locky | 803a9fdb26c22ecd599f25f30e79c4914c75e45c2613718c4a25b16112222726

Analysis

max time kernel
127s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/05/2024, 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

542751e8e64d10ff82ff68c514486246_JaffaCakes118.exe
Size

206KB
MD5

542751e8e64d10ff82ff68c514486246
SHA1

e376fa75c0597a0b877fcd547355fd0e2ecffb19
SHA256

803a9fdb26c22ecd599f25f30e79c4914c75e45c2613718c4a25b16112222726
SHA512

2b9a16d54459c8c673791ba9d8f83fd1ea23a70deda0179dcccc5da688cdc5a69a25d9f8fede72b7f16f945970e0e739a69fbf1a7f09211fb1701200d226f063
SSDEEP

3072:nZo0jJJKIEK2aVgxr6ygjxy7vupGaHuIO6n6:2YFhZLVyLupNu/+

Score

10^/10

locky locky_osiris ransomware

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
Locky (Osiris variant)
Variant of the Locky ransomware seen in the wild since early 2017.
ransomware locky_osiris

Deletes itself 1 IoCs

pid	Process
2532	cmd.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\DesktopOSIRIS.bmp"	542751e8e64d10ff82ff68c514486246_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop\WallpaperStyle = "0"	542751e8e64d10ff82ff68c514486246_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop\TileWallpaper = "0"	542751e8e64d10ff82ff68c514486246_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000003a9373237a56aa30f45d1abccbea8f2ab420b9b462cd80fbb5e02d94318698d5000000000e8000000002000020000000d3a1f5b3899ea60b2416148b5ab000d5ab6afeffe9a14cfa2fbd903cc4adbf7a900000007bd459657f8caeb1d8a409375842855a6c477931be18c334a05f9c4830b3c3879290ef3d5ea38d54fb34531d842d472eb6becb86370fe2afe0ac5a80572231934b43cf7aa8aec8b924a6ba365bb2e01fc16250331bd4193f4851ee8702656461959ecbbd73cc164489aafac3d2c117c082d133181cb4f2261f39f952804391558ebb1a66789edd31965a403ddb74c8cb4000000082d290d79fcea9584a20dbc488b3d4174189eb7801dd125c90a178165c488d82fb70c48c28d1ffe71c2d330810f5410e489ed9b6a283452089fd5923a7cf38bb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0038be2a09a9da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{55D6CF71-14FC-11EF-8D50-4A4F109F65B0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000001182d6da5c4727cbe791f038eb4f6158c786c6aa166b624ca9e391004ec4090e000000000e8000000002000020000000e3381273041cb7e35587c903483800fad34257cce9e956d0f4d1d248a6d9f57a200000001a2324ee828497bb50ba30e5ad0393a834cf69e109e13a999a655dad666cb2f040000000778d4c24d74078e5533065c1c59be98f556fa74d93a3db878848ba9317ec7aca8d3e11fdaa88e38df9a075d2c370f19d8723318d832dc66ab5a98bf6303cabb0	iexplore.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1100	iexplore.exe
940	DllHost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1100	iexplore.exe
1100	iexplore.exe
2452	IEXPLORE.EXE
2452	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1100	2228	542751e8e64d10ff82ff68c514486246_JaffaCakes118.exe	32
PID 2228 wrote to memory of 1100	2228	542751e8e64d10ff82ff68c514486246_JaffaCakes118.exe	32
PID 2228 wrote to memory of 1100	2228	542751e8e64d10ff82ff68c514486246_JaffaCakes118.exe	32
PID 2228 wrote to memory of 1100	2228	542751e8e64d10ff82ff68c514486246_JaffaCakes118.exe	32
PID 1100 wrote to memory of 2452	1100	iexplore.exe	34
PID 1100 wrote to memory of 2452	1100	iexplore.exe	34
PID 1100 wrote to memory of 2452	1100	iexplore.exe	34
PID 1100 wrote to memory of 2452	1100	iexplore.exe	34
PID 2228 wrote to memory of 2532	2228	542751e8e64d10ff82ff68c514486246_JaffaCakes118.exe	35
PID 2228 wrote to memory of 2532	2228	542751e8e64d10ff82ff68c514486246_JaffaCakes118.exe	35
PID 2228 wrote to memory of 2532	2228	542751e8e64d10ff82ff68c514486246_JaffaCakes118.exe	35
PID 2228 wrote to memory of 2532	2228	542751e8e64d10ff82ff68c514486246_JaffaCakes118.exe	35

C:\Users\Admin\AppData\Local\Temp\542751e8e64d10ff82ff68c514486246_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\542751e8e64d10ff82ff68c514486246_JaffaCakes118.exe"
1⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\DesktopOSIRIS.htm
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1100 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2452
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\542751e8e64d10ff82ff68c514486246_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  PID:2532

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OSIRIS-20d7.htm

Filesize
8KB

MD5
0ea75aa883556b9f0d39e1ccb07cacdb

SHA1
0cad1c77131da838bcf7a828883c88d20d7d1452

SHA256
3bd1298b6b35a2da4fdf875021eefb4d227b330e88b7226be8feb1e3b3c2a1c4

SHA512
3a68ef241455db5d8c076ce92fe84d513de38707ac1d272109bbafa7794607a43dee4e3145a765b2946c4f55dae91f1f5446d479415ad613ad65fc8d6acb65c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66c7f6ce2099d000ca15ab4eb12d07f3

SHA1
647d97440a92073c83760a26b4e8dbaf9c45d1c0

SHA256
fda7821795335d49cc0430a7db2e41dcf63cfe12c00c468677be456a42889873

SHA512
1f611e3bd8321f36c2ab0e0b8b8312d6f970dd227b0bf4e5937d6f2a39d92efda99802383f3d8adc94c0638aa1176dd515effac0ae0170c0cb90e9c137c46862

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7a002b8d5532597ba0b7c6d92665b79

SHA1
d916e917306e0f72afcf9912e2ad68cffedd57e3

SHA256
b9b7dc2f733acd3c044977044af59b7bf06dece060e07d9591be2c63e70bddae

SHA512
b88502016e06d8c68403b2066a52dffbcbe384d9593a2fb804e012ddb2206da5626871642648a78f9f2f1b86be84a117b26e0d0e3c5f11891d489e947d863f1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1614cc3fcce62eab0040a333ab23e3fb

SHA1
ad2160c605daf69b552c93c174aec7ee3114a848

SHA256
5d9866aacf5ce56c536787b18460fe0d2707e57becbbc43f98e8bda68de26f35

SHA512
86557924eaa6bdc33858cc339c7647ac83e11d9d7f3b190457c3847820b48287a1cf140d84f6cb5c84b98a44300029878edc7b84eca41247f0882c8abd2830d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0612c970251cf594559479633142fc7

SHA1
7ebd8e9b33f6f5e5469b1c2b4f7720870032ace8

SHA256
6fbeed4b3abf7349d662dd3b1072e3b13b25fd762bfcf52abc543b9a855606ba

SHA512
411670ee91ad400b899c5400e52b58663f4a0fd871dcc48cb704280e8f252033e2787e2bd1641e3b76867f266656ae8c150841cdc1ceda4ea0fe1d88fc63a049

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f99f1a58be3679636ec94c6cd6734d14

SHA1
eddb37cba3339be2cbe48d13e27839c6f4566d1c

SHA256
440d9d464ec289b02889e9be6815760ceb516c18731d8fb5db140910b412330e

SHA512
44b6d7f0f866b9c72faffc90d846cd6830083502941bd203368318cb2f5ee5ae8986b33e61602839d1c8673b1a3be26df524d4027bcf8a9c470ce976bfeab125

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e107d29bf564df426cc52352771cf168

SHA1
4ba35a3b856e0001abe487eafe6d5d1d531a20fa

SHA256
3c9f8bbfddd2587fa432fa236cee2664967e6bb14385b2bdb978d1cb1e6a3802

SHA512
dd82ef9e26ebe16327e3ba127b2beb3f3b66958e28fbdcd32fa028275780a7c268a8172ec2c7049399716165e803d0aadbd8912cd09d1892eba5aa31f76860ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6073ada674b48c59f99778f8b010e70

SHA1
f696adfe4113abe22944abf0bc0ef75e43d60bb4

SHA256
a176e4020d53113af9f750f87f4823a0bc7e3ec0332105f7b570fa1b49b43a51

SHA512
f19602f671620b886cbec5d7d63e51fe2b7314423f59a9e6ca9076375bb5408fc25ddbe32a9b85313a2ca68e5d58bf950691a8a1e7e97ba9c09140c0fe4d4585

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbb249275a3d1b616f751ee2f880b892

SHA1
be3cfb481c59643be115cdaa54968532fb267b9f

SHA256
af20fab9f84e567303e21d326d4c0e861f6982dedbbb128bb3b27acab7cd7096

SHA512
4585bc9274935b7da29aab12fed05a2594d40d317a90e1567435b85da88e2a48c97346e1839bae5df9185623d596a230727dde409cab138084fd858f1ecb07e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98914e5b7a03a12bb567c147f8bb5cdc

SHA1
a23be1bde642f77de8d72e22080a9e79ec8e974a

SHA256
c18d7fc19564b91d20d5f0e3553ef50c1e96791cc73e73d5aef0e6881b001613

SHA512
4070b50eeef3bd604935555de30801e4cb0994aa1a703165b14f6265d0b482c709008b0680cbcc31db779599ca49894a3e3816398238d2cff48c515e25e46443

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabED9C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEE89.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEF39.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\DesktopOSIRIS.bmp

Filesize
3.1MB

MD5
d5b460eae3d863f8a986b46c7368bc41

SHA1
6fdee1b8c040d4b472e5927bffa66bea252e1d8e

SHA256
de1d8f68da71289f97bcc582ae648cecaf5c0c8f0995a0e890484e1c8a597694

SHA512
a158effabaa4c0fe142aefa0e3bd44ed1a6bb2a81b20f454d83360dcd88a4a401f1f9b6fed2277c1f5bc5ab37a18a6509a388dcc0d860118c43ce34f3e7958e8

Download Submit
memory/940-350-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/940-828-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/940-348-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/2228-10-0x0000000001CD0000-0x0000000001CF7000-memory.dmp

Filesize
156KB

Download
memory/2228-351-0x0000000001CD0000-0x0000000001CF7000-memory.dmp

Filesize
156KB

Download
memory/2228-347-0x0000000000300000-0x0000000000302000-memory.dmp

Filesize
8KB

Download
memory/2228-342-0x0000000001CD0000-0x0000000001CF7000-memory.dmp

Filesize
156KB

Download
memory/2228-19-0x0000000001CD0000-0x0000000001CF7000-memory.dmp

Filesize
156KB

Download
memory/2228-20-0x0000000001CD0000-0x0000000001CF7000-memory.dmp

Filesize
156KB

Download
memory/2228-18-0x0000000001CD0000-0x0000000001CF7000-memory.dmp

Filesize
156KB

Download
memory/2228-1-0x0000000000440000-0x0000000000441000-memory.dmp

Filesize
4KB

Download
memory/2228-8-0x0000000000440000-0x0000000000441000-memory.dmp

Filesize
4KB

Download
memory/2228-7-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2228-5-0x0000000001CD0000-0x0000000001CF7000-memory.dmp

Filesize
156KB

Download
memory/2228-6-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download
memory/2228-4-0x0000000000450000-0x0000000000451000-memory.dmp

Filesize
4KB

Download
memory/2228-3-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2228-2-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads