Analysis
- max time kernel
148s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/10/2026, 12:57
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-Downloader.Win32.Small.bnd.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan-Downloader.Win32.Small.bnd.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target jaffacakes118_Trojan-Downloader.Win32.Small.bnd.exe
- Size 7KB
- Sample261006-p69scazthx
- SHA256 a72c6c1b6690f15c63d7155cc349dac5a143df0b04defc23e26312bf5962d30a
- MD5 6e9ea9d8d716d055ab06c1a76c2adbcc
- SHA1 7ae16be7332e7ba8d1f2297123ce6965c80ed6ec
- SHA512 3a23dcf2a14f936b3c25f2a673383ff50ec2dafb121e47d87dcfbf757de7bdbcc2cfc4996e0dc8986a6dade0833b60486573c41a6d2cf4a885faf3ce71adb3f3
- SSDEEP 192:DUjMOvE5AIinUGBbS3TUvc4/rt35QwR+h/A4PZKDyMC:oPvE5DGBS3TUvc4/rtWwRM/08
- TLSH T18EF17D4BB1382E41CA5701B71277282C3568CD2E01F8CA974FECB187BCB75688B98758
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/memory/5932-4-0x0000000010000000-0x0000000010009000-memory.dmp acprotect behavioral2/files/0x000600000001b85a-2.dat acprotect behavioral2/memory/5932-7-0x0000000010000000-0x0000000010009000-memory.dmp acprotect - Loads dropped DLL 1 IoCs
pid Process 5932 jaffacakes118_Trojan-Downloader.Win32.Small.bnd.exe -
resource yara_rule behavioral2/memory/5932-0-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/5932-4-0x0000000010000000-0x0000000010009000-memory.dmp upx behavioral2/files/0x000600000001b85a-2.dat upx behavioral2/memory/5932-6-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/5932-7-0x0000000010000000-0x0000000010009000-memory.dmp upx - Program crash 1 IoCs
pid pid_target Process procid_target 2192 5932 WerFault.exe 87 - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ielowutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan-Downloader.Win32.Small.bnd.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\SearchBandMigrationVersion = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000651c704f08d44143ab17b7999a55a4a500000000020000000000106600000001000020000000cf18bf8dedd6f72f0e959ce92ac67ec28497a2a7dc4b8c599aa2084ecd989612000000000e800000000200002000000088835d04f6749048e9d7bc6de7e6ba5940bf02e70a5cd40f38350c35b7d0e9a6100000005ba0f7c1d10e999244dff97de2bcaba44000000044ac86419488c56d0812d7dc278297046d023ae6b434a9f2c778e1c6a0fba251b366979269417af38c29f16d8b9c3f948ee9cc707ad32bf42fac888bb90af7e7 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000651c704f08d44143ab17b7999a55a4a500000000020000000000106600000001000020000000893eb786f95cdbf02307956a0b6b6da55d37d8c87851fb1d4535592208d36f4b000000000e80000000020000200000000d08b84a8fa5999d806511e8bf838a7e40d6cf01b9fe94c2a83092537e1a22a850000000df2d99d30d0a8eec853f74f13ab953070da3b1aaee76534647999bb67f97a7b6b3b0c876d3964453604f8cd9ecfe0f074bee8ac6938869f7c6772cc94d0529c0150e4421b967a49ad4a615b414a1722b4000000077f5634bb7e43a7e23009ac6d2c0b6649acfd6045da0e7e7930fcd73868c9d657b0e0771710d4cc4da20a4bbbe496837df5344064c28669c68d8ef44f0f7b8dd iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IENTSS" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000651c704f08d44143ab17b7999a55a4a50000000002000000000010660000000100002000000082256b1093adf97d64b7729836138616939f705dd803d41566826975d6b9194a000000000e8000000002000020000000ce8b5f2172c58c2e0919a898e98f818596006f527a5ea4ee9af6a52ebd8e639a500000002da5496b6cab6a9af0e26454d641439a3d04c8fb2383b1a424a1626593688f7e564f0dbd1ca672bd678c139962be47c67cfb42b138acdb08b677e8e1c89c9c91f497bff4ac67004154463b4b6752e603400000006e6c63d9cafff551220033ffe9997c07fdfafbc4bc741518916dc9eb86d16ea4d40d57c7156d81e7b0efb784ed8af5d9a39a86d995898feb29f8bd1d8298f3b2 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000651c704f08d44143ab17b7999a55a4a500000000020000000000106600000001000020000000cc7486a9c8743f2a80d9e8df53b0631ca94414b2149fa43d638d03263c77bbf9000000000e8000000002000020000000954c8ab45f210ec627d9bd8fbed6807573618aa4aae47adbff541b8f1246232c10000000eec814ad9945eef561a6a4dfc19565644000000076510b5f18d136fc107cd0d1dec9d4cccbbb626d1e680cf9088076fc1c2b940cd918031a4397c8852c6cb8067fc77f9adb960bbbcc73c00fbf7d2920e3c6a50e iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1497142836" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31282578" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\SearchScopes\KnownProvidersUpgradeTime = 9370c2e24542dd01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000651c704f08d44143ab17b7999a55a4a500000000020000000000106600000001000020000000c5fcdc469d0ee7d6a93570b4eb3a800a8da34f4c8190015fad4da363b0c3481e000000000e80000000020000200000007b9fe30ac601cbcbbe86386e8cae9636562b16a95c2388d02aabcf7d8bb18dab500000001868b988ecd099424c9fa473dc144952aad19caf430b7725433ecb4745ee5594da77ffd4f553fd2f6203fd9ffd8757490d33a553a0c1e88cb38be35edaa64c681ddba13d0678a3bd89144e7e61ee467040000000d0b9512212c72f5ed41cd9840f19e22cc6d94225112810d3a6cb2118f780f80ee0dc5d8c9d480cf45daf39142a04f9fcb51c1de013709e1a719a72a5ac0d57fb iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1502275801" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Recovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\User Preferences iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\SearchScopes\Version = "5" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = 9370c2e24542dd01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IESS02&market={language}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\SearchScopesUpgradeVersion = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IESS02&market={language}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "498056437" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{84B313E9-C185-11F1-9B43-42EB048BA5BD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000651c704f08d44143ab17b7999a55a4a5000000000200000000001066000000010000200000008fccd668a88ef30237cd08210ebb8fe701b4915f06544df4b394e6399dffd950000000000e800000000200002000000027854f3b812bb4c200b1eac4900bdfec019b72c5e56373aabfd7269572ee0a21100000003206177ef46cdb2dc0bb6fe8514c6ce04000000000a272d05bbb03293ddd38a5e8830083e4e305d99594f086f0924ca13d8c763109fecdb52556a348586fb0803b40738917b4f9648cedd701dfb8b73ad381a1e4 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31282578" IEXPLORE.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2080 iexplore.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2080 iexplore.exe 2080 iexplore.exe 3176 IEXPLORE.EXE 3176 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2080 wrote to memory of 3176 2080 iexplore.exe 91 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Small.bnd.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Small.bnd.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5932 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5932 -s 7002⤵
- Program crash
PID:2192
-
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
- System Location Discovery: System Language Discovery
PID:4580
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3176
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5932 -ip 59321⤵PID:5544
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 eabe6065f5fd95f5cb608a8659f165e451168e0e8eb424bb8e1face9e8e9bc17
- MD5 8b848c0616bf8c2ba6a2d2f04022047b
- SHA1 e519b4e5d3f99f8d95029182097eee435b22e388
- SHA512 a69b7ffe56840454bdbf8f16b159890cc671c6dfd2834b39171bf0a0314ea4d3a2af4bd2e7a98d74d63a1bbad7ef8e2d486fb695bc69b25733f6196fa301c940
- TLSH T186F0D4619529F972AFC1B8DD01345A553C20B4F76185C12214756C75055237F2E0A03C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 1c4f381b6b095ea7a43d5e6a2c93c595aa91fa50e377d4c192d4c5ba2e9d55d7
- MD5 1e6987efdf60bea4b7a77042accc56cd
- SHA1 62a88fb4b59d8dbe4ca35fd564ff101457d87324
- SHA512 11488423be6ee008c8837cbeafa6d87de3cf4cd820d866c30bae0545f7776df111cf2ba445b51ff4b545eb467c1847d68bb63450d2596a507acd5582448db437
- TLSH T128E0C02421FB411FF1E4D4348FD9792159A9F133141893B42ED49B08B713A009C02926
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I0NP1C01\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MJOBZ9FO\favicon[1].ico
- Size 4KB
- SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
- MD5 da597791be3b6e732f0bc8b20e38ee62
- SHA1 1125c45d285c360542027d7554a5c442288974de
- SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
- SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
- TLSH T1B9919C8A6AF4CD28CE621D24C53C52FD016BDE1DD19C2087D9E67F92323B96F91232C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\KnoA04D.tmp
- Size 88KB
- SHA256 1e2e25bf730ff20c89d57aa38f7f34be7690820e8279b20127d0014dd27b743f
- MD5 002d5646771d31d1e7c57990cc020150
- SHA1 a28ec731f9106c252f313cca349a68ef94ee3de9
- SHA512 689e90e7d83eef054a168b98ba2b8d05ab6ff8564e199d4089215ad3fe33440908e687aa9ad7d94468f9f57a4cc19842d53a9cd2f17758bdadf0503df63629c6
- SSDEEP 1536:V5JGkeov2IRdGjYQ4OozRuTah6gK8wd1ObAto2cTReH5xCVYiA4Pjqcawh7O6GAn:R
- TLSH T165937D2A04C76881B231D8193DA87FC1DC30886BB4069AE57DFD471B8F79E4BA46367C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\x3.tmp
- Size 4KB
- SHA256 69cdfa01a9e123760e2f64014ccbddaca226e67971599ae71f2e70f2aaeb2d41
- MD5 f8e3bd359f022e9990c121eb0bb7f8dd
- SHA1 5568900cb4d532f59370be7368b315e906c7e306
- SHA512 d8baf2948de08a88b22262355df36e358e0d764bcd97dfaf9cf05cafcda7370170538719a0d215248081b17af2931b5a0bc045fba31ff2ab8281b8946e7160f8
- SSDEEP 48:Cp75Gw/L5f7c7Jb224hQlZpo6cM+5oJpPhUDRNZiU5SeJY8JTaxLyI/C3O3:SfNc7Jb2rhkFayp5UDRNwV7Ce3
- TLSH T172914CCA79F51F93C6A702BB029B48C53E6FD45543F82ECB1D7914CB38272A122D4D60
- MD5 SHA1 SHA512 SSDEEP TLSH