d1a3fee43f7c69cff3a6401d0ec704185534adeb36c1a701b0ecd8424b2263b3

Analysis

max time kernel
170s
max time network
189s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb390cb81b3ec509e2db0c4ab3964396_JaffaCakes118.exe
Size

40KB
MD5

eb390cb81b3ec509e2db0c4ab3964396
SHA1

10dae46ac0452663be8bfc461e72d5eb4e9e1397
SHA256

d1a3fee43f7c69cff3a6401d0ec704185534adeb36c1a701b0ecd8424b2263b3
SHA512

04c64e5c8eaa33f1aca7f2f48556a7fbc7bd4d6f4e4be8edf4796a7413c12af360cdc1ca4d7413c2b3f5f74ae8a869c597ff273902b66e4a8f4937c28136a1a0
SSDEEP

768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtHj3+Zl:aqk/Zdic/qjh8w19JDHjY

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2612	services.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000012246-7.dat	upx
behavioral1/memory/2736-4-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2612-11-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2612-17-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2612-22-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2612-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2612-27-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2612-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2612-35-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2612-50-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2612-53-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2612-57-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2612-58-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2612-62-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2612-66-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2612-67-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2612-557-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	eb390cb81b3ec509e2db0c4ab3964396_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	eb390cb81b3ec509e2db0c4ab3964396_JaffaCakes118.exe
File opened for modification	C:\Windows\java.exe	eb390cb81b3ec509e2db0c4ab3964396_JaffaCakes118.exe
File created	C:\Windows\java.exe	eb390cb81b3ec509e2db0c4ab3964396_JaffaCakes118.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	eb390cb81b3ec509e2db0c4ab3964396_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	eb390cb81b3ec509e2db0c4ab3964396_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	eb390cb81b3ec509e2db0c4ab3964396_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	eb390cb81b3ec509e2db0c4ab3964396_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	eb390cb81b3ec509e2db0c4ab3964396_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	eb390cb81b3ec509e2db0c4ab3964396_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	eb390cb81b3ec509e2db0c4ab3964396_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	eb390cb81b3ec509e2db0c4ab3964396_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2612	2736	eb390cb81b3ec509e2db0c4ab3964396_JaffaCakes118.exe	27
PID 2736 wrote to memory of 2612	2736	eb390cb81b3ec509e2db0c4ab3964396_JaffaCakes118.exe	27
PID 2736 wrote to memory of 2612	2736	eb390cb81b3ec509e2db0c4ab3964396_JaffaCakes118.exe	27
PID 2736 wrote to memory of 2612	2736	eb390cb81b3ec509e2db0c4ab3964396_JaffaCakes118.exe	27

C:\Users\Admin\AppData\Local\Temp\eb390cb81b3ec509e2db0c4ab3964396_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eb390cb81b3ec509e2db0c4ab3964396_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
893B

MD5
d4ae187b4574036c2d76b6df8a8c1a30

SHA1
b06f409fa14bab33cbaf4a37811b8740b624d9e5

SHA256
a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7

SHA512
1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
225d66f84f3517a89d7183cfcc95c71c

SHA1
2cd1d21e864a5c584b8fe7beb45ff7d54afb3d19

SHA256
6d8a16727fb1118658b5e8effbc89a2007b3cc8733f7be966ff9ef48e4747745

SHA512
17506dcfafe2ea073e0ab8d94acc08bd95a564314581f857a76cd20595efcafa69f213ec381ab46308a5aab80cb7443858d86ac9ce65f2cc2890ba7283148869

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc6eb8f22969d6d75b6490fcef265ee8

SHA1
04f1016baf4e0e2693ce6f6bd39b14bd4c886061

SHA256
a388638a14ce0be694f9a696103cbc5bf33bdd329d522d1f46c54cbbbe542319

SHA512
e0489f6e1b7f8cdc28419d322ce42a9e8cef0a707344c4e3ce14e1431acbc52b27d75cf3b93332e909f76ed23bfdcbc7d65deab38e7c0e0cbb7cb968ac90b56d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11b01fd3c4e0c37a6f35376cfc0c58fa

SHA1
5a056b9ee9df41375e301ba754442b9d00b638ec

SHA256
67f304797c5c3b8dbc13d5cce093140424383a3089cc43d080bac4e9c7430c63

SHA512
c05127f5e6df2bd246415ff3fa2eba067bbc3daa0d7d0ae9f414b627d410bdc4e2a1edc8a0c9aea57e92efbf7850f61b8dd3f2e02f9d126db4d884bb5575d284

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42d5df5c735b523e97d6ca95879b8496

SHA1
67a3012a09ab07dfd7617ad4cbe6b7c9d768dc1a

SHA256
247f60e9d65456fed3b8db722707f399957be748f8c196965ec38efe32880e16

SHA512
7cfc3b388ca9bf5f8d22a6fc34b3dd3097e545afffe62604f5234d45dc590c549bc955aeaeab228db5255930f5496725135fb01df00a7994c78c96be7758aba0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
935cf857fcd56cf7db3a3858523ae170

SHA1
5b5d461ac68fb8d0429fe95de0041e0c072a8e58

SHA256
67aeeb4582442d19899dbbed95ac22d6611bf844d205591ed78f163f0d2ecf34

SHA512
23ed817af1d22269d8da5f74f4ddd131a68fed31a8e6dfdc22824596883da872911c7522cc647378d89a9cc7d86099b5a1193e99c7babb0f8752749cc1ecf0a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c27e3607cf229c66cb5ab2af7d8d346

SHA1
37b56afbe66ac6cc2fdffbfe537223512715e931

SHA256
6e2166d472570fec8dbf77e6de072c6fb23eb9f19e0f5ad8a8a629a357b64210

SHA512
5ae147226a8acb8a0313a2e655955041e573139258472feb11093c5a0d6a14310f619811f5178052ed456367b582341d395dec04275960eacfbf91bdfda3cc68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dc9dc0721612715922d3f5d541cb777

SHA1
50606e4be77378f2db07fcdf70ad72825c8bad87

SHA256
b048bd7650bec76f3238877efcbd6262f202fccb370aeeada88b294a16d66592

SHA512
48ab2728ee5873d43557c1b404f4c6c8db7df05a106e0a4a38e6a87073557da66ef3bde90a6d96d6ff70a64401a16be08904169fcc3a1ebc02044eb9f6028f63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f1d08e287c788db3949ef94619ef59e

SHA1
89ba620309a53bd8b361a9b3b39545cc94c20b1e

SHA256
2dea250f0db784b35962f99b16accce734f039bfcce694b9aaf19bafe08c09c4

SHA512
24eefc0be64838841c463f058f790b12a5f4bcda8f14026b08efbeef4c491b51449966d8ee9dc23b838aeabc5b613735e96c0cf5c4ad9dbe3add54e367730bfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de3b128670725bcfe4704cb8f396ac39

SHA1
b09feee85941ceeae378e60b8ae093b8124fddae

SHA256
553f8002ef44fb953c1413b264f052c33ba70ff0779a6ca6decb33d7e935ae71

SHA512
f03e7ac315047bfea7f2db46fea2bdede2e1b76a7992966a6cca796407b2591900fae1599a5555fc8485c4b358ffe15c2b0d55cdc17177fa9aff6793dd2bd736

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
392c8fa5e5315fd006a1f77955f800df

SHA1
76a0c35e0d9e8da1804f3f568414004bb939819c

SHA256
5c961da3a24c448068413b5cf2d1f356fc7613c3b5904bfda6e260ddf7b0e3f8

SHA512
cd3031dfd597fdcb75b463187c55455244d5b65591646df9a2f3db96647340cde6f40cf936f5cf7bea2c5040dd76da0891e75967cf213486e69d5644d55bb33d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c83e64a774b5472a3a0c1114d388b21d

SHA1
d517399e0f10ffea20d4e5a70649941156803778

SHA256
80224aea4b8bec137178b2dda101cb83c377e37511797ec5b06bf3b0c78d5803

SHA512
40b02acc48241ac0fe34e3f893f467d246fcac217c96ffe705e0cd4730b266f948fe09a8627129e5aed5817cb457f6624d2cc779a55e6faa925b830b6502b372

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66a480835b5befd97faadea943177eb3

SHA1
5e6fc99ffbdb6624b16551903539cdf58167431e

SHA256
e8cd7c41a45a0ae674ff6963a1c574b93ac59bf26b9b14a6b671d849f04f0436

SHA512
bbf41dea4c2eeda8cf4f914210f8994f83f56aeefe5dfb41a7af66706e68161e424c91d6dc3d1ffba22cae83ea2b8545f848fc6f49a7e5640770a3962f010494

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
751cd0503d4b719527156aeee2d2696e

SHA1
ad99f42a8e2ac61b538289e165682e6e7f0ddd83

SHA256
fe4b325eb4d671fe5cd7a812ce419f369a2e6e6e56e9eeee9f540f8560c3169a

SHA512
5db827f6037605ac2d6267fb98b6791f2e65004e3c7ecdc6a66d34888b67f6115a55c1986aad27b7c904626aa448542f03382a7547ec5b293f870572e23460aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cf457fd62c1492c3c297a34e409df48

