b5476446d4f5ac386bdd94987323ed71f70de54016ba19ce31e6e46b43e267ce

Analysis

max time kernel
93s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe
Size 1.7MB
Sample240508-xtnncaae6s
SHA256 b5476446d4f5ac386bdd94987323ed71f70de54016ba19ce31e6e46b43e267ce
MD5 264b27b9ac7ac6874e50d073638930b5
SHA1 4e2b68ab76ea8afaa6ef03dde72ab1ad5fd1f265
SHA512 8f78943b1526f29c26f8f34571eb40b0fa9396d02876e76a7c6311340f0a7ee2826890a1cfb5f0aa0077d2726ef1458b16de33cdc55706df09a8ee95bdd9702d
SSDEEP 49152:kO0e40QOdfZ7B1OHZYlLjqyJkUs75Naw4O5:kO0Z0QIfH1SM/qkkVbd4O5
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3140	sz.exe
3804	sz.exe
1296	pluginsetupadmin.exe

Loads dropped DLL 8 IoCs

pid	Process
5076	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe
5076	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe
5076	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe
5076	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe
5076	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe
5076	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe
5076	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe
1296	pluginsetupadmin.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\WOW6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\InprocServer32\ThreadingModel = "Apartment"	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\WOW6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\InprocServer32	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\WOW6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\JuleGame\\JLGPLA~1\\NPJLGP~1.DLL"	pluginsetupadmin.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	sz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\TypeLib\{77312AEE-9563-4B2C-B87E-4E8FF1528577}\3.0\0	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\WOW6432Node\CLSID\{77312AEE-9563-4B2C-B87E-4E8FF1528577}\Implemented Categories	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\JLGPLAYER3.jlgplayer3Ctrl.1	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AFF5BE97-7736-4383-82DA-1543D0520645}\ProxyStubClsid32	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F959CDDB-6516-4ABD-9D40-CDCFE3D48331}\TypeLib	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\JuleGame\\JLGPLA~1\\NPJLGP~1.DLL"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AFF5BE97-7736-4383-82DA-1543D0520645}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\WOW6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\JuleGame\\JLGPLA~1\\NPJLGP~1.DLL"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\WOW6432Node\Interface\{F959CDDB-6516-4ABD-9D40-CDCFE3D48331}\TypeLib\ = "{77312AEE-9563-4B2C-B87E-4E8FF1528577}"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\WOW6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\ = "jlgplayer3 Control"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F959CDDB-6516-4ABD-9D40-CDCFE3D48331}\TypeLib\ = "{77312AEE-9563-4B2C-B87E-4E8FF1528577}"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\MiscStatus\ = "0"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\WOW6432Node\Interface\{AFF5BE97-7736-4383-82DA-1543D0520645}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\TypeLib\{77312AEE-9563-4B2C-B87E-4E8FF1528577}\3.0\FLAGS	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{77312AEE-9563-4B2C-B87E-4E8FF1528577}\2.0	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{77312AEE-9563-4B2C-B87E-4E8FF1528577}\2.0\0	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AFF5BE97-7736-4383-82DA-1543D0520645}\TypeLib\ = "{77312AEE-9563-4B2C-B87E-4E8FF1528577}"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AFF5BE97-7736-4383-82DA-1543D0520645}\TypeLib\Version = "2.0"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\ = "jlgplayer3 Control"	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JLGPLAYER3.jlgplayer3Ctrl.1	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\ProgID\ = "JLGPLAYER3.jlgplayer3Ctrl.1"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\Control\	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\WOW6432Node\Interface\{AFF5BE97-7736-4383-82DA-1543D0520645}\ = "_Djlgplayer3"	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{77312AEE-9563-4B2C-B87E-4E8FF1528577}\2.0\HELPDIR	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{77312AEE-9563-4B2C-B87E-4E8FF1528577}\2.0\HELPDIR\	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F959CDDB-6516-4ABD-9D40-CDCFE3D48331}\ = "_Djlgplayer3Events"	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\WOW6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\MiscStatus	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JLGPLAYER3.jlgplayer3Ctrl.1\CLSID	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\ToolboxBitmap32	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\WOW6432Node\Interface	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\WOW6432Node\Interface\{AFF5BE97-7736-4383-82DA-1543D0520645}\ProxyStubClsid	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\WOW6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\JuleGame\\JLGPLA~1\\NPJLGP~1.DLL, 1"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\WOW6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\TypeLib\ = "{77312AEE-9563-4B2C-B87E-4E8FF1528577}"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F959CDDB-6516-4ABD-9D40-CDCFE3D48331}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77312AEE-9563-4B2C-B87E-4E8FF1528577}\ = "jlgplayer3 Property Page"	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\Control	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{77312AEE-9563-4B2C-B87E-4E8FF1528577}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\JuleGame\\jlgplayer\\npjlgplayer3.dll"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F959CDDB-6516-4ABD-9D40-CDCFE3D48331}\TypeLib\Version = "2.0"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AFF5BE97-7736-4383-82DA-1543D0520645}\ = "_Djlgplayer3"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AFF5BE97-7736-4383-82DA-1543D0520645}\TypeLib\ = "{77312AEE-9563-4B2C-B87E-4E8FF1528577}"	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\WOW6432Node\Interface\{F959CDDB-6516-4ABD-9D40-CDCFE3D48331}\ProxyStubClsid32	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{77312AEE-9563-4B2C-B87E-4E8FF1528577}	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AFF5BE97-7736-4383-82DA-1543D0520645}\ProxyStubClsid32	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\WOW6432Node\Interface\{F959CDDB-6516-4ABD-9D40-CDCFE3D48331}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}"	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AFF5BE97-7736-4383-82DA-1543D0520645}	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F959CDDB-6516-4ABD-9D40-CDCFE3D48331}	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77312AEE-9563-4B2C-B87E-4E8FF1528577}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\JuleGame\\JLGPLA~1\\NPJLGP~1.DLL"	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\WOW6432Node\Interface\{AFF5BE97-7736-4383-82DA-1543D0520645}\TypeLib	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\WOW6432Node\Interface\{F959CDDB-6516-4ABD-9D40-CDCFE3D48331}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\TypeLib\{77312AEE-9563-4B2C-B87E-4E8FF1528577}\3.0\ = "jlgplayer3 ActiveX Control module"	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\TypeLib\{77312AEE-9563-4B2C-B87E-4E8FF1528577}\3.0\HELPDIR	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\TypeLib\{77312AEE-9563-4B2C-B87E-4E8FF1528577}\3.0\HELPDIR\	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\WOW6432Node\CLSID\{77312AEE-9563-4B2C-B87E-4E8FF1528577}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AFF5BE97-7736-4383-82DA-1543D0520645}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AFF5BE97-7736-4383-82DA-1543D0520645}\TypeLib	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\WOW6432Node\Interface\{F959CDDB-6516-4ABD-9D40-CDCFE3D48331}\ = "_Djlgplayer3Events"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F959CDDB-6516-4ABD-9D40-CDCFE3D48331}\ = "_Djlgplayer3Events"	pluginsetupadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\WOW6432Node\Interface\{F959CDDB-6516-4ABD-9D40-CDCFE3D48331}\ProxyStubClsid	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\WOW6432Node\Interface\{F959CDDB-6516-4ABD-9D40-CDCFE3D48331}\TypeLib\Version = "3.0"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\WOW6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\ProgID\ = "JLGPLAYER3.jlgplayer3Ctrl.1"	pluginsetupadmin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\WOW6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\InprocServer32\ThreadingModel = "Apartment"	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\ProgID	pluginsetupadmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A1B1EE5-E5AD-48E1-A74A-6DE132B3F8ED}\Version	pluginsetupadmin.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5076	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe
5076	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe
5076	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe
5076	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe
5076	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe
5076	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3804	sz.exe
3804	sz.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 3140	5076	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe	80
PID 5076 wrote to memory of 3140	5076	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe	80
PID 5076 wrote to memory of 3140	5076	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe	80
PID 5076 wrote to memory of 3804	5076	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe	85
PID 5076 wrote to memory of 3804	5076	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe	85
PID 5076 wrote to memory of 3804	5076	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe	85
PID 5076 wrote to memory of 1296	5076	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe	86
PID 5076 wrote to memory of 1296	5076	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe	86
PID 5076 wrote to memory of 1296	5076	264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\264b27b9ac7ac6874e50d073638930b5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Users\Admin\AppData\Roaming\2345ÓÎÏ·\sz\sz.exe
  "C:\Users\Admin\AppData\Roaming\2345ÓÎÏ·\sz\sz.exe" /setupsucc
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  PID:3140
- C:\Users\Admin\AppData\Roaming\2345ÓÎÏ·\sz\sz.exe
  "C:\Users\Admin\AppData\Roaming\2345ÓÎÏ·\sz\sz.exe" /autorun /setuprun
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3804
- C:\Users\Admin\AppData\Roaming\2345ÓÎÏ·\sz\pluginsetupadmin.exe
  "C:\Users\Admin\AppData\Roaming\2345ÓÎÏ·\sz\pluginsetupadmin.exe" /S
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Registers COM server for autorun
  - Modifies registry class
  PID:1296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

npjlgplayer3.dll

Path C:\Users\Admin\AppData\Local\JuleGame\jlgplayer\npjlgplayer3.dll
Size 793KB
SHA256 e2dd0098bfe73f5ae6f407a03a11df39baed75e29fcdc67413bbbc6819a1c4a5
MD5 eb9729ce37dff44821fc35f71dea8fa0
SHA1 2cf8d4d6b9bad91e9ec26c746fa011b9e97387b1
SHA512 79e1fd84b4e61a1e20188f4c8d40b1363e0ea5dcbb840e4dbbe8463f0f8c1321c2b6c66f32498e3dbdc8c4ffe95a10659cba16eed445c8113183e9bfb1fb9839
SSDEEP 12288:sawAcH1b9waMWLWANyFqEaP2Y5d9w25PIdn/T465O:jm1b9waMWqANyFqEaP2Y5dFgd/T460
MD5 SHA1 SHA512 SSDEEP

Submit Download

FindProcDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr3E05.tmp\FindProcDLL.dll
Size 3KB
SHA256 0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
MD5 8614c450637267afacad1645e23ba24a
SHA1 e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA512 af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr3E05.tmp\System.dll
Size 10KB
SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
MD5 56a321bd011112ec5d8a32b2f6fd3231
SHA1 df20e3a35a1636de64df5290ae5e4e7572447f78
SHA512 5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
SSDEEP 192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
MD5 SHA1 SHA512 SSDEEP

Submit Download

lander.ini

Path C:\Users\Admin\AppData\Roaming\2345ÓÎÏ·\sz\lander.ini
Size 374B
SHA256 2fbf7507afd3c3c120fd4a5801f3adfcfe1a57b2e3c00f41799bcbac4236a02d
MD5 65a50e1fcd4fa1371791e26c4195bced
SHA1 fc04e9674aee95827e8b1fbfc230e280c8ecfa52
SHA512 b73c3560fc55b358278d52a8fe105034649ced419dfb9217d8455b56fc2e34f62a8d6d50e2406305e42f05a71332f0cb611937086b37ce051d6433020431e17c
MD5 SHA1 SHA512

Submit Download

pluginsetupadmin.exe

Path C:\Users\Admin\AppData\Roaming\2345ÓÎÏ·\sz\pluginsetupadmin.exe
Size 461KB
SHA256 c007fefe59aa783e7ea677a6275f87b9675f750a8e31a67c8325440308eed90a
MD5 87daf3658c6aa863444532f1f324cca1
SHA1 c0caa342fcbde6a0c6b1566e71bc051117a7c40b
SHA512 050b10619e355fe16fc23bf83b7b38a5237adb80e406d79653c029182bf33a40c3717a12f80ce1e024e2afee305421b3f3947d38a833169576e1c3d0a9ebc551
SSDEEP 12288:7ugClTRuCj6KxXpDKlvuONobWHp9d/MJyKRs:78TRuo6KxZeluooKh/SyKRs
MD5 SHA1 SHA512 SSDEEP

Submit Download

sz.exe

Path C:\Users\Admin\AppData\Roaming\2345ÓÎÏ·\sz\sz.exe
Size 1.2MB
SHA256 bcc516b915a8826ef12689e455d0b1afaa7ad1eae534729eb43e6639a95992f6
MD5 5fd84590e2e1358a8e51fb76b1b3d721
SHA1 eea0902b66e1082a5ba9a1ad7c4bcd3fb5d53154
SHA512 3e9de52d11522b5115d30b51a6cf5b43e28df27432e7d0aa0eeecd0648ab1d3622b30f921bbed011681ba7c286d71053486bb0b6949103b69adab1cc4e5e1281
SSDEEP 24576:hyPL2BkBGuDHCu9lpaE6ua0gY28UlyvCKk3U9wlozxjv2k6DjIVnF0SK+OGkn:G2BkBpCurMpujW8ptxOkMj6nFjdO5n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lander.ini

Path C:\Users\Admin\AppData\Roaming\2345游戏\sz\Lander.ini
Size 105B
SHA256 2bb149a4225b101b9e91b0ff2a710e02dacff7f125a0d69144e95a0a7d54aba8
MD5 53e80003a66e99aa2049120f6982b60a
SHA1 af33a75e8983c70d1c6cc9af7dfb110ec1603299
SHA512 c79fcbe2ac5864098d3ce87d2bdc790061821509f2458fcb6bbc4beecf0eab11b1bd509f6594a831ce32aa09389ac4e221b4c2e772c5d53971f22536500565fe
MD5 SHA1 SHA512

Submit Download

memory/5076-43-0x00000000048D0000-0x00000000048D3000-memory.dmp

Download

memory/5076-44-0x00000000048D1000-0x00000000048D2000-memory.dmp

Download

memory/5076-42-0x00000000048D0000-0x00000000048D3000-memory.dmp

Download

memory/5076-53-0x00000000048D1000-0x00000000048D2000-memory.dmp

Download

memory/5076-54-0x00000000048D1000-0x00000000048D2000-memory.dmp

Download

memory/5076-62-0x00000000048D1000-0x00000000048D2000-memory.dmp

Download

memory/5076-61-0x00000000048D0000-0x00000000048D3000-memory.dmp

Download

memory/5076-14-0x00000000048D0000-0x00000000048D3000-memory.dmp

Download

memory/5076-15-0x00000000048D0000-0x00000000048D3000-memory.dmp

Download

memory/5076-16-0x00000000048D1000-0x00000000048D2000-memory.dmp

Download