Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
24-06-2024 17:03
Behavioral task
behavioral1
Sample
09bf965f2e6c6182342110ec95cbacdd_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
09bf965f2e6c6182342110ec95cbacdd_JaffaCakes118.exe
-
Size
2.5MB
-
MD5
09bf965f2e6c6182342110ec95cbacdd
-
SHA1
7dcf765c2a4afc9ed14cc19cdb925f9857748213
-
SHA256
d81b25ba955e8ab608e792df5b5ddc3a1c3a3dfc66c8801fa82c456326af597a
-
SHA512
4dec0bcda949aae0409019218690036bec483e340faea4d7c2b8a30218a082c371957ecf193a938acb8ac4e88dec5ebb30c6d61870f218ed979c58837541c018
-
SSDEEP
49152:7pVxXrwHcI9iOe1SfGYo1IiouCpAPcuv3+FwieK6EUhmQudRlS7hChUPH:7RXrw8I9JeaoaioUTv3+FLeKPUhZud7G
Malware Config
Extracted
gozi
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Windows\SysWOW64\zlib.dll acprotect -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
09bf965f2e6c6182342110ec95cbacdd_JaffaCakes118.exeb2e.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation 09bf965f2e6c6182342110ec95cbacdd_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation b2e.exe -
Executes dropped EXE 4 IoCs
Processes:
b2e.exebatchfile.bat1.exeRpqzq.pifpid process 1864 b2e.exe 4840 batchfile.bat 4364 1.exe 2548 Rpqzq.pif -
Loads dropped DLL 4 IoCs
Processes:
batchfile.batRpqzq.pifregsvr32.exepid process 4840 batchfile.bat 2548 Rpqzq.pif 644 regsvr32.exe 2548 Rpqzq.pif -
Processes:
resource yara_rule behavioral2/memory/4616-0-0x0000000000400000-0x00000000006A2000-memory.dmp upx behavioral2/memory/4616-10-0x0000000000400000-0x00000000006A2000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\375C.tmp\batchfile.bat upx behavioral2/memory/4840-17-0x0000000000400000-0x0000000000431000-memory.dmp upx C:\Users\Admin\AppData\Roaming\1.exe upx behavioral2/memory/4364-34-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4840-37-0x0000000000400000-0x0000000000431000-memory.dmp upx behavioral2/memory/2548-51-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4364-53-0x0000000000400000-0x0000000000458000-memory.dmp upx C:\Windows\SysWOW64\zlib.dll upx behavioral2/memory/2548-65-0x0000000010000000-0x0000000010014000-memory.dmp upx behavioral2/memory/2548-69-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/2548-71-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/2548-73-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/2548-74-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/2548-76-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/2548-78-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/2548-80-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/2548-82-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/2548-84-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/2548-86-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/2548-88-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/2548-90-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/2548-92-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/2548-94-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/2548-96-0x0000000000400000-0x0000000000458000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
1.exeRpqzq.pifdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nKlfz7 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Rpqzq.pif\"" 1.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lcK9dux = "\"C:\\Users\\Admin\\AppData\\Roaming\\Rpqzq.pif\"" 1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FJ63oBDZ6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Rpqzq.pif\"" Rpqzq.pif Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\R6hYGd = "\"C:\\Users\\Admin\\AppData\\Roaming\\Rpqzq.pif\"" Rpqzq.pif -
Drops file in System32 directory 3 IoCs
Processes:
1.exeRpqzq.pifdescription ioc process File opened for modification C:\Windows\SysWOW64\win.com 1.exe File opened for modification C:\Windows\SysWOW64\zlib.dll Rpqzq.pif File opened for modification C:\Windows\SysWOW64\mswinsck.ocx Rpqzq.pif -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2324 4840 WerFault.exe batchfile.bat -
Modifies registry class 64 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer\ = "MSWinsock.Winsock.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID\ = "MSWinsock.Winsock" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1\ = "132497" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\ = "Winsock General Property Page Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ = "Microsoft WinSock Control, version 6.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS\ = "2" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\ = "Microsoft WinSock Control, version 6.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx, 1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\ = "Microsoft WinSock Control, version 6.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID\ = "MSWinsock.Winsock.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
1.exepid process 4364 1.exe 4364 1.exe 4364 1.exe 4364 1.exe 4364 1.exe 4364 1.exe 4364 1.exe 4364 1.exe 4364 1.exe 4364 1.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
batchfile.bat1.exeRpqzq.pifpid process 4840 batchfile.bat 4364 1.exe 2548 Rpqzq.pif 2548 Rpqzq.pif -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
09bf965f2e6c6182342110ec95cbacdd_JaffaCakes118.exeb2e.exebatchfile.bat1.exeRpqzq.pifdescription pid process target process PID 4616 wrote to memory of 1864 4616 09bf965f2e6c6182342110ec95cbacdd_JaffaCakes118.exe b2e.exe PID 4616 wrote to memory of 1864 4616 09bf965f2e6c6182342110ec95cbacdd_JaffaCakes118.exe b2e.exe PID 4616 wrote to memory of 1864 4616 09bf965f2e6c6182342110ec95cbacdd_JaffaCakes118.exe b2e.exe PID 1864 wrote to memory of 4840 1864 b2e.exe batchfile.bat PID 1864 wrote to memory of 4840 1864 b2e.exe batchfile.bat PID 1864 wrote to memory of 4840 1864 b2e.exe batchfile.bat PID 4840 wrote to memory of 2072 4840 batchfile.bat iexplore.exe PID 4840 wrote to memory of 2072 4840 batchfile.bat iexplore.exe PID 4840 wrote to memory of 4364 4840 batchfile.bat 1.exe PID 4840 wrote to memory of 4364 4840 batchfile.bat 1.exe PID 4840 wrote to memory of 4364 4840 batchfile.bat 1.exe PID 1864 wrote to memory of 4048 1864 b2e.exe cmd.exe PID 1864 wrote to memory of 4048 1864 b2e.exe cmd.exe PID 1864 wrote to memory of 4048 1864 b2e.exe cmd.exe PID 4364 wrote to memory of 2548 4364 1.exe Rpqzq.pif PID 4364 wrote to memory of 2548 4364 1.exe Rpqzq.pif PID 4364 wrote to memory of 2548 4364 1.exe Rpqzq.pif PID 2548 wrote to memory of 644 2548 Rpqzq.pif regsvr32.exe PID 2548 wrote to memory of 644 2548 Rpqzq.pif regsvr32.exe PID 2548 wrote to memory of 644 2548 Rpqzq.pif regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\09bf965f2e6c6182342110ec95cbacdd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\09bf965f2e6c6182342110ec95cbacdd_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3681.tmp\b2e.exe"C:\Users\Admin\AppData\Local\Temp\3681.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\3681.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\09bf965f2e6c6182342110ec95cbacdd_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\375C.tmp\batchfile.bat"C:\Users\Admin\AppData\Local\Temp\375C.tmp\batchfile.bat"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\375C.tmp\batchfile.bat"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 5164⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Rpqzq.pifC:\Users\Admin\AppData\Roaming\Rpqzq.pif5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\system32\mswinsck.ocx"6⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\selfdel0.bat" "3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4840 -ip 48401⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3681.tmp\b2e.exeFilesize
2.6MB
MD5333daf1122d0b642a24caf3e35e6c685
SHA1ed051b2e422f8487d166da4461ea9a9bf2ff22ca
SHA256985645c3ccff912547cf542cb4c5efed1c9254f78ebe96ea4bc2587895c686ac
SHA51298fec4a769e1499d6eb0717e62b7519df1aead8c27f181d3cd5058bdd548df0b99ce65baae33dcd18f95199f2f5233a0dcfe653a3d4bc05c0b56f23df17d68d1
-
C:\Users\Admin\AppData\Local\Temp\375C.tmp\batchfile.batFilesize
168KB
MD5b815f329d9fa598b8d758d6a11f39d15
SHA1107ffe308c333adb682b08c1e6b92cfffd0b76d1
SHA256d7d6d7f4cfd710a40fccd1602f710b876294f54dfc4e92ceec88a3ce3fa14127
SHA5121f2b8607d50ee0a5f39fdeb24b602565dbe345f29372babfffaffaf5ea92e2a27e595b721a73a235606fa1c406faf15c5e9c15ab8777cca3dd3c89c173c6f14d
-
C:\Users\Admin\AppData\Local\Temp\selfdel0.batFilesize
158B
MD5a16477e4738777313e46fd6ebc124a8e
SHA1aad9e33b9dfa22137e3979911411612e736b6b89
SHA2563a6fdf522abc11d0e63fe7ddd1e8db066aa50bc960c78d8b38463545a3414b91
SHA5127730a36e76f17eb144cdc9474e2df70802b86fda679d1ac9fffb23b8caf3bdc3f3eceafdeaabed522762ec5a46c0b0a88cc61d5ba0c6a65a9d21660ee102f56b
-
C:\Users\Admin\AppData\Roaming\1.exeFilesize
150KB
MD5a61afbe928f23e7651b0a921e602a520
SHA180259d32845eb6a63f0a8e95fdf4ce952a92fe0b
SHA25681a99f7983e97abe455110b3962519e21f2b4a1756ad4636e56dc1906d0c6738
SHA5123931247db4859d50752a00751aea5bbfd1b7523e26053847bda6c7e932e71a729c70c3599d6c3281500a579eac86d65d629a5f75ad19e2aed24e2cca67fbfa46
-
C:\Users\Admin\AppData\Roaming\kernel33.dllFilesize
625KB
MD5358611b92e360a749054fdc7b6b076ea
SHA1d6d2224161fee024ab3767a81ed57f7e57d0c1ce
SHA25679782a87dfd093a0e4196d6f0aa4d46a55c0290f6145f5f8fa60e53c540f89b4
SHA5120986c84ed52b42b3aeb96479032e188165d1fa1d5c7018e240b444e03eb6317365ea51fc0233263f7e97f099cd3ca3094ab0b177c0405816bc800b41f42523ad
-
C:\Windows\SysWOW64\mswinsck.ocxFilesize
105KB
MD59484c04258830aa3c2f2a70eb041414c
SHA1b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA256bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
SHA5129d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
-
C:\Windows\SysWOW64\zlib.dllFilesize
27KB
MD5200d52d81e9b4b05fa58ce5fbe511dba
SHA1c0d809ee93816d87388ed4e7fd6fca93d70294d2
SHA256d4fe89dc2e7775f4ef0dfc70ed6999b8f09635326e05e08a274d464d1814c617
SHA5127b1df70d76855d65cf246051e7b9f7119720a695d41ace1eb00e45e93e6de80d083b953269166bdee7137dbd9f3e5681e36bb036f151cea383c10d82957f39c5
-
memory/1864-42-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1864-9-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/2548-80-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2548-73-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2548-96-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2548-51-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2548-94-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2548-92-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2548-61-0x0000000002020000-0x0000000002047000-memory.dmpFilesize
156KB
-
memory/2548-65-0x0000000010000000-0x0000000010014000-memory.dmpFilesize
80KB
-
memory/2548-90-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2548-69-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2548-71-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2548-88-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2548-74-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2548-76-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2548-78-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2548-86-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2548-82-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2548-84-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4364-53-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4364-34-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4616-0-0x0000000000400000-0x00000000006A2000-memory.dmpFilesize
2.6MB
-
memory/4616-10-0x0000000000400000-0x00000000006A2000-memory.dmpFilesize
2.6MB
-
memory/4840-37-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4840-17-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB