Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system - submitted
14/04/2024, 22:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
efb5b4193206cbc0813e9c93f8432be3_JaffaCakes118.exe
Resource
win7-20240220-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
efb5b4193206cbc0813e9c93f8432be3_JaffaCakes118.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target efb5b4193206cbc0813e9c93f8432be3_JaffaCakes118.exe
- Size 937KB
- Sample240414-2x79daga86
- SHA256 1d2851cb25ebbe6054a0de127ef44f384eab3820a51c85a94042a447b0303722
- MD5 efb5b4193206cbc0813e9c93f8432be3
- SHA1 640e45da357a7e518ed0c938c1339a75e6b70cd7
- SHA512 21452d2b6dbe8ebf1eefd21964cd1832559faec78bb0e44ef4d7b292f8aee3ae95367717380ca980173efa0696785145d5ffd413b0d1d43756b14b422c759ca4
- SSDEEP 24576:WkLRhwtZT/v46nMQmAcOtWCW+yZzbqJnmQ8qS9Vx6+E:WMRhA4LHpO4CqvqgJ9V4D
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation efb5b4193206cbc0813e9c93f8432be3_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation rinst.exe Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation For Public.exe - Executes dropped EXE 4 IoCs
pid Process 2292 rinst.exe 3968 For Public.exe 4148 bpk.exe 3608 maincit.exe - Loads dropped DLL 8 IoCs
pid Process 4148 bpk.exe 3968 For Public.exe 4148 bpk.exe 4148 bpk.exe 3608 maincit.exe 3608 maincit.exe 3608 maincit.exe 2408 efb5b4193206cbc0813e9c93f8432be3_JaffaCakes118.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\bpk = "C:\\Windows\\SysWOW64\\bpk.exe" bpk.exe - Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A} bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ = "PK IE Plugin" bpk.exe - Drops file in System32 directory 8 IoCs
description ioc Process File created C:\Windows\SysWOW64\inst.dat rinst.exe File created C:\Windows\SysWOW64\rinst.exe rinst.exe File opened for modification C:\Windows\SysWOW64\pk.bin bpk.exe File opened for modification C:\WINDOWS\SysWOW64\Hand.cur maincit.exe File created C:\Windows\SysWOW64\pk.bin rinst.exe File created C:\Windows\SysWOW64\bpk.exe rinst.exe File created C:\Windows\SysWOW64\bpkhk.dll rinst.exe File created C:\Windows\SysWOW64\bpkwb.dll rinst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3383D1F1-029B-43B1-8733-289322EA85FA}\1.0\FLAGS\ = "2" maincit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C40DE621-5879-4553-882A-EA3F1109E290}\ = "__ucAniGIF" maincit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C40DE621-5879-4553-882A-EA3F1109E290}\ProxyStubClsid32 maincit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CLSID\ = "{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\Version = "1.0" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3383D1F1-029B-43B1-8733-289322EA85FA}\1.0\FLAGS maincit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C40DE621-5879-4553-882A-EA3F1109E290} maincit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\VERSION maincit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} maincit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ = "IViewSource" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{08D24088-19F0-490A-93C8-84B68381D155} maincit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\MiscStatus\1 maincit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\ = "IE Class" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ProgID\ = "PK.IE.1" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\bpkwb.dll" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08D24088-19F0-490A-93C8-84B68381D155}\ = "_ucAniGIF" maincit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08D24088-19F0-490A-93C8-84B68381D155}\ProxyStubClsid32 maincit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08D24088-19F0-490A-93C8-84B68381D155}\TypeLib\Version = "1.0" maincit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\0 bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\0\win32 bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A} bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\Control\ maincit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0 bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\ = "BPK IE Plugin Type Library" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ = "IViewSource" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08D24088-19F0-490A-93C8-84B68381D155}\ProxyStubClsid maincit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} maincit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1\ = "IE Plugin Class" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CurVer bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3383D1F1-029B-43B1-8733-289322EA85FA}\1.0\ = "WelchGIFviewer" maincit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\ = "{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\FLAGS\ = "0" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0} maincit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\ProgID maincit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ProgID bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\FLAGS bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\ = "{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CLSID bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A} bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} maincit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1\CLSID bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1\CLSID\ = "{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C40DE621-5879-4553-882A-EA3F1109E290}\ = "__ucAniGIF" maincit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\Version = "1.0" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C40DE621-5879-4553-882A-EA3F1109E290}\TypeLib\Version = "1.0" maincit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX1\\GIFviewer.ocx, 30000" maincit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\VersionIndependentProgID bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{08D24088-19F0-490A-93C8-84B68381D155}\ProxyStubClsid32 maincit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\MiscStatus\1\ = "147857" maincit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C40DE621-5879-4553-882A-EA3F1109E290}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" maincit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\ = "WelchGIFviewer.ucAniGIF" maincit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C40DE621-5879-4553-882A-EA3F1109E290}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" maincit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C40DE621-5879-4553-882A-EA3F1109E290}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}" maincit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3383D1F1-029B-43B1-8733-289322EA85FA}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX1\\GIFviewer.ocx" maincit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08D24088-19F0-490A-93C8-84B68381D155}\TypeLib maincit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ = "IE Plugin Class" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3383D1F1-029B-43B1-8733-289322EA85FA} maincit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\TypeLib\ = "{3383D1F1-029B-43B1-8733-289322EA85FA}" maincit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7D518439-D9BE-4A7E-A76B-2FB2A03369F0}\Implemented Categories maincit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C40DE621-5879-4553-882A-EA3F1109E290}\ProxyStubClsid32 maincit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WelchGIFviewer.ucAniGIF\Clsid maincit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08D24088-19F0-490A-93C8-84B68381D155}\ = "ucAniGIF" maincit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3383D1F1-029B-43B1-8733-289322EA85FA}\1.0 maincit.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4100 msedge.exe 4100 msedge.exe 1068 msedge.exe 1068 msedge.exe 1416 msedge.exe 1416 msedge.exe 4900 identity_helper.exe 4900 identity_helper.exe 5932 msedge.exe 5932 msedge.exe 5932 msedge.exe 5932 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
pid Process 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe - Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 4148 bpk.exe 4148 bpk.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 1416 msedge.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 4148 bpk.exe 3608 maincit.exe 3608 maincit.exe 4148 bpk.exe 4148 bpk.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2408 wrote to memory of 2292 2408 efb5b4193206cbc0813e9c93f8432be3_JaffaCakes118.exe 87 PID 2408 wrote to memory of 2292 2408 efb5b4193206cbc0813e9c93f8432be3_JaffaCakes118.exe 87 PID 2408 wrote to memory of 2292 2408 efb5b4193206cbc0813e9c93f8432be3_JaffaCakes118.exe 87 PID 2292 wrote to memory of 3968 2292 rinst.exe 89 PID 2292 wrote to memory of 3968 2292 rinst.exe 89 PID 2292 wrote to memory of 3968 2292 rinst.exe 89 PID 2292 wrote to memory of 4148 2292 rinst.exe 90 PID 2292 wrote to memory of 4148 2292 rinst.exe 90 PID 2292 wrote to memory of 4148 2292 rinst.exe 90 PID 3968 wrote to memory of 3608 3968 For Public.exe 91 PID 3968 wrote to memory of 3608 3968 For Public.exe 91 PID 3968 wrote to memory of 3608 3968 For Public.exe 91 PID 3608 wrote to memory of 1416 3608 maincit.exe 92 PID 3608 wrote to memory of 1416 3608 maincit.exe 92 PID 1416 wrote to memory of 3940 1416 msedge.exe 93 PID 1416 wrote to memory of 3940 1416 msedge.exe 93 PID 3608 wrote to memory of 3368 3608 maincit.exe 94 PID 3608 wrote to memory of 3368 3608 maincit.exe 94 PID 3368 wrote to memory of 1932 3368 msedge.exe 95 PID 3368 wrote to memory of 1932 3368 msedge.exe 95 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4712 3368 msedge.exe 96 PID 3368 wrote to memory of 4100 3368 msedge.exe 97 PID 3368 wrote to memory of 4100 3368 msedge.exe 97 PID 1416 wrote to memory of 2692 1416 msedge.exe 98 PID 1416 wrote to memory of 2692 1416 msedge.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\efb5b4193206cbc0813e9c93f8432be3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\efb5b4193206cbc0813e9c93f8432be3_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\For Public.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\For Public.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\maincit.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\maincit.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://freepremiumdownload.com/5⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb5ed46f8,0x7ffeb5ed4708,0x7ffeb5ed47186⤵PID:3940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,16424309938745682469,6499068168979977998,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:26⤵PID:2692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,16424309938745682469,6499068168979977998,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:36⤵
- Suspicious behavior: EnumeratesProcesses
PID:1068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,16424309938745682469,6499068168979977998,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:86⤵PID:2312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,16424309938745682469,6499068168979977998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:16⤵PID:404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,16424309938745682469,6499068168979977998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:16⤵PID:1676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,16424309938745682469,6499068168979977998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:16⤵PID:1292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,16424309938745682469,6499068168979977998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:16⤵PID:4288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,16424309938745682469,6499068168979977998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:16⤵PID:5320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,16424309938745682469,6499068168979977998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:16⤵PID:5504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,16424309938745682469,6499068168979977998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:16⤵PID:5828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,16424309938745682469,6499068168979977998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:16⤵PID:5836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,16424309938745682469,6499068168979977998,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6328 /prefetch:86⤵PID:6056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,16424309938745682469,6499068168979977998,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6328 /prefetch:86⤵
- Suspicious behavior: EnumeratesProcesses
PID:4900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,16424309938745682469,6499068168979977998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:16⤵PID:1784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,16424309938745682469,6499068168979977998,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:16⤵PID:5140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,16424309938745682469,6499068168979977998,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:16⤵PID:4748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,16424309938745682469,6499068168979977998,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5140 /prefetch:26⤵
- Suspicious behavior: EnumeratesProcesses
PID:5932
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gopremiumaccount.blogspot.com/5⤵
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffeb5ed46f8,0x7ffeb5ed4708,0x7ffeb5ed47186⤵PID:1932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,9900572077506040310,15002040249639134123,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:26⤵PID:4712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,9900572077506040310,15002040249639134123,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:36⤵
- Suspicious behavior: EnumeratesProcesses
PID:4100
-
-
-
-
-
C:\Windows\SysWOW64\bpk.exeC:\Windows\system32\bpk.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4148
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4900
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2216
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 38b634f3fedcf2a9dc3280aa76bd1ea93e192200b8a48904664fac5c9944636a
- MD5 dc629a750e345390344524fe0ea7dcd7
- SHA1 5f9f00a358caaef0321707c4f6f38d52bd7e0399
- SHA512 2a941fe90b748d0326e011258fa9b494dc2f47ac047767455ed16a41d523f04370f818316503a5bad0ff5c5699e92a0aaf3952748b09287c5328354bfa6cc902
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 39205cdf989e3a86822b3f473c5fc223d7290b98c2a3fb7f75e366fc8e3ecbe9
- MD5 cff358b013d6f9f633bc1587f6f54ffa
- SHA1 6cb7852e096be24695ff1bc213abde42d35bb376
- SHA512 8831c223a1f0cf5f71fa851cdd82f4a9f03e5f267513e05b936756c116997f749ffa563623b4724de921d049de34a8f277cc539f58997cda4d178ea205be2259
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
- Size 20KB
- SHA256 73279553e1043b5a1f12766aadf552ffdaeb0a22bff842e68a299dbb7af01ec8
- MD5 0c537a82da568b1528a5b4c5db95f169
- SHA1 cbce4bdcd79433b66466b9fe3c0fec730b1a5bb4
- SHA512 76ed9ad0826f246c6a3b1b00215625e38437d477e1df4c57c2a56071a4c2d80465a62062b44e33de2ba58f90e664f0c9bdedc2b274ab54706209b812c0d95485
- SSDEEP 384:cTT2NcvhvDmPRy1koewbRMLmK/AjRlO3ITYkcvoOGtC2tzE1KVxMM:Rc5WYDeCRMCiYF0rvam1K8M
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
- Size 44KB
- SHA256 891dc8b9999ba1b2d25c1a044b49330b66b86f986478282f4e5950b726e9878f
- MD5 57ae46a87a9955c7c61ce5cfebde0bf6
- SHA1 2a9297a0e2ee5f4e0a9b1de88ffd2121d5d2ca77
- SHA512 34e51215e347df35ae4cf8420e2148420780f78123a37450682ed92841c6e1dd1635317cae1ef925a001bda733228db0f5de87faa0a10c36cb967e9b70691689
- SSDEEP 768:zznaVeiIgbPR01gJRjixXV2ATZI8hrymPuTbpioqqZw0b4S6:PnaoEZ01ypuXVrTJhrymGTpqM8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 456B
- SHA256 c8f415155dc44f2f4eb76666b2b4dc1a1f2fb8e555fa2ce1466fe85b7fe8ede7
- MD5 1d2539293afdda02ed083db13296cfae
- SHA1 0c1eabc8ebdcf4b24b26d447b1c255dc6892a6ff
- SHA512 960ada7459f57a82b788dce5d16a9cf933fc7df83d8ec7c2596141f5b69b067f4d576bd2c87fa1f99a813642528a20efd81b0e7ab43223f817e87cf1817fd857
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 456B
- SHA256 621e2f0f57ec5e84bc3113b064c07baf806f4088791b3995d3f8666a72a72d25
- MD5 fbe2fa8da27d044c436ab7859459da06
- SHA1 f5eae5f2465c506465ba58114ff0ce7a38ac5d39
- SHA512 605f59bd004dedda0dab36f751dbc074b881cb79348235d5f48653e8eee39a4357e4b119e9382286c0d5acf2cddb492d1fc72034c84082bea3be65e78f1e9bfa
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 2KB
- SHA256 1d48913b527f68edd6d222f0f8df7d0a838e5fda17fb5fbd7364146f175b8eb8
- MD5 cbc7af90ca11017f9a06b8529efd5d9e
- SHA1 510e379c29d75c60289933cd62661bcc6d71ede8
- SHA512 a1970ce319952a73f3235a8140f7534e91a046891595d99d05a1f528f95a3680452f3f2b03c828139be3be75cd5beefd01348aca89478e91400a1886494e8f2e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 1db5111140008880b951bab52cad692c3910220246d40ab7420c136aa4d2129b
- MD5 77c413c5098f7c21eecff9470865050c
- SHA1 d087abf137af59373edf46a3cee52f2f29b45a3c
- SHA512 ec6aa5816c771ad3efce2330dafd4d2af75a057c312e7b0556cc417e214294541e8ab28287174092e515cd8fdc33b723756fec0f07a933710275b984f3365ed2
- SSDEEP 96:nkksNb/um1f/OwpvWMoiVmdeHmN4UWQyV+VDCziEwb:nkksNH9WGWMXfro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 7KB
- SHA256 c7e92e2ca643dd102483b1e8726d6768d18f586da918f1d1ec8da6d029ce9e04
- MD5 be63d89da56bb7dbd056c9edbc628147
- SHA1 744ed93abe0c3f755c6603d0a029499f03981655
- SHA512 7f727bb93f21852787823ceae8107c20214f2f1c9b47a6dd9db52c76dd56fc9c97159848634c0588bc5f83d19408c9959cb60312a67218b74e87aa99208a5ad8
- SSDEEP 192:nkksNH9eGWMeuDCA/2aEYYQMpB+Yi2Zrg:nk9x9vWWMW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 f7ed212e13198a90dc2b58b746c339d9ecbb91d0fb4023ce0703961b5282811e
- MD5 60a02c3fd2d50a6faa8df41ce4c57c04
- SHA1 44c40af8852b39a8af538990add0fa78c92a9059
- SHA512 4227efa2a720538a35012cd22fcbe0ce67f132e5a7239f0d7e3542563de26048cea5e9ae2f0ce4711ec22e82d85f2e7913a033bc2856c078ea6a09f3c965d225
- SSDEEP 192:7oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupGS2ye2RUuql+:r9iIxuERzA83h09RZxYSM6+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 615052517c6b567cfafa535c8fa943563a88ea68bc39a75530fbb8bfc640804e
- MD5 e6f6ac4d950e9670a642197ffeb24e0d
- SHA1 7b1a44bbb40b4ef8c8cfaad90d2103760b63ab49
- SHA512 b51199424bdac3db2a95e49291da1d9fce4a0d054eabd43fea3cdfc4cf32352cb102e9273cd99b241e251c0ec3d813df767c0ecba543dea99665f3a01f2a659f
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupPRe2RUMStl5KoiXs4YwKso:A9iIxuERzA83h09RZxYPFfA0o4NYwpgT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\For Public.exe
- Size 726KB
- SHA256 62e95cfcc24f329d3866bf6d9207f28bf102bf466802c56535cad70f7e4aeb49
- MD5 776a5cb5ce5136dde367ab157b8840cb
- SHA1 217259e01fa2fbc7fe7d385dab105bd08b7ee3a8
- SHA512 ce4c35963d0a98405824f0490d78a862b9d35286b66d15899d6a8e16f4ca316d086876de7478e13713eb48eb345f3f57dfc07dca5b459675986b7b65182bbda5
- SSDEEP 12288:Mutrzh9xOXk7LDxecUXSdL5e24dZ+SDIzWqzbqhLOJIkp3z4OZaYBGl+iE:Mutr5OU7LD83S55wuSDiGSJIo3cyBG0H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\bpk.exe
- Size 428KB
- SHA256 869baf78bc757f7a0bcf8608e363f6ed5e441ba5a59a03b5d03a0c85f6ffc079
- MD5 0a891898eac14c2aa9a48ab91490d68e
- SHA1 a49509969cbcfc335d9d2be918647f8b2c0799cb
- SHA512 baba73ab0566125bfbabb8c64123de72afb65f02ff3934b781612dd8a0ffe3c7eae4d2970667dbd944556bc92fa2ac14e36c92ae2aefc0eaca52c30609908996
- SSDEEP 6144:697QWj+Yl3D++C+YejUpUsoDzBqDt1usKfbziqpcrIf1rfo14BZN0td22CfAt8n:65BQysoDzBqcfbGqt1jRK22Ht8n
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\bpkhk.dll
- Size 24KB
- SHA256 47cc307947b09c158696afe0c5dec2e4b261fa8daa8aa42b8c85414853e8b57f
- MD5 2f8c71470cecca08811c2176327b96b0
- SHA1 b9c814596906808e929fee64068b8bd5868e8345
- SHA512 7e7d175ebc42c7cdd29b1c04a08884ccf3a244ebfb02add43fec45d0177546832535b28c43f08ccabcb1960f9b23141a0971a77c10b6c684e77cec26e36c6c2d
- SSDEEP 192:nwOVrsNrCHWAIeKSrpziMF58Xh7KCuW78hmyX:nwXgieKEz/5Kh7Z978hmY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\bpkwb.dll
- Size 40KB
- SHA256 e1ff8e132ef73b54d4a0f7097873299fd917cdee3429f82026c84695e70e2f95
- MD5 b1c29e8a2a14db756b5d57ffae702e84
- SHA1 bb80f638f5d35e0c5d608981c47b57ddf34f47ef
- SHA512 16e33dc454a53e7f71bb9da6abc32d5a6c6ea21b6a02f3fe62b4e34a7a304e9f2f4673a2e4a6b810a6a0672d24dc71ceaa24a82e7ab725cfc9210d244bb1fa32
- SSDEEP 384:Uu2G6WdzRS8n3M9JpPFsTF0lDqBhAy+f2kjeWdnQUqVr8b6twhL0UlardPN/spLL:Uu84SqWvPFXDqHADfRw8b6MwbbspxR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\inst.dat
- Size 996B
- SHA256 636ac77e2f4403b6ea07f9c4e13e4346e9615c69374e4435f1b74fd0a65d0515
- MD5 732cc5f54466282edfe6cecd8c675a02
- SHA1 db203726cf309ba3107659358a94a78cc1cb754c
- SHA512 d4e610c44148b63d6690c49548b91b15851aa2998a7ea8021b3e773192563d648b72103301f9efa50c55b04e7813cec090a77c7070e2fda178101132ad109bd4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\pk.bin
- Size 4KB
- SHA256 c4ba8594ad72a82dd18e8cbd2c6dfc76f590c0071428d95b1fc9a18cb387b7eb
- MD5 aadb29c5e658b3b75bfee07971c28e53
- SHA1 0822574ac82c5a632d854343cb878799555f7672
- SHA512 2d4fd67e29437a9a8f3abc667cdf9ac615fd1875e3c0b01bd09e4b83ce361eefbc9f24c7a0985833ecee0767b721bf33ea303ecf76619806a7c0ae5988b7a279
- SSDEEP 6:rf+NefbYoSNNaN8NQQbYb+EW28qbMJekJechbjS9zM+Yoem/osHAgSXf:rf+N2YLaO2+EW28gMwkJechbjozDksc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe
- Size 7KB
- SHA256 6bba0b8d8bf03ba15828c53e72d83d766e44b3238b55ab75348d8ce93bfd0056
- MD5 a455ca431e66975d886f1a8cfee8cb9f
- SHA1 95868529973c77199b76ec593a686d9b324dee8b
- SHA512 53e0c4edf9d91ebdea04bfb343c568190eaaeb066bc6742262f1e5943d2b27c375e1eca483419ae8753138dc2131c9d3c7742812c16863689c3bb266057c0531
- SSDEEP 192:9B22Blo4VgSAP1oyn5g1to5R8FPSmdvkEhew:z/lo6gS21Dg1tYR8FP1CE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\GIFviewer.ocx
- Size 100KB
- SHA256 2123cadad9f7da81601c5e09105a569fedda561b4b12e87f0c0f6b4afa286e5c
- MD5 73404435b36b8cb9ea68be6d4249488e
- SHA1 ecd6f0e28c4f4ac6c1943a7647f42a5d91c14f02
- SHA512 e260099024bdc4711ef068455e350cb400042f5fd5066b07b024e49b8a13b6c058347f2e4e68ff73704358b51db851e4e06c28cb2f3cd36b64d9023c748dcad7
- SSDEEP 1536:A59RXop5dMIWdR+IGIcMOhZ+fBvsHIXZpON6pkfSeKI8C4k17RSa6340MZhrFqTQ:AHYoqKBUOQgreDn5iuR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\maincit.exe
- Size 416KB
- SHA256 040b98e976860c22feec7e8547bbca4599ce6f995489e69cf5630aaa5511f6d6
- MD5 716fbb0215215fcb3d6cdbf62423ec57
- SHA1 7e57f6b3268daaf04ba9b8270ee954733cf0eb85
- SHA512 eb3c2f70ac74386596b346d0fb4081e68e37c0aaa90e1c08c7b9239fd62d67947cc84b0c9006d4d727ab7240acfe8c2a45a535807a7e759ff367c046f572ac2e
- SSDEEP 6144:/5FBfH1bMOwU7WlnRLBLM2ltQbfad9NJCXNRFB6vBvgTfiaZ+HFjGnP3sMLUzs:JftPZ7mYCL9PMUvcjwSP3sAUzs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\bpk.exe
- Size 428KB
- SHA256 b966953b0a0e0bf648b1043b4e708445b52b020a0485921138bbf3be58d9995d
- MD5 bae0fb25bcf05a5da7fde8dce759ee0d
- SHA1 bc74b07d14a63ce572755c70ceb796136d129e20
- SHA512 74a61f7712df39194b2cb77186231d5960b8bfc5b37abdf20c357471a4e8dd8a8e648161cda7b1c8ee01d422926e3b30fd5ec9c6ebbf589a4feeaeba99ca2929
- SSDEEP 6144:9R1nwbWmZgZH1TTnXyCrze0O3+sv33Dyoo+ZbdYnvy367RtG95d6O4E6Iwq3L:t+WbZH1TLyCrlS+s/3to+YnvAERtGnd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\bpkhk.dll
- Size 24KB
- SHA256 525414ffe5f797ebdd7de5620b75ff723de17bf8f399ffcd7ddec2d0b8a5dc4a
- MD5 58129986fa29f6dacd99ab45f60bcb3c
- SHA1 7f21995794a060fc8629e0d113cf568de14c509e
- SHA512 62ade2d2eb41cd99dcd9f6d66e7966d129be20551faadcf827558e85d669f885ad144d10a87c3be7faed08103b86ab523fb6756b44f9e0ba77cdff586214701a
- SSDEEP 96:gb5+7aBt50ViCs602aK/2z5gPInuoxLKNhpUTzEvkulDOqKdtr5jposUGEEq6OD2:o50abCVZ0HtKI/k1Ucvkutnilo8EE13
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\bpkwb.dll
- Size 40KB
- SHA256 62e2948c3e3857e8304a657b7e7da30cdcb6842f71bd4c678a1734ebbf17198e
- MD5 2e6016325548ab79e2d636640c6ec473
- SHA1 586e2b84d46ef00e26c1686033def28e8a9995a5
- SHA512 1dc89b9e15f5835dff3203e278f000df5c0d8d93cbef5059be3f1024ef1e16ae8087a4f8e1131b20b190942984e9dc6079dfe951a52de7f4d4ad7de8721a0e86
- SSDEEP 384:RQvSI66SKSh+wxcmtaby7aXE9v/dkTA00kwmL+qG6HlH9AIvyyryQGwHEH:RQvSIzxSpjtja+xtnmL+q/lHaErVvk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\pk.bin
- Size 4KB
- SHA256 d1f0b8d3bbe246709c1cd3fd7c0daadfb2258e56f123d7b09fb17eb40534c296
- MD5 e226c803bcf28b951504aec921aaa386
- SHA1 864573c800bc322e659fd8b5509d1e78b188abf2
- SHA512 6cacb96ccd7d3035283839adef9e967bfd5d421bfbc74bf0b5bd45827bb4e37d868bd8e7c057449a3a8a66af367ab1c7d4107d071f70f3a4cd6da150b9ebd7ed
- SSDEEP 6:+Y/tihHKPZviY/2xFgsO/G1MAekq/u/l+IFJ3AMOuMn1GMcsxMKYfcOg9PB1LUD3:/iBKP1iBFgplcJwMTQGMcsxMB6nk3
- MD5 SHA1 SHA512 SSDEEP