Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 08:24
Static task
static1
Behavioral task
behavioral1
Sample
6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe
-
Size
283KB
-
MD5
6a55a41c395a1c2e7726b82ebce8b6aa
-
SHA1
82365a68148412def7f142e2eb1909d1752c0b88
-
SHA256
3a788ddde5fa52db3d63dbee5c99936a974c2f4f45b3d1a5da2c4659560c402f
-
SHA512
174d7901665c9b39fe65e74357fb6149a6acb6581794a56a326439b5e7c132bf1878d15f66817a2f7e0b945a408d06718cc1ff2a5688a9edfbda2442454ed096
-
SSDEEP
6144:Di4CiCJYfhrtA5Vc3/t7oNX0f3PgrB8hnvts:DZP1tA5Au6lW
Malware Config
Signatures
-
GandCrab payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2744-2-0x0000000000400000-0x0000000000492000-memory.dmp family_gandcrab behavioral2/memory/2744-3-0x0000000000660000-0x0000000000677000-memory.dmp family_gandcrab behavioral2/memory/2744-12-0x0000000000400000-0x000000000042C000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jfosahrrunj = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\akudyj.exe\"" 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exedescription ioc process File opened (read-only) \??\S: 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe File opened (read-only) \??\Y: 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe File opened (read-only) \??\Z: 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe File opened (read-only) \??\G: 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe File opened (read-only) \??\J: 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe File opened (read-only) \??\K: 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe File opened (read-only) \??\X: 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe File opened (read-only) \??\I: 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe File opened (read-only) \??\M: 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe File opened (read-only) \??\V: 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe File opened (read-only) \??\H: 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe File opened (read-only) \??\O: 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe File opened (read-only) \??\Q: 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe File opened (read-only) \??\R: 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe File opened (read-only) \??\T: 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe File opened (read-only) \??\A: 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe File opened (read-only) \??\B: 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe File opened (read-only) \??\E: 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe File opened (read-only) \??\U: 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe File opened (read-only) \??\W: 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe File opened (read-only) \??\L: 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe File opened (read-only) \??\N: 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe File opened (read-only) \??\P: 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exepid process 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exedescription pid process target process PID 2744 wrote to memory of 2716 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 2716 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 2716 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 2268 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 2268 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 2268 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 3956 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 3956 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 3956 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 1100 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 1100 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 1100 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 2652 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 2652 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 2652 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 1308 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 1308 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 1308 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 4168 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 4168 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 4168 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 1436 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 1436 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 1436 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 4376 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 4376 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 4376 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 3068 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 3068 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 3068 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 2584 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 2584 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 2584 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 4480 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 4480 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 4480 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 1732 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 1732 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 1732 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 4472 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 4472 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 4472 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 3360 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 3360 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 3360 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 1972 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 1972 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 1972 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 2236 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 2236 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 2236 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 1104 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 1104 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 1104 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 3976 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 3976 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 3976 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 4540 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 4540 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 4540 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 2436 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 2436 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 2436 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe PID 2744 wrote to memory of 4368 2744 6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe nslookup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6a55a41c395a1c2e7726b82ebce8b6aa_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2744-0-0x0000000000620000-0x000000000063B000-memory.dmpFilesize
108KB
-
memory/2744-1-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2744-2-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/2744-3-0x0000000000660000-0x0000000000677000-memory.dmpFilesize
92KB
-
memory/2744-12-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB