b5476446d4f5ac386bdd94987323ed71f70de54016ba19ce31e6e46b43e267ce

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 19:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe
Size

1.7MB
MD5

264b27b9ac7ac6874e50d073638930b5
SHA1

4e2b68ab76ea8afaa6ef03dde72ab1ad5fd1f265
SHA256

b5476446d4f5ac386bdd94987323ed71f70de54016ba19ce31e6e46b43e267ce
SHA512

8f78943b1526f29c26f8f34571eb40b0fa9396d02876e76a7c6311340f0a7ee2826890a1cfb5f0aa0077d2726ef1458b16de33cdc55706df09a8ee95bdd9702d
SSDEEP

49152:kO0e40QOdfZ7B1OHZYlLjqyJkUs75Naw4O5:kO0Z0QIfH1SM/qkkVbd4O5

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2660	sz.exe
1480	sz.exe
1280	pluginsetupadmin.exe

Loads dropped DLL 9 IoCs

pid	Process
2364	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe
2364	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe
2364	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe
2364	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe
2364	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe
2364	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe
2364	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe
2364	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe
1280	pluginsetupadmin.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\InprocServer32\ThreadingModel = "Apartment"	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\InprocServer32	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\JuleGame\\JLGPLA~1\\NPJLGP~1.DLL"	pluginsetupadmin.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	sz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	sz.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\JLGPLAYER3.jlgplayer3Ctrl.1	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\ToolboxBitmap32	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\MiscStatus\1\ = "655761"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\Interface\{F959CDDB-6516-4ABD-9D40-CDCFE3D48331}\TypeLib\Version = "3.0"	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\TypeLib	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\Control	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F959CDDB-6516-4ABD-9D40-CDCFE3D48331}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\Control	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F959CDDB-6516-4ABD-9D40-CDCFE3D48331}\TypeLib\Version = "2.0"	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77312AEE-9563-4B2C-B87E-4E8FF1528577}\Implemented Categories	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77312AEE-9563-4B2C-B87E-4E8FF1528577}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\Interface\{F959CDDB-6516-4ABD-9D40-CDCFE3D48331}\TypeLib\ = "{77312AEE-9563-4B2C-B87E-4E8FF1528577}"	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F959CDDB-6516-4ABD-9D40-CDCFE3D48331}\TypeLib	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\TypeLib\{77312AEE-9563-4B2C-B87E-4E8FF1528577}\3.0\FLAGS\ = "2"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\JuleGame\\JLGPLA~1\\NPJLGP~1.DLL"	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\Interface\{AFF5BE97-7736-4383-82DA-1543D0520645}	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{77312AEE-9563-4B2C-B87E-4E8FF1528577}\2.0\FLAGS	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{77312AEE-9563-4B2C-B87E-4E8FF1528577}\2.0\0	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AFF5BE97-7736-4383-82DA-1543D0520645}\TypeLib\Version = "2.0"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JLGPLAYER3.jlgplayer3Ctrl.1\ = "jlgplayer3 Control"	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\Interface	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JLGPLAYER3.jlgplayer3Ctrl.1	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\Version	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F959CDDB-6516-4ABD-9D40-CDCFE3D48331}\TypeLib\ = "{77312AEE-9563-4B2C-B87E-4E8FF1528577}"	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\ProgID	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\Interface\{AFF5BE97-7736-4383-82DA-1543D0520645}\ = "_Djlgplayer3"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\JuleGame\\JLGPLA~1\\NPJLGP~1.DLL, 1"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\JLGPLAYER3.jlgplayer3Ctrl.1\CLSID\ = "{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{77312AEE-9563-4B2C-B87E-4E8FF1528577}\2.0\ = "jlgplayer3 ActiveX Control module"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AFF5BE97-7736-4383-82DA-1543D0520645}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\Interface\{AFF5BE97-7736-4383-82DA-1543D0520645}\TypeLib	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\Interface\{F959CDDB-6516-4ABD-9D40-CDCFE3D48331}\TypeLib	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\TypeLib\{77312AEE-9563-4B2C-B87E-4E8FF1528577}\3.0\0	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AFF5BE97-7736-4383-82DA-1543D0520645}\TypeLib	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\MiscStatus\1\ = "655761"	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\MiscStatus	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{77312AEE-9563-4B2C-B87E-4E8FF1528577}\2.0\0\win32	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F959CDDB-6516-4ABD-9D40-CDCFE3D48331}	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\JuleGame\\JLGPLA~1\\NPJLGP~1.DLL"	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\Interface\{F959CDDB-6516-4ABD-9D40-CDCFE3D48331}	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\TypeLib\{77312AEE-9563-4B2C-B87E-4E8FF1528577}	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{77312AEE-9563-4B2C-B87E-4E8FF1528577}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\ProgID	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\JLGPLAYER3.jlgplayer3Ctrl.1\ = "jlgplayer3 Control"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AFF5BE97-7736-4383-82DA-1543D0520645}\TypeLib\Version = "2.0"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F959CDDB-6516-4ABD-9D40-CDCFE3D48331}\ = "_Djlgplayer3Events"	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F959CDDB-6516-4ABD-9D40-CDCFE3D48331}\TypeLib	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\TypeLib\{77312AEE-9563-4B2C-B87E-4E8FF1528577}\3.0\HELPDIR\	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\Interface\{F959CDDB-6516-4ABD-9D40-CDCFE3D48331}\ProxyStubClsid	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\InprocServer32\ThreadingModel = "Apartment"	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F959CDDB-6516-4ABD-9D40-CDCFE3D48331}\ProxyStubClsid32	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77312AEE-9563-4B2C-B87E-4E8FF1528577}	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\Interface\{AFF5BE97-7736-4383-82DA-1543D0520645}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}"	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AFF5BE97-7736-4383-82DA-1543D0520645}\ProxyStubClsid32	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\Interface\{AFF5BE97-7736-4383-82DA-1543D0520645}\TypeLib\Version = "3.0"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\MiscStatus\ = "0"	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\TypeLib\{77312AEE-9563-4B2C-B87E-4E8FF1528577}\3.0\0\win32	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Wow6432Node\CLSID	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AFF5BE97-7736-4383-82DA-1543D0520645}\ProxyStubClsid32	pluginsetupadmin.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2364	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe
2364	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe
2364	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe
2364	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1480	sz.exe
1480	sz.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2660	2364	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe	28
PID 2364 wrote to memory of 2660	2364	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe	28
PID 2364 wrote to memory of 2660	2364	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe	28
PID 2364 wrote to memory of 2660	2364	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe	28
PID 2364 wrote to memory of 1480	2364	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe	31
PID 2364 wrote to memory of 1480	2364	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe	31
PID 2364 wrote to memory of 1480	2364	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe	31
PID 2364 wrote to memory of 1480	2364	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe	31
PID 2364 wrote to memory of 1280	2364	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe	32
PID 2364 wrote to memory of 1280	2364	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe	32
PID 2364 wrote to memory of 1280	2364	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe	32
PID 2364 wrote to memory of 1280	2364	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe	32
PID 2364 wrote to memory of 1280	2364	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe	32
PID 2364 wrote to memory of 1280	2364	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe	32
PID 2364 wrote to memory of 1280	2364	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Roaming\2345ÓÎÏ·\sz\sz.exe
  "C:\Users\Admin\AppData\Roaming\2345ÓÎÏ·\sz\sz.exe" /setupsucc
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  PID:2660
- C:\Users\Admin\AppData\Roaming\2345ÓÎÏ·\sz\sz.exe
  "C:\Users\Admin\AppData\Roaming\2345ÓÎÏ·\sz\sz.exe" /autorun /setuprun
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1480
- C:\Users\Admin\AppData\Roaming\2345ÓÎÏ·\sz\pluginsetupadmin.exe
  "C:\Users\Admin\AppData\Roaming\2345ÓÎÏ·\sz\pluginsetupadmin.exe" /S
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Registers COM server for autorun
  - Modifies registry class
  PID:1280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\JuleGame\jlgplayer\npjlgplayer3.dll

Filesize
793KB

MD5
eb9729ce37dff44821fc35f71dea8fa0

SHA1
2cf8d4d6b9bad91e9ec26c746fa011b9e97387b1

SHA256
e2dd0098bfe73f5ae6f407a03a11df39baed75e29fcdc67413bbbc6819a1c4a5

SHA512
79e1fd84b4e61a1e20188f4c8d40b1363e0ea5dcbb840e4dbbe8463f0f8c1321c2b6c66f32498e3dbdc8c4ffe95a10659cba16eed445c8113183e9bfb1fb9839

Download Submit
C:\Users\Admin\AppData\Roaming\2345ÓÎÏ·\sz\lander.ini

Filesize
374B

MD5
65a50e1fcd4fa1371791e26c4195bced

SHA1
fc04e9674aee95827e8b1fbfc230e280c8ecfa52

SHA256
2fbf7507afd3c3c120fd4a5801f3adfcfe1a57b2e3c00f41799bcbac4236a02d

SHA512
b73c3560fc55b358278d52a8fe105034649ced419dfb9217d8455b56fc2e34f62a8d6d50e2406305e42f05a71332f0cb611937086b37ce051d6433020431e17c

Download Submit
C:\Users\Admin\AppData\Roaming\2345ÓÎÏ·\sz\pluginsetupadmin.exe

Filesize
461KB

MD5
87daf3658c6aa863444532f1f324cca1

SHA1
c0caa342fcbde6a0c6b1566e71bc051117a7c40b

SHA256
c007fefe59aa783e7ea677a6275f87b9675f750a8e31a67c8325440308eed90a

SHA512
050b10619e355fe16fc23bf83b7b38a5237adb80e406d79653c029182bf33a40c3717a12f80ce1e024e2afee305421b3f3947d38a833169576e1c3d0a9ebc551

Download Submit
C:\Users\Admin\AppData\Roaming\2345ÓÎÏ·\sz\sz.exe

Filesize
512KB

MD5
dc76537739480187a51475b137a96572

SHA1
34d097cf5e3f0d4a422f70e09bb81e988fa6adb9

SHA256
07b49f9565b8aff1bb71699ed63b6574289779215fb5c2aa54b4f2d6c21a2f5e

SHA512
afd3896ea65847f173f99538183d8c6e434d9b3f28c3e595af4145464b02449bbb9a5336ffd1c5ae8ea321bc87980298e80a9b82d488e09c00aeadd1541ba959

Download Submit
C:\Users\Admin\AppData\Roaming\2345ÓÎÏ·\sz\sz.exe

Filesize
1.2MB

MD5
5fd84590e2e1358a8e51fb76b1b3d721

SHA1
eea0902b66e1082a5ba9a1ad7c4bcd3fb5d53154

SHA256
bcc516b915a8826ef12689e455d0b1afaa7ad1eae534729eb43e6639a95992f6

SHA512
3e9de52d11522b5115d30b51a6cf5b43e28df27432e7d0aa0eeecd0648ab1d3622b30f921bbed011681ba7c286d71053486bb0b6949103b69adab1cc4e5e1281

Download Submit
C:\Users\Admin\AppData\Roaming\2345游戏\sz\Lander.ini

Filesize
105B

MD5
f677bcc35ca5b71636740932c8310d57

SHA1
3c11efe096c0280f3a19f9f1b60c5560449453f5

SHA256
7612f7c2be199d78dee986475d1dc391afce3b3b2625f196892475287dc643e0

SHA512
77cedaebe2e93a11291123d513d0133c964aa0f47eab192fa55f28d278be3ccc4305e259909d4e7e50c06b610ff74f3478f1028a77860b9bebdf82716d2dd2f3

Download Submit
\Users\Admin\AppData\Local\JuleGame\jlgplayer\npjlgplayer3.dll

Filesize
448KB

MD5
f57f2e5e228ebf5267412172bed99dd7

SHA1
2c26c695bd6e746917571d8acbbf146bf59d96e5

SHA256
e23c2bbbd1b377d44a13678a25de985d300bd7d6e751aa14735b3186ff5b9eb8

SHA512
1f6a6709a01a92bde4ab846ebb2524f4feeff83e33019c3cc037e6af99335f3eafbbd3beb8c25c52397f3334bbda8e011b38445425cce01f2e4aa3edffcbbda5

Download Submit
\Users\Admin\AppData\Local\Temp\nso560.tmp\FindProcDLL.dll

Filesize
3KB

MD5
8614c450637267afacad1645e23ba24a

SHA1
e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

SHA256
0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

SHA512
af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

Download Submit
\Users\Admin\AppData\Local\Temp\nso560.tmp\System.dll

Filesize
10KB

MD5
56a321bd011112ec5d8a32b2f6fd3231

SHA1
df20e3a35a1636de64df5290ae5e4e7572447f78

SHA256
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

SHA512
5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

Download Submit
\Users\Admin\AppData\Roaming\2345ÓÎÏ·\sz\sz.exe

Filesize
448KB

MD5
a1cbdcee6f0f3842569643197cf28fd1

SHA1
94e52a96b209a0d76c879144300ff7e3d11146eb

SHA256
22c0f3fe4a76fb8efae4fb2695123572eae51ea30ba8fe94df755704e62348df

SHA512
332cce9c01a1bb09197ade949d773afc194b2dc6b73505bea4a8bcfa9aa3affa436479a77f1a0f9bf23a33a425e891fea8f28900cd6eb1560159f2762c9c9c2c

Download Submit
memory/2364-50-0x00000000004F1000-0x00000000004F2000-memory.dmp

Filesize
4KB

Download
memory/2364-13-0x00000000004F1000-0x00000000004F2000-memory.dmp

Filesize
4KB

Download
memory/2364-43-0x00000000004F0000-0x00000000004F3000-memory.dmp

Filesize
12KB

Download
memory/2364-44-0x00000000004F1000-0x00000000004F2000-memory.dmp

Filesize
4KB

Download
memory/2364-12-0x00000000004F0000-0x00000000004F3000-memory.dmp

Filesize
12KB

Download
memory/2364-62-0x00000000004F1000-0x00000000004F2000-memory.dmp

Filesize
4KB

Download
memory/2364-61-0x00000000004F0000-0x00000000004F3000-memory.dmp

Filesize
12KB

Download