SHA1
4c0ee5ffdb7a2c785ea7e4e6211143f93b42bfd9

SHA256
c847f5773b06a42b303ebaeb005597c2629b3de33dcf70b3ab068e80369e023f

SHA512
318dd0e55a316e9bec1ff6101cea05ce30f7480385680999db17e071f0531f52dbd5f400d1989acc6265703c783f5f059a828ff6caafefc3079703492f8bb47a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57b824a168e7b547cc91d980a383b9c8

SHA1
8c5ddb1ba29813152abe6c5bc5682e2a2dd1f271

SHA256
520302663067b02baac8ccd1499f44b8933f85ccbba41e2432cd68ef1118b4ed

SHA512
d02caefc1e7b7261e90800d95a7755a97a9f46fbea6c1720bd95d76885a9269f00a5a218552f008f4ac3d9d3c26e1860b993a70578c47049f5e33506b4b676a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5ad455f6bc21d55e26f133f54d4f120

SHA1
db7b12e81c80eed2c5b294c4b1719a1680760c16

SHA256
d74a693c2f5662547bfaf3e275448a65e21c26b0142bef1ab427c7d99de46dec

SHA512
7907dad5ecc47c73e73607273a0fe869a9a312449de77387176dd76bb7043ce8e1c806a48a3ed81e0783b83dbdfe1c48278b30b17b4a99400e6b86c1a032c6bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0eb672f3b679756175ad766190d23d85

SHA1
1f0d8e582d4e4cb51cc8851a757c2935c539f7f3

SHA256
8e7710a7a37fe425e419f5ea75d716c94931c1d0d732fc207b6d7dda89efd0ba

SHA512
c9ae0fa4423dc89dba929bbe571516dda4bfae8e986da6df408e79ebf894d74597a495167492935ec5344ef774f673a35c9b19ace4f4d51339609852484e7f52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56d3a4f4dc900e372ff5b5f2dcdc7438

SHA1
679be60160ea78d186defbcb2e6399db5c09c5f6

SHA256
61029cea14236ca5a67f968b0e39bd87b00adda1f85e56b926ae3d7f338114da

SHA512
49fbb2527801f80e062bfb6029bcdeebca2eba957605d907a7905b697ef5a78ae55f3c08d225cdcfc791c9551d986f40a9d0edcac00cda8fa0044960f9ebbf18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

Filesize
252B

MD5
5f4737014373eec9d50a52b762e02e70

SHA1
2793f4deac7fea921754f58a4431696b8e674b8b

SHA256
719c6b46843f2c2cbc32c6fa384c63af8ebd09958fc86c18080cc1ebd7384b96

SHA512
975b28075f1e00d8ebfe80cdd963156641f4c22d9a1530f7942cd96df2b3cd81a19451e15269269cf086f596670146c363f54965f35375656763f5da0ed698e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IKDEMF4Q\search[1].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDD0E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDD40.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDE34.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC765.tmp

Filesize
40KB

MD5
f2a52d2168cf3e3973ccf2077b5458d3

SHA1
2172d9215a70f8b004c1391ebd241e9f1a66fb46

SHA256
e5763b5e6e23f7b95e14c19c9ed11a4f565143f84724e8fd003201af4cb893a1

SHA512
1205e4a80037acfd69d66cf3bb0cb634de9ae030e1cc2a67a0a38b069945b44a242818cc852a91041276472eef68d557f60c62f4a53dc12958f851f9e1b15194

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
6ebb9f58a60725aaa5d01d7025937ba4

SHA1
03d50d8b6514e7de7ee765083b75bbee78e87271

SHA256
c6fc611fe8617ec9b4bc6921d08b7860d4968fd8c70138be54ca044203d34c7b

SHA512
7789f61477b2f59e8aa52d0ab544895dea8b263c071bc0a0cc5ad7b84d5ebfd503390f95165dff9295b45b3e1954e1d07371ebf262ced851750cfa2bf3209976

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
a1aa042ffd241f2ed359d034f9792212

SHA1
897bff5dfe7e99954c9926c3acb5e8ac0627efdc

SHA256
1833d1be82735c32ea81203f34ded67b634bcf9bf2cbec9fd6e776a0de2cf171

SHA512
90e647bbbbfe0575c21334a0e86442b81a0da98f6bc1c0c3b4bf9a6aeb19b759b44811486e732edfeb482b028e86bd4cd982cb5c3d7fd74c1b354a783eff25ee

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2612-35-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-53-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-50-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-58-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-62-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-67-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-27-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-57-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-22-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-66-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-557-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-17-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2612-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2736-9-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2736-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2736-4-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2736-0-0x0000000000500000-0x000000000050D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads