Overview
overview
7Static
static
712bcdb449b...18.exe
windows7-x64
712bcdb449b...18.exe
windows10-2004-x64
7$INSTDIR"/...ll.exe
windows7-x64
7$INSTDIR"/...ll.exe
windows10-2004-x64
7$INSTDIR"/...er.exe
windows7-x64
1$INSTDIR"/...er.exe
windows10-2004-x64
1$INSTDIR"/...us.dll
windows7-x64
3$INSTDIR"/...us.dll
windows10-2004-x64
3$INSTDIR"/...sU.exe
windows7-x64
1$INSTDIR"/...sU.exe
windows10-2004-x64
1$INSTDIR"/...XU.dll
windows7-x64
1$INSTDIR"/...XU.dll
windows10-2004-x64
1$INSTDIR"/...er.exe
windows7-x64
1$INSTDIR"/...er.exe
windows10-2004-x64
1$INSTDIR"/...er.exe
windows7-x64
1$INSTDIR"/...er.exe
windows10-2004-x64
1$INSTDIR"/...er.dll
windows7-x64
1$INSTDIR"/...er.dll
windows10-2004-x64
1$INSTDIR"/...MC.dll
windows7-x64
1$INSTDIR"/...MC.dll
windows10-2004-x64
1$INSTDIR"/...il.exe
windows7-x64
3$INSTDIR"/...il.exe
windows10-2004-x64
3$INSTDIR"/...nc.dll
windows7-x64
7$INSTDIR"/...nc.dll
windows10-2004-x64
7$INSTDIR"/...l2.dll
windows7-x64
3$INSTDIR"/...l2.dll
windows10-2004-x64
3$INSTDIR"/...ad.exe
windows7-x64
1$INSTDIR"/...ad.exe
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analysis
-
max time kernel
134s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 12:28
Behavioral task
behavioral1
Sample
12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
$INSTDIR"/OpalViewerUninstall.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$INSTDIR"/OpalViewerUninstall.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
$INSTDIR"/bin/"/$OUTDIR/OpalPreFetchListener.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$INSTDIR"/bin/"/$OUTDIR/OpalPreFetchListener.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral7
Sample
$INSTDIR"/bin/"/GdiPlus.dll
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
$INSTDIR"/bin/"/GdiPlus.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral9
Sample
$INSTDIR"/bin/"/NMSAccessU.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$INSTDIR"/bin/"/NMSAccessU.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral11
Sample
$INSTDIR"/bin/"/NMSDVDXU.dll
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
$INSTDIR"/bin/"/NMSDVDXU.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral13
Sample
$INSTDIR"/bin/"/OpalPreFetchListener.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$INSTDIR"/bin/"/OpalPreFetchListener.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral15
Sample
$INSTDIR"/bin/"/OpalViewer.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$INSTDIR"/bin/"/OpalViewer.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral17
Sample
$INSTDIR"/bin/"/OpalWebKicker.dll
Resource
win7-20240215-en
Behavioral task
behavioral18
Sample
$INSTDIR"/bin/"/OpalWebKicker.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral19
Sample
$INSTDIR"/bin/"/VizMMC.dll
Resource
win7-20240220-en
Behavioral task
behavioral20
Sample
$INSTDIR"/bin/"/VizMMC.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
$INSTDIR"/bin/"/WinTail.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
$INSTDIR"/bin/"/WinTail.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral23
Sample
$INSTDIR"/bin/"/lame_enc.dll
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
$INSTDIR"/bin/"/lame_enc.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
$INSTDIR"/bin/"/libxml2.dll
Resource
win7-20240215-en
Behavioral task
behavioral26
Sample
$INSTDIR"/bin/"/libxml2.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral27
Sample
$INSTDIR"/bin/"/win32pad.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
$INSTDIR"/bin/"/win32pad.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
General
-
Target
12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe
-
Size
5.5MB
-
MD5
12bcdb449b0071b8451c4887a87efef9
-
SHA1
34f179932ac93e0bf92c2fd8cd9fd44d479742fe
-
SHA256
7d93356ce79e5c931bc2951c4284d42fc9210c8e130ffec7833463f3d7aaaa75
-
SHA512
7be9f14b0535f8b43789136349d6725af474b5ab3820f74928a4ec2bcdd6df4747b8644937908a1a87c7d8e7d88db88505a6954861705077ab2bebdbf8ccc0a8
-
SSDEEP
98304:l7vDN1vO9D5WE8YvH/UoGPiYaq1g5ox28qHIHic0SKVdIcVOteMO9hLQPZFTXjOF:l7bsfP/FGPEox25Hcwgc8eR9qtOFjeGb
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
pid Process 1416 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe 1416 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe 1416 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe 1416 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe 1416 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe 1416 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe 1416 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D01C3F2-EEFB-4135-AD73-AD8411D40409}\ProxyStubClsid32 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NMSDVDX.DataItemX\ = "DataItemX Class" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C3BC4176-C611-42C8-8562-A64632C90A4A}\ProgID\ = "NMSDVDX.VolumeInfoX.1" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{62B0C595-47DB-4E86-A690-E30A0E1DCAB7}\ = "IWriteErrorX" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NMSDVDX.FileLayoutX.1\CLSID 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51496FEE-8200-4B10-B57C-EB5D64DB28A0}\InprocServer32 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Opal.DicomFile 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8EC37881-8729-42FB-8763-4C2F7398187F} 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{016609A9-951A-4906-BEFD-2F4B67FB0E3E} 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{016609A9-951A-4906-BEFD-2F4B67FB0E3E}\TypeLib 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NMSDVDX.MSFX.1 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NMSDVDX.FileLayoutX\CurVer\ = "NMSDVDX.FileLayoutX.1" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D01C3F2-EEFB-4135-AD73-AD8411D40409}\TypeLib\ = "{AE827ABA-9A56-40FF-8F45-B7DE58CD9BDB}" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBF668FE-9A21-44DA-B19C-DA4641BA8A17}\InprocServer32 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DBF668FE-9A21-44DA-B19C-DA4641BA8A17}\InprocServer32\ = "C:\\opal\\bin\\NMSDVDXU.dll" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{022A4344-7686-42AA-AF45-CB7808EA18C6}\VersionIndependentProgID\ = "NMSDVDX.FileErrorX" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\WOW6432Node\Interface 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DC24F973-DF48-4149-AAD3-E82A32650EFA}\ = "IAudioVideoCBX" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2FBBB5F-6FF7-4F6B-93A3-7EDB509AA938}\Insertable 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2CF7A4D-056A-48FD-80C4-3F269335188A} 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{753A15E2-A722-4939-9183-9E0BA897D354}\Programmable 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2FBBB5F-6FF7-4F6B-93A3-7EDB509AA938}\Control 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D9AC115-02B1-4B91-A5A9-DC5430C38DC6} 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C3BC4176-C611-42C8-8562-A64632C90A4A}\Programmable 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B0190ECA-A831-44BD-9B2E-74000ECA96E2} 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NMSDVDX.ExtentX\CurVer 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A232E886-AAA6-4471-98E3-520E09F80D95}\ = "IDataItemX" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{52D77484-D134-442C-9024-7C26A31A9E59}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B2E795E-C849-46DC-B321-07E6B7EB975C}\ = "IDiscInfoX" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NMSDVDX.DiscInfoX 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{59480498-3171-48AE-A3C4-F8B050FFA921} 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A5A6560-9B11-4980-943B-5332A91FC11A}\TypeLib\Version = "1.0" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NMSDVDX.MSFX\CLSID 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DF00A585-3C3D-4F49-8984-DE58E69AFD80}\TypeLib\ = "{2D5F3E01-DBBD-4FD6-9566-07ABFAF36163}" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OpalWebKicker\CurVer 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FD65921-DFB2-4D17-9E84-0C1752E03CF2}\InprocServer32\ThreadingModel = "Apartment" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1BAC4A11-58CB-483C-A8AF-B26F5E3B5DE1}\VersionIndependentProgID 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DC24F973-DF48-4149-AAD3-E82A32650EFA}\TypeLib\ = "{AE827ABA-9A56-40FF-8F45-B7DE58CD9BDB}" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D0EC0FE-60AF-471C-AFD1-1D7FC72E39DF}\ProxyStubClsid32 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8EC37881-8729-42FB-8763-4C2F7398187F}\InProcServer32\ThreadingModel = "Both" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NMSDVDX.SessionInfoX.1 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{62B0C595-47DB-4E86-A690-E30A0E1DCAB7}\TypeLib\ = "{AE827ABA-9A56-40FF-8F45-B7DE58CD9BDB}" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{016609A9-951A-4906-BEFD-2F4B67FB0E3E}\InprocServer32\ThreadingModel = "Apartment" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51496FEE-8200-4B10-B57C-EB5D64DB28A0}\ = "AudioCDImageX Class" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{639520A1-3657-493E-8326-C88A8E90B4A9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FD65921-DFB2-4D17-9E84-0C1752E03CF2}\InprocServer32 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C3BC4176-C611-42C8-8562-A64632C90A4A}\TypeLib\ = "{AE827ABA-9A56-40FF-8F45-B7DE58CD9BDB}" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9C68273E-A742-44CB-B3AC-C347D614ADD8}\TypeLib 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NMSDVDX.DataItemX\CLSID\ = "{14725AC8-AAAB-48E5-914E-26BE824FEBE9}" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9C68273E-A742-44CB-B3AC-C347D614ADD8}\TypeLib\Version = "1.0" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2FBBB5F-6FF7-4F6B-93A3-7EDB509AA938}\Version 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{075DE13F-7A89-4C76-8911-5C5D1D0B0C30}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8EC37881-8729-42FB-8763-4C2F7398187F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NMSDVDX.FileLayoutX\CLSID 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NMSDVDX.AudioCDImageX.1\CLSID\ = "{51496FEE-8200-4B10-B57C-EB5D64DB28A0}" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2D5F3E01-DBBD-4FD6-9566-07ABFAF36163}\1.0\FLAGS 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{940C9B9C-1948-44F5-8A3E-275BF892E60C}\ProgID 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AE827ABA-9A56-40FF-8F45-B7DE58CD9BDB}\1.0\FLAGS 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NMSDVDX.SessionInfoX.1\CLSID 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NMSDVDX.DVDEngineX.1 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2FBBB5F-6FF7-4F6B-93A3-7EDB509AA938}\VersionIndependentProgID 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NMSDVDX.FileLayoutX.1\CLSID\ = "{65472655-C70C-4393-9470-BBD37A1A6F7B}" 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A3FF0FE7-E5B9-410B-9AF0-6927794CE654} 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2D5F3E01-DBBD-4FD6-9566-07ABFAF36163}\1.0\0\win32 12bcdb449b0071b8451c4887a87efef9_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
1.2MB
MD58f2e118719c0a8329ef00b58bb256483
SHA1a9b426f52a7f931e2a268e28b25d93249ac515ee
SHA2565fdbd14f8b88d21b58a138433c035031fb6a8c6be756b828dc126fce426dee70
SHA5129ebe4c54556ab09f7fb7792f35ceb7459b7c306c08f3806bc28f7345020eac44f0a88ad9fab631bed5523112eddeb28d3cca03734ede4443cde4660b35f05007
-
Filesize
552KB
MD5a4bde4b2b0c5423a05fc497057a64fbb
SHA13f0d2862c31fe4fc018cb48ca202e87e6b15046f
SHA256d4d980aa2ffcdb68a9984f31fa49f64bd491476a39d1169b0a5efe153a4f7f4a
SHA51253b68a903ef916ccfa39e39b32cfba4da914879e6fea6946ced74e0320b475d5798dd297991bca1af71e63074d5611ef64c6f2e5bbb0d0de89b2f81188bd6c29
-
Filesize
1.1MB
MD59e27fa1bbb7bf9a826d9092c69e79e4b
SHA178a0f434aec0e14e4654dce1fd7515ac22a9daaa
SHA256b5fd602a3f7228fc2978e00dc7c50869f9bde6c351391894a299c186301454c8
SHA512c29acfbe00e416667880d0d2c37ff1ad75f27dbb209129a9bc451c5c7df409c597c38fa26245b57b7e46f4dc39315e4647313c6762f45462cc258a12aa4ee165