c224e360d8e38d5ecefa4030b6811aa6bb0e686695a1050a08973f439eb79adb

Analysis

max time kernel
134s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04-05-2024 19:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4fa04b1648d214db5f0afaafc37de686_JaffaCakes118.exe
Size

96KB
MD5

4fa04b1648d214db5f0afaafc37de686
SHA1

e8b5beeb43f2318b0fd2dad9d62a9fef356ed90b
SHA256

c224e360d8e38d5ecefa4030b6811aa6bb0e686695a1050a08973f439eb79adb
SHA512

cfadecb672f35cb50390f8fa7e8811085498be63cb8635cbbc81bb412ae4b0f937baaae243f3af125e3f6d0220f0d16a5dfeebf38fa6383cce9499d4dcf9b0fb
SSDEEP

1536:Ek5iHMA3Lti0nm5C959zma1uQdEu2daiRQ+tR5R45WtqV9R2R462izMg3R7ih9:EMiHMA7jms9/maoxaie+tHrtG9MW3+3W

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkgdml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lddbqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lcgblncm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkpgck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mkpgck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqfbaq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndidbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laalifad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nklfoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnjjdgee.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnlfigcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nqfbaq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgneampk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Laciofpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgpagm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lkgdml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Liggbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Liggbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lpappc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lnjjdgee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mglack32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lpcmec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mciobn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mamleegg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Laalifad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpdelajl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njacpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpappc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lknjmkdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mamleegg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lddbqa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mciobn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mnocof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mnlfigcc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lgpagm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpmokb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ngedij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	4fa04b1648d214db5f0afaafc37de686_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	4fa04b1648d214db5f0afaafc37de686_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lknjmkdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mglack32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ncgkcl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njacpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laciofpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njcpee32.exe

Executes dropped EXE 36 IoCs

pid	Process
3028	Liggbi32.exe
4756	Lpappc32.exe
3752	Lkgdml32.exe
864	Laalifad.exe
1088	Lpcmec32.exe
4032	Lgneampk.exe
5048	Laciofpa.exe
1488	Lgpagm32.exe
1968	Lnjjdgee.exe
1636	Lddbqa32.exe
1908	Lcgblncm.exe
2620	Lknjmkdo.exe
2576	Mnlfigcc.exe
2856	Mciobn32.exe
1792	Mkpgck32.exe
2684	Mnocof32.exe
1960	Mpmokb32.exe
4928	Mkbchk32.exe
2384	Mamleegg.exe
536	Mgidml32.exe
4832	Mpaifalo.exe
1816	Mcpebmkb.exe
2068	Mglack32.exe
2400	Mpdelajl.exe
4556	Mgnnhk32.exe
4680	Nnhfee32.exe
3252	Nqfbaq32.exe
4576	Nklfoi32.exe
1452	Nafokcol.exe
4484	Ncgkcl32.exe
4308	Njacpf32.exe
3288	Nqklmpdd.exe
836	Ngedij32.exe
3716	Njcpee32.exe
3300	Ndidbn32.exe
4600	Nkcmohbg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Liggbi32.exe	4fa04b1648d214db5f0afaafc37de686_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Ogndib32.dll	Liggbi32.exe
File created	C:\Windows\SysWOW64\Mkpgck32.exe	Mciobn32.exe
File created	C:\Windows\SysWOW64\Mpmokb32.exe	Mnocof32.exe
File opened for modification	C:\Windows\SysWOW64\Mpaifalo.exe	Mgidml32.exe
File created	C:\Windows\SysWOW64\Hlmobp32.dll	Mgnnhk32.exe
File created	C:\Windows\SysWOW64\Npckna32.dll	Nnhfee32.exe
File opened for modification	C:\Windows\SysWOW64\Laciofpa.exe	Lgneampk.exe
File opened for modification	C:\Windows\SysWOW64\Lgneampk.exe	Lpcmec32.exe
File created	C:\Windows\SysWOW64\Bidjkmlh.dll	Lknjmkdo.exe
File opened for modification	C:\Windows\SysWOW64\Nnhfee32.exe	Mgnnhk32.exe
File created	C:\Windows\SysWOW64\Lgneampk.exe	Lpcmec32.exe
File created	C:\Windows\SysWOW64\Hbocda32.dll	Lpcmec32.exe
File created	C:\Windows\SysWOW64\Jfbhfihj.dll	Mciobn32.exe
File created	C:\Windows\SysWOW64\Mamleegg.exe	Mkbchk32.exe
File created	C:\Windows\SysWOW64\Mgnnhk32.exe	Mpdelajl.exe
File created	C:\Windows\SysWOW64\Nqklmpdd.exe	Njacpf32.exe
File created	C:\Windows\SysWOW64\Dngdgf32.dll	Lpappc32.exe
File created	C:\Windows\SysWOW64\Mnlfigcc.exe	Lknjmkdo.exe
File created	C:\Windows\SysWOW64\Gqffnmfa.dll	Mpmokb32.exe
File created	C:\Windows\SysWOW64\Opbnic32.dll	Njcpee32.exe
File opened for modification	C:\Windows\SysWOW64\Laalifad.exe	Lkgdml32.exe
File opened for modification	C:\Windows\SysWOW64\Lddbqa32.exe	Lnjjdgee.exe
File created	C:\Windows\SysWOW64\Njcpee32.exe	Ngedij32.exe
File created	C:\Windows\SysWOW64\Baefid32.dll	Laalifad.exe
File created	C:\Windows\SysWOW64\Plilol32.dll	Lddbqa32.exe
File created	C:\Windows\SysWOW64\Hnfmbf32.dll	Mpdelajl.exe
File created	C:\Windows\SysWOW64\Fibjjh32.dll	Nqfbaq32.exe
File opened for modification	C:\Windows\SysWOW64\Nafokcol.exe	Nklfoi32.exe
File opened for modification	C:\Windows\SysWOW64\Ndidbn32.exe	Njcpee32.exe
File created	C:\Windows\SysWOW64\Gcgqhjop.dll	4fa04b1648d214db5f0afaafc37de686_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Fldggfbc.dll	Lgpagm32.exe
File opened for modification	C:\Windows\SysWOW64\Ncgkcl32.exe	Nafokcol.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Ndidbn32.exe
File created	C:\Windows\SysWOW64\Laalifad.exe	Lkgdml32.exe
File opened for modification	C:\Windows\SysWOW64\Mkpgck32.exe	Mciobn32.exe
File created	C:\Windows\SysWOW64\Jgengpmj.dll	Mkbchk32.exe
File opened for modification	C:\Windows\SysWOW64\Mglack32.exe	Mcpebmkb.exe
File created	C:\Windows\SysWOW64\Gbbkdl32.dll	Mglack32.exe
File opened for modification	C:\Windows\SysWOW64\Ngedij32.exe	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Mdemcacc.dll	Lkgdml32.exe
File created	C:\Windows\SysWOW64\Khehmdgi.dll	Lgneampk.exe
File opened for modification	C:\Windows\SysWOW64\Mnlfigcc.exe	Lknjmkdo.exe
File created	C:\Windows\SysWOW64\Mpdelajl.exe	Mglack32.exe
File opened for modification	C:\Windows\SysWOW64\Lpappc32.exe	Liggbi32.exe
File created	C:\Windows\SysWOW64\Lkgdml32.exe	Lpappc32.exe
File created	C:\Windows\SysWOW64\Lnjjdgee.exe	Lgpagm32.exe
File created	C:\Windows\SysWOW64\Mpaifalo.exe	Mgidml32.exe
File created	C:\Windows\SysWOW64\Nqfbaq32.exe	Nnhfee32.exe
File created	C:\Windows\SysWOW64\Ddpfgd32.dll	Ngedij32.exe
File opened for modification	C:\Windows\SysWOW64\Lcgblncm.exe	Lddbqa32.exe
File created	C:\Windows\SysWOW64\Nnhfee32.exe	Mgnnhk32.exe
File created	C:\Windows\SysWOW64\Pipfna32.dll	Nafokcol.exe
File opened for modification	C:\Windows\SysWOW64\Njcpee32.exe	Ngedij32.exe
File created	C:\Windows\SysWOW64\Lpappc32.exe	Liggbi32.exe
File created	C:\Windows\SysWOW64\Laciofpa.exe	Lgneampk.exe
File opened for modification	C:\Windows\SysWOW64\Mkbchk32.exe	Mpmokb32.exe
File created	C:\Windows\SysWOW64\Oaehlf32.dll	Mcpebmkb.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Ndidbn32.exe
File created	C:\Windows\SysWOW64\Jpgeph32.dll	Lnjjdgee.exe
File opened for modification	C:\Windows\SysWOW64\Lknjmkdo.exe	Lcgblncm.exe
File opened for modification	C:\Windows\SysWOW64\Mgidml32.exe	Mamleegg.exe
File opened for modification	C:\Windows\SysWOW64\Mgnnhk32.exe	Mpdelajl.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Ndidbn32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2336	4600	WerFault.exe	121

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpgeph32.dll"	Lnjjdgee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddpfgd32.dll"	Ngedij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfbhfihj.dll"	Mciobn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnacjn32.dll"	Mamleegg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nklfoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lpcmec32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lgneampk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ncgkcl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	4fa04b1648d214db5f0afaafc37de686_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Baefid32.dll"	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gqffnmfa.dll"	Mpmokb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	4fa04b1648d214db5f0afaafc37de686_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgengpmj.dll"	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pipfna32.dll"	Nafokcol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lgpagm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnfmbf32.dll"	Mpdelajl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paadnmaq.dll"	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lcgblncm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ndidbn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lpappc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lkgdml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mgidml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lddbqa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mnocof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Liggbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Laciofpa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mkpgck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mnlfigcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nqfbaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lpappc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdemcacc.dll"	Lkgdml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lgneampk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dngdgf32.dll"	Lpappc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lgpagm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mciobn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opbnic32.dll"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oaehlf32.dll"	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mglack32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlmobp32.dll"	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnelfilp.dll"	Mgidml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nklfoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Liggbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lkgdml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mamleegg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	4fa04b1648d214db5f0afaafc37de686_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mciobn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbbkdl32.dll"	Mglack32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mglack32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	4fa04b1648d214db5f0afaafc37de686_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mpaifalo.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 3028	4860	4fa04b1648d214db5f0afaafc37de686_JaffaCakes118.exe	83
PID 4860 wrote to memory of 3028	4860	4fa04b1648d214db5f0afaafc37de686_JaffaCakes118.exe	83
PID 4860 wrote to memory of 3028	4860	4fa04b1648d214db5f0afaafc37de686_JaffaCakes118.exe	83
PID 3028 wrote to memory of 4756	3028	Liggbi32.exe	84
PID 3028 wrote to memory of 4756	3028	Liggbi32.exe	84
PID 3028 wrote to memory of 4756	3028	Liggbi32.exe	84
PID 4756 wrote to memory of 3752	4756	Lpappc32.exe	85
PID 4756 wrote to memory of 3752	4756	Lpappc32.exe	85
PID 4756 wrote to memory of 3752	4756	Lpappc32.exe	85
PID 3752 wrote to memory of 864	3752	Lkgdml32.exe	86
PID 3752 wrote to memory of 864	3752	Lkgdml32.exe	86
PID 3752 wrote to memory of 864	3752	Lkgdml32.exe	86
PID 864 wrote to memory of 1088	864	Laalifad.exe	87
PID 864 wrote to memory of 1088	864	Laalifad.exe	87
PID 864 wrote to memory of 1088	864	Laalifad.exe	87
PID 1088 wrote to memory of 4032	1088	Lpcmec32.exe	88
PID 1088 wrote to memory of 4032	1088	Lpcmec32.exe	88
PID 1088 wrote to memory of 4032	1088	Lpcmec32.exe	88
PID 4032 wrote to memory of 5048	4032	Lgneampk.exe	89
PID 4032 wrote to memory of 5048	4032	Lgneampk.exe	89
PID 4032 wrote to memory of 5048	4032	Lgneampk.exe	89
PID 5048 wrote to memory of 1488	5048	Laciofpa.exe	91
PID 5048 wrote to memory of 1488	5048	Laciofpa.exe	91
PID 5048 wrote to memory of 1488	5048	Laciofpa.exe	91
PID 1488 wrote to memory of 1968	1488	Lgpagm32.exe	92
PID 1488 wrote to memory of 1968	1488	Lgpagm32.exe	92
PID 1488 wrote to memory of 1968	1488	Lgpagm32.exe	92
PID 1968 wrote to memory of 1636	1968	Lnjjdgee.exe	93
PID 1968 wrote to memory of 1636	1968	Lnjjdgee.exe	93
PID 1968 wrote to memory of 1636	1968	Lnjjdgee.exe	93
PID 1636 wrote to memory of 1908	1636	Lddbqa32.exe	94
PID 1636 wrote to memory of 1908	1636	Lddbqa32.exe	94
PID 1636 wrote to memory of 1908	1636	Lddbqa32.exe	94
PID 1908 wrote to memory of 2620	1908	Lcgblncm.exe	95
PID 1908 wrote to memory of 2620	1908	Lcgblncm.exe	95
PID 1908 wrote to memory of 2620	1908	Lcgblncm.exe	95
PID 2620 wrote to memory of 2576	2620	Lknjmkdo.exe	97
PID 2620 wrote to memory of 2576	2620	Lknjmkdo.exe	97
PID 2620 wrote to memory of 2576	2620	Lknjmkdo.exe	97
PID 2576 wrote to memory of 2856	2576	Mnlfigcc.exe	98
PID 2576 wrote to memory of 2856	2576	Mnlfigcc.exe	98
PID 2576 wrote to memory of 2856	2576	Mnlfigcc.exe	98
PID 2856 wrote to memory of 1792	2856	Mciobn32.exe	99
PID 2856 wrote to memory of 1792	2856	Mciobn32.exe	99
PID 2856 wrote to memory of 1792	2856	Mciobn32.exe	99
PID 1792 wrote to memory of 2684	1792	Mkpgck32.exe	100
PID 1792 wrote to memory of 2684	1792	Mkpgck32.exe	100
PID 1792 wrote to memory of 2684	1792	Mkpgck32.exe	100
PID 2684 wrote to memory of 1960	2684	Mnocof32.exe	101
PID 2684 wrote to memory of 1960	2684	Mnocof32.exe	101
PID 2684 wrote to memory of 1960	2684	Mnocof32.exe	101
PID 1960 wrote to memory of 4928	1960	Mpmokb32.exe	102
PID 1960 wrote to memory of 4928	1960	Mpmokb32.exe	102
PID 1960 wrote to memory of 4928	1960	Mpmokb32.exe	102
PID 4928 wrote to memory of 2384	4928	Mkbchk32.exe	103
PID 4928 wrote to memory of 2384	4928	Mkbchk32.exe	103
PID 4928 wrote to memory of 2384	4928	Mkbchk32.exe	103
PID 2384 wrote to memory of 536	2384	Mamleegg.exe	104
PID 2384 wrote to memory of 536	2384	Mamleegg.exe	104
PID 2384 wrote to memory of 536	2384	Mamleegg.exe	104
PID 536 wrote to memory of 4832	536	Mgidml32.exe	105
PID 536 wrote to memory of 4832	536	Mgidml32.exe	105
PID 536 wrote to memory of 4832	536	Mgidml32.exe	105
PID 4832 wrote to memory of 1816	4832	Mpaifalo.exe	107

C:\Users\Admin\AppData\Local\Temp\4fa04b1648d214db5f0afaafc37de686_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4fa04b1648d214db5f0afaafc37de686_JaffaCakes118.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\SysWOW64\Liggbi32.exe
  C:\Windows\system32\Liggbi32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\SysWOW64\Lpappc32.exe
    C:\Windows\system32\Lpappc32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4756
  - - C:\Windows\SysWOW64\Lkgdml32.exe
      C:\Windows\system32\Lkgdml32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3752
    - - C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:864
      - C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1088
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4032
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5048
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1488
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1968
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1636
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1908
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2620
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2576
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2856
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2684
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1960
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4928
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2384
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:536
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4832
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1816
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2068
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2400
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4556
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4680
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3252
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4576
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1452
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4484
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4308
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3288
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:836
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3716
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3300
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        37⤵
        Executes dropped EXE
        
        PID:4600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 412
        38⤵
        Program crash
        
        PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4600 -ip 4600
1⤵
PID:5028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Baefid32.dll

Filesize
7KB

MD5
0437aca73d319ceb95a545bd921b47ad

SHA1
719a60b7f46e2793bd488785b8e415e10a6a5f08

SHA256
82f0e4ec989dfd82fa145321ebe5a2f5acfae24776d5591c44ff6384eca251b5

SHA512
5cecf81e5f7c529cf3d9968aab758bd478676e45983ed659394fb14800b815e85dcb799fd8f3dfce290ac85adf2e0fcbe6aca534f3c5e76aa6c2c2d0c835d819

Download Submit
C:\Windows\SysWOW64\Laalifad.exe

Filesize
96KB

MD5
6ea855537a34b81380a6af88b2f09375

SHA1
60e146ec7427a1bab134edb234ba65f4a158da09

SHA256
86c5693d79ebf4ce5807a05233728dd9bc7a7e123a5038c419d2be496ad44b70

SHA512
8dd2308128bb7ec8ae1d675ddf3345c4da7649c8b01eb29234bcf1bc13b315104bf36ab4e610aa1e126bdd5b046cf052bf3ab763be60463d8237878114756655

Download Submit
C:\Windows\SysWOW64\Laciofpa.exe

Filesize
96KB

MD5
bc4304a6ef0a6bc49834e1c94c0e56a6

SHA1
74015ab14bd99c179be89c1dd9031917888a103b

SHA256
5f2cac55bf2f6bf1b38fff55f9ccd9f908ab1576d0ded22802701ba125d408d4

SHA512
884bb1c6da131acc791d0924b42a1162b3db5041210c8b442d62d8ac8335124f01a759664ca674d6ad3916c44df6fdc710395112dd9923cfb700b14a787fbc62

Download Submit
C:\Windows\SysWOW64\Lcgblncm.exe

Filesize
96KB

MD5
0b02ac3bf53f7f5e472c4c3087388997

SHA1
c32a9097767583b9f573d65eb04407c0c6b3d7eb

SHA256
e18fcd454878edb5ba315ea626a11655eaea00f01b829c9d958419f89abe8b91

SHA512
508e52995ca573ec8bc3f59720ef9bb82f8ab207c344a8ea976b48def69df78c01e5285d74f020387577bde545f4136c3e6df26adce2facf7f8c1ab8cddde6b9

Download Submit
C:\Windows\SysWOW64\Lddbqa32.exe

Filesize
96KB

MD5
92b4bd42d423ae17951fc2e69ecd98af

SHA1
53728707519b53e430d2fe2d051d0ff49ef88209

SHA256
d22aadf50c26fd13619951f4e3a2a16acf5ac380e24bd842b58758bcd0a240d6

SHA512
62258bce8edce1091f293722044007cd2c25eee3dafec3e069f9791cba794b7af905c518d33020364119dde3e57246f0684bb19e9229d36bd20dcf5a096ae773

Download Submit
C:\Windows\SysWOW64\Lgneampk.exe

Filesize
96KB

MD5
6fe31854a0ed9632885be5da3eef55dd

SHA1
501588ee769828342b956ce6d7ebcf77eb4dbabe

SHA256
1687e7cb68ded818e1c3f2ceaabf37f2f37f72f9fb240da13c5500c9d63e160c

SHA512
e9036a1bbdcedb3f2d508628cab83e643fa196fbd24684a40a43b3909ff3757760db5f26e765c2c9dceb9dc6d1f248d07e84fd33025b0b9e8fab7aa9c728c008

Download Submit
C:\Windows\SysWOW64\Lgpagm32.exe

Filesize
96KB

MD5
3b91916bdc045ac1d3a7c6b85c977785

SHA1
f04c294b509511009c8586d1aa681f65531fac02

SHA256
2fb836a68c7a59271d42b5d0aef1876066520ad43bfa6889101cad2963cd55f7

SHA512
ac18db4d43e214756eb5174ba19aced24e0d5878cc8f5689fc469df63e8e5192097ad033ebdd132a3ff358efde4e36287e0017b41368e4836458d7520e4dbce8

Download Submit
C:\Windows\SysWOW64\Liggbi32.exe

Filesize
96KB

MD5
d10f516e7ac0966ee3c2b82aaed91d02

SHA1
5ce66f6c65c25f85b6afa8088b2f9c556a87b163

SHA256
d63dce82c3dbfc68b11f2bca035eb06f58376d0d6a285612c0140be2d5426344

SHA512
dc7009ec4ae5735064913bc537c31f27e75c2f724a534248cb1f6b1a4d31ce07e667527a75b51eea952405de90ed9ee17e760324708adb864142f40355638f31

Download Submit
C:\Windows\SysWOW64\Lkgdml32.exe

Filesize
96KB

MD5
87b4baa9f28f4bada7e31a8b51df7939

SHA1
7fb7ec94f81356b74473e984274e6c14815bb9fc

SHA256
86964ac86bf4357036432c39acf640074fbe49cf7da972bef5771f8f198dd9b0

SHA512
2e28ef28cbbadb5f1e55fa07b9e84c760124912ab36809db63d1a026e5f60e1e15abcdd139278a34a6e822a71a7170c25a9e2ce733b00ddc27cfc8d28841befc

Download Submit
C:\Windows\SysWOW64\Lknjmkdo.exe

Filesize
96KB

MD5
4ebdcca2adffb9333ea68f99d728d43b

SHA1
fbeffe28428b69055e8d2abd31120cb1c6851f99

SHA256
9c92209e0ef4bb5f26baa202f742799ff2117c42949bcd1e2765189e07cb3ff1

SHA512
dad9c4a43f1bb723a34d72eb0991bb2f6a6f74b34677c77889a3d6c8c88bc3a7935d690c730b083272db3d58ebaeb48610e26f77e6480b46a098a29e03cb6263

Download Submit
C:\Windows\SysWOW64\Lnjjdgee.exe

Filesize
96KB

MD5
be3b7c0485dfc7ca224e50d6630e228d

SHA1
88dc9b5371e75b1e00c3ca819fbca3690a3e1a4a

SHA256
ba81c725f31534449c651e5bb8693a312286344da605c5711e77106f2d2c2537

SHA512
504f91ffbb2e6d30640bc067763a4e4e8717b15dc4af62114ca4d1b8a1ff04bd10e6f03a9eaa86123ea04a3073f37c6a603a196f6333d35859d5329b2fd1774f

Download Submit
C:\Windows\SysWOW64\Lpappc32.exe

Filesize
96KB

MD5
a455e8fbef601f4d33383b3c80f8f5e8

SHA1
1d0afd9a55f381169a41e90efbacf54ca8188c2f

SHA256
b3590245dc15d18b47f8b42869bf1c59f2637e4a42fd268a48e9c06ed8434d89

SHA512
ba08d9606ec01e4d7e09f856da240a4aefc653817625e937738efbde0e76876a88e3fbee0c796cecfaf470943e0433787b3d4344daef8760e9b226298854bbb9

Download Submit
C:\Windows\SysWOW64\Lpcmec32.exe

Filesize
96KB

MD5
1b785d31026629d9743569e01adf51c1

SHA1
9b95fe1045983718da4bcba777ab30ec0085ca71

SHA256
d1c3a64207a63af99a7815883a13dc033dd99af5de83483ed8faaa7664d8612a

SHA512
2a419dcb3127f11fc71c8dc0c2046e7540200afc10ead02353061d83e7b18f1b6d528858a30a1f06f09a0d6cc3c68c8d1772cf87e6591140e7de895d82568e00

Download Submit
C:\Windows\SysWOW64\Mamleegg.exe

Filesize
96KB

MD5
0d3c886aed710e0cecb6317f714f55d3

SHA1
625180dcb3708d86f2fb2af5fda54ebe3f84d393

SHA256
8b356628c3475e037eeab753106fdbfe43cc00b11be8b76e12bc13ee8694ae2f

SHA512
16208a7a31c061525df51af49f0b6460f133314ecde0a852276e5f91946194065e210bd20b777c8d8eb918e16aa2ff396da4c8148cf2218ddf51e7412e11915e

Download Submit
C:\Windows\SysWOW64\Mciobn32.exe

Filesize
96KB

MD5
93d75d94a0efdf12ceee368526013ebe

SHA1
305e26e9c4ba274974659f05d67d9404f096800d

SHA256
7c0bb5ff31ed130f8016dfdb0286f543b08325260cf567cc37bc91572dfa2585

SHA512
6d9def2e80fd36ab8eba5bbbbafc0c1fa7eeb073e1d8cb6b952b0d608c2991436af32130b4f344fa3d0058f713bee3f4cedebf9fbe3bb87cef8bff39170bb411

Download Submit
C:\Windows\SysWOW64\Mcpebmkb.exe

Filesize
96KB

MD5
a7c8ec874913e454f615033ecc554d52

SHA1
cf2734015c626b930b8ec2b0d65613ce60211bf7

SHA256
4191a421826ec8dba3854ed5eb4dc0bbd7d335e2e5e170b8f354e68b1d6c7c6b

SHA512
68f08d12dbb23151bb206523ed96ef9b9e5a2b925b72c86fe6dbb511c06f038c2f467c6caf25912781c121efece4355208bae158848c6cfcb0d97e323a5febdc

Download Submit
C:\Windows\SysWOW64\Mgidml32.exe

Filesize
96KB

MD5
91fdc71f37f19f92be16c215fd05be6a

SHA1
05e1b48a3196fab657faca29703eca1237cb4b0b

SHA256
c79f263e036e8e1d8730f21596d327eb5239fe8e01c72d90b9c6f1df7f4c3cf8

SHA512
a05e50ce9362784de1c135e4636c4e057da508cf843a8773bbb3c4d58b3668e612396f1dac0b37623c7b3325ef1c97baf566a0228406c08f4dbe228ed2646d11

Download Submit
C:\Windows\SysWOW64\Mglack32.exe

Filesize
96KB

MD5
507fb6cd47c627ba80968aa70febe419

SHA1
0c1b6eb56fa741d28765371ccf0fab9ae24c3aa3

SHA256
199806677c9227e3dec25388b4e7b03c98a267006b50a5d42ab12c01dece3d87

SHA512
1b084d15d0318d495b47c01e631234243c3e2de3236609f2ce8be2e5eed7c1b47906887114925d8b511dfb7ce9ab24efb1d9351720863305bdd5ac3318c55cb0

Download Submit
C:\Windows\SysWOW64\Mgnnhk32.exe

Filesize
96KB

MD5
9956b1fce228435cbcee72a226dd776d

SHA1
ba91ced062d7dda0f4bff2e97662270a411e8a33

SHA256
21e1792d473ce61763e171e678850e576cda6f8c40d4c2fc9cc6215fd36d372b

SHA512
fc4c78e535ae83a98a655fd6b2d64f53804571393b0a91821ab63d790a9de805227d6a4ddcff7bb3c67fb14654a049a9f62d0483fce4e0b100fe0d10a8e32c28

Download Submit
C:\Windows\SysWOW64\Mkbchk32.exe

Filesize
96KB

MD5
49ad86212c5525c20321e21c82d6d4c1

SHA1
142d887d1d2205d8dc9f58a0d1ff8ddf48d34273

SHA256
57ed20305da9fe3f545243b8d954f7c538dd399589bf3c392fbd47364a70de26

SHA512
0275c970e71f86979d9fea84de5f84136a719bc4a565fbcf74e5bc7ef4dd5d1b37760a35f8df15e14a77d1df1ad14aea15f2cb6a0b05f0be1453efae0d9c4290

Download Submit
C:\Windows\SysWOW64\Mkpgck32.exe

Filesize
96KB

MD5
fb4e1870ec87aa5dcdef8d80df021821

SHA1
e1c612a686d9a112c5993c2a8079c7b9d8ab9937

SHA256
3efefecfd00a8fc1e56083f94493d6affdba9fdf29f6656c15e43fc46b60408e

SHA512
9306e89679265d346f1dcb37ef00cb342f40b377e3b273380c9c45160c1df1d3a31dcff08aaeff57257225ebc94b8c3c34e75d0dd26ae000b5cb5f2e3783d809

Download Submit
C:\Windows\SysWOW64\Mnlfigcc.exe

Filesize
96KB

MD5
1f3e263ff14a0b94ae2388ea55a5fe31

SHA1
a082900cf798fd19ffeff33c2e2060fcf086dd0a

SHA256
e519e18dd7f24b6ac1fbe146ce314d6788c25b1c09f4d77ff47ae9f6c3504561

SHA512
15e42abaced1119bf7972157a5ceb8daf31b09ba5e4ef36ab76478efec9c86e5a205f2e1512eaefe227581dee8714a921aa036572a2d5dcc78343cdddaf17113

Download Submit
C:\Windows\SysWOW64\Mnocof32.exe

Filesize
96KB

MD5
5dc50e0099a836663f044aed0f387f90

SHA1
f533a6824c3674480298daf0215de88d0706a753

SHA256
ebdc68c9f00eff95943ae68b17ded237c074da87bd0a5057800c91b597489f97

SHA512
808414921c3427ee6b5dda8e9b197a3149d82a27702b6cc6a9c52a27dd97b164f49b6d9fda5a843523e6d14f6421bbc515944f20cd32273acd4a56e217a84d60

Download Submit
C:\Windows\SysWOW64\Mpaifalo.exe

Filesize
96KB

MD5
2c6434073904cabcbb52e799fc0f03ff

SHA1
06d24621f7b60a4f7149526866e67bd3e8d5f54a

SHA256
7a197ca6aa1b865fb439f51267b852ca8555bb6e75e6fd0ecd1a12d218ba2720

SHA512
578c5e071900cf28a6c0953250ae011295c2072d11e961c494ab185a4f7a97f28bf501bffadd32479d61429149dd0f3c818f6ff6d51f9ecf2ea3257eb929c314

Download Submit
C:\Windows\SysWOW64\Mpdelajl.exe

Filesize
96KB

MD5
5387ff68333f048a8cd140831e42ef56

SHA1
52a5940d1608292719e052e1e0e270b8a750d451

SHA256
c4d75cbfac128dc3be981856e82ef6538e3297d55f9f05f22c5e4defe56528a0

SHA512
9bba9c0628b269e95ef6b243f103bf078656a16ef259c7991fd58de56549e8f7ec5569a298c45f5c70d7fb5fd2d96675bac768230e581b97bd5b1b154afbed14

Download Submit
C:\Windows\SysWOW64\Mpmokb32.exe

Filesize
96KB

MD5
f69efb25b94cfee5eb9bf85fee9ed94c

SHA1
0cd65b1454abd65cecbe3824c168f1bc1fcfe5f9

SHA256
08d0b452a7f854bc8b623894dd8397fb609f6dd75bc4111f16f55c6cd1888cd5

SHA512
6551d270696728b8686c68203f47cddb66ed1b5b880689951b04b7f73bf84a69ccf0b2a89bb157c89dcf05d9a0d6439d8203064d518c8c73ae23ead9a203214b

Download Submit
C:\Windows\SysWOW64\Nafokcol.exe

Filesize
96KB

MD5
f249da6b487fc3b56cd343a1e8ed181c

SHA1
005de587045e01a73189713fe443b34d743fdd8e

SHA256
9c2690d5f4aebccdca0d6e9d65d472aa5ab56852b0ff3c4aa8853fbf41302047

SHA512
18a97345af29e74f102e161e04675e9f3203314185a7e0690d5487f5502cca8912bcf6685328cf85dac658e465dbb2a7efb1072522b311257c9787bd3b89f63a

Download Submit
C:\Windows\SysWOW64\Ncgkcl32.exe

Filesize
96KB

MD5
73d849a5f66bd5bf480584339e51341a

SHA1
cebe074573b6f31195090cc91faf7bca4b9b8eef

SHA256
f16068506b74850c61590403707f8f5f02e58d941a57fc2d8b59131ffca04968

SHA512
1dd680d4a9e48162b5604622881b6a390f16c1917e1d24f1fe7aae073a6079a4353a1b35cbba457ee7479af3467042424f2cdbd6f652e1ee9f33a89e1e7218b3

Download Submit
C:\Windows\SysWOW64\Njacpf32.exe

Filesize
96KB

MD5
7944ac56b8ad58c149e565afb2f1b07a

SHA1
059b055f9c0799f16ed7347e9851b53f82f81e65

SHA256
a998d80b38494b4936f37be43dd533dccef885bccb076a648b9462183ab8ecad

SHA512
02400ce0fdc324037d269c3a651262eda207c16e1bcba19c64972666a8846364f173b9cf967e2aadf1041c1d4b39c4abfb3d00f98ebc9f3acb53a02fe16e289c

Download Submit
C:\Windows\SysWOW64\Nklfoi32.exe

Filesize
96KB

MD5
8b6e419ce76a49590343381195668b07

SHA1
cdf3ae4a54b1ed8e188534f722d56b49a933bf7d

SHA256
dfbe4c6f3531fc958610dc1d8b02aec3f101924be659c0d082acd397f1dcde61

SHA512
6c856572968aca8fc3c1d68295c19bf16429005855d66b34849b5283cd00df732a2adee33b443af0e590a3e9b6813d1914f4d0a18d521a670ea44409820255b4

Download Submit
C:\Windows\SysWOW64\Nnhfee32.exe

Filesize
96KB

MD5
6b65015922191955fcedce673090b5a0

SHA1
ef6227479b161f2776017587ac0a2544cd8abdf2

SHA256
fac151b8d25fa55b318e9d3fd3797f7cefbb87cbe1830f20c3641aca67b7f6bc

SHA512
344eba0332dd60a586eea6ebe488a465aed494d4fe01c1a6c4a6d3a3ae4efa0a78ab8427afb939e93d9a9645be108c878d573bfdf1c966f09b82a3cd8c5905ba

Download Submit
C:\Windows\SysWOW64\Nqfbaq32.exe

Filesize
96KB

MD5
1dfd2c94ad207b78d89ac8a24ec38c54

SHA1
be4874511f83c12ecf7201b328b173eaca7f29ed

SHA256
edcd421a8470f85abb0f935594e58288cf2178a356dc960a8e740b92c528ff93

SHA512
3527bd54d8af8de5938b7957599829480381836f98e46c2f19dc4f5519e8a04f52109c12e57c41a6c7be7d17657c425429e2d93bd9db61c01c1bc10ece31a137

Download Submit
C:\Windows\SysWOW64\Nqklmpdd.exe

Filesize
96KB

MD5
34862bef610a217494a5f291dd765739

SHA1
3e2c42131190deabe1398e8a605c694741fa3599

SHA256
f5ed21d22a43bd8d7d9d1c3fa88ed1f856b92fe5cfd947ca7cc2c527d5d4c949

SHA512
6d4fab752de99411d210776011b3d1f2f830e4cb45f92f3fe60ba124b082dd09c7975aaf44ad00cec44eef646fcaec17d7546bf864f07ebc52b93e096f920006

Download Submit
memory/536-159-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/536-297-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/836-262-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/836-285-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/864-310-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/864-32-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1088-44-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1088-309-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1452-288-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1452-232-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1488-63-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1488-306-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1636-304-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1636-80-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1792-124-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1816-176-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1816-295-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1908-92-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1960-300-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1960-136-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1968-305-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1968-72-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2068-294-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2068-184-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2384-298-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2384-152-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2400-293-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2400-192-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2576-104-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2576-302-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2620-96-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2620-303-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2684-134-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2856-112-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2856-301-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3028-313-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3028-12-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3252-216-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3252-290-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3288-284-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3288-260-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3300-282-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3300-274-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3716-268-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3716-283-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3752-24-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3752-311-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4032-47-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4032-308-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4308-286-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4308-248-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4484-287-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4484-240-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4556-199-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4556-292-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4576-289-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4576-223-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4600-280-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4600-281-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4680-211-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4680-291-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4756-312-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4756-15-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4832-296-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4832-168-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4860-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4860-314-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4928-299-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4928-144-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5048-307-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5048-56-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads