B08F706A00AC13925
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
- Size 4KB
- SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
- MD5 da597791be3b6e732f0bc8b20e38ee62
- SHA1 1125c45d285c360542027d7554a5c442288974de
- SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
- SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
- TLSH T1B9919C8A6AF4CD28CE621D24C53C52FD016BDE1DD19C2087D9E67F92323B96F91232C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DV9ET3T5\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH