cerber | e6455cb52653e906492659ee0624ac089690ea3ad2e91a761746eb9baab47489

Analysis

max time kernel
131s
max time network
132s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe
Size

261KB
MD5

878a47f7dd1e1a6409debe922daaca1a
SHA1

87d2a81c575dc2494fe26e5d883f66155ff4a847
SHA256

e6455cb52653e906492659ee0624ac089690ea3ad2e91a761746eb9baab47489
SHA512

692c790e0487f2af5cf020f03656939a1a3a8b2257b1f0e6ffd8260139a88e5348ccaa11c1d24664480f644d1e412102aadf73614d5bf239ca128a09c1636b4a
SSDEEP

6144:fwHysdQpdJ3hP3GmPDI8GciVatKlzxSWjrXQdUqZ+iuBK:EdQp4mPDSU8II8EiuBK

Score

10^/10

cerber gozi banker discovery evasion persistence ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt

Family

cerber

Ransom Note

C E R B E R R A N S O M W A R E ######################################################################### Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great! You have turned to be a part of a big community #Cerber+Rans0mware. ######################################################################### !!! If you are reading this message it means the software !!! "Cerber Rans0mware" has been removed from your computer. ######################################################################### What is encryption? ------------------- Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. ######################################################################### Everything is clear for me but what should I do? ------------------------------------------------ The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !!! Any attempts to get back your files with the third-party tools can !!! be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. ######################################################################### !!! There are several plain steps to restore your files but if you do !!! not follow them we will not be able to help you, and we will not try !!! since you have read this warning already. ######################################################################### For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: 1. decrypt all your files; 2. work with your documents; 3. view your photos and other media; 4. continue your usual and comfortable work at the computer. If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. ######################################################################### There is a list of temporary addresses to go on your personal page below: _______________________________________________________________________ | | 1. http://52uo5k3t73ypjije.vrid8l.top/EE9C-4C27-5953-006D-FB43 | | 2. http://52uo5k3t73ypjije.hlu8yz.top/EE9C-4C27-5953-006D-FB43 | | 3. http://52uo5k3t73ypjije.xmfru5.top/EE9C-4C27-5953-006D-FB43 | | 4. http://52uo5k3t73ypjije.5b1s82.top/EE9C-4C27-5953-006D-FB43 | | 5. http://52uo5k3t73ypjije.onion.to/EE9C-4C27-5953-006D-FB43 |_______________________________________________________________________ ######################################################################### What should you do with these addresses? ---------------------------------------- If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): 1. take a look at the first address (in this case it is http://52uo5k3t73ypjije.vrid8l.top/EE9C-4C27-5953-006D-FB43); 2. select it with the mouse cursor holding the left mouse button and moving the cursor to the right; 3. release the left mouse button and press the right one; 4. select "Copy" in the appeared menu; 5. run your Internet browser (if you do not know what it is run the Internet Explorer); 6. move the mouse cursor to the address bar of the browser (this is the place where the site address is written); 7. click the right mouse button in the field where the site address is written; 8. select the button "Insert" in the appeared menu; 9. then you will see the address http://52uo5k3t73ypjije.vrid8l.top/EE9C-4C27-5953-006D-FB43 appeared there; 10. press ENTER; 11. the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling. If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: 1. click the left mouse button on the first address (in this case it is http://52uo5k3t73ypjije.vrid8l.top/EE9C-4C27-5953-006D-FB43); 2. in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address. If for some reason the site cannot be opened check the connection to the Internet. ######################################################################### Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: 1. run your Internet browser (if you do not know what it is run the Internet Explorer); 2. enter or copy the address https://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER; 3. wait for the site loading; 4. on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed; 5. run Tor Browser; 6. connect with the button "Connect" (if you use the English version); 7. a normal Internet browser window will be opened after the initialization; 8. type or copy the address ________________________________________________________ | | | http://52uo5k3t73ypjije.onion/EE9C-4C27-5953-006D-FB43 | |________________________________________________________| in this browser address bar; 9. press ENTER; 10. the site should be loaded; if for some reason the site is not loading wait for a moment and try again. If you have any problems during installation or operation of Tor Browser, please, visit https://www.youtube.com/ and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. ######################################################################### Additional information: You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. ######################################################################### Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. ######################################################################### If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. ######################################################################### Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files.

URLs

http://52uo5k3t73ypjije.vrid8l.top/EE9C-4C27-5953-006D-FB43

http://52uo5k3t73ypjije.hlu8yz.top/EE9C-4C27-5953-006D-FB43

http://52uo5k3t73ypjije.xmfru5.top/EE9C-4C27-5953-006D-FB43

http://52uo5k3t73ypjije.5b1s82.top/EE9C-4C27-5953-006D-FB43

http://52uo5k3t73ypjije.onion.to/EE9C-4C27-5953-006D-FB43

http://52uo5k3t73ypjije.onion/EE9C-4C27-5953-006D-FB43

Extracted

Path

C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Cerber Ransomware</title> <style> a { color: #47c; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #333; font-family: "Helvetica Neue", Helvetica, "Segoe UI", Arial, freesans, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; } hr { background-color: #e7e7e7; border: 0 none; border-bottom: 1px solid #c7c7c7; height: 5px; margin: 30px 0; } li { padding: 0 0 7px 7px; } ol { padding-left: 3em; } .container { background-color: #fff; border: 1px solid #c7c7c7; margin: 40px; padding: 40px 40px 20px 40px; } .info, .tor { background-color: #efe; border: 1px solid #bda; display: block; padding: 0px 20px; } .logo { font-size: 12px; font-weight: bold; line-height: 1; margin: 0; } .tor { padding: 10px 0; text-align: center; } .warning { background-color: #f5e7e7; border: 1px solid #ebccd1; color: #a44; display: block; padding: 15px 10px; text-align: center; } </style> </head> <body> <div class="container"> <h3>C E R B E R   R A N S O M W A R E</h3> <hr> Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great!!! You have turned to be a part of a big community #Cerber_Ransomware. <hr> If you are reading this message it means the software "Cerber Rans0mware" has been removed from your computer. <hr> <h3>What is encryption?</h3> Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. <hr> <h3>Everything is clear for me but what should I do?</h3> The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. Any attempts to get back your files with the third-party tools can be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. <hr> There are several plain steps to restore your files but if you do not follow them we will not be able to help you, and we will not try since you have read this warning already. <hr> For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: <ol> <li>decrypt all your files;</li> <li>work with your documents;</li> <li>view your photos and other media;</li> <li>continue your usual and comfortable work at the computer.</li> </ol> If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. <hr> <div class="info"> There is a list of temporary addresses to go on your personal page below: <ol> <li><a href="http://52uo5k3t73ypjije.vrid8l.top/EE9C-4C27-5953-006D-FB43" target="_blank">http://52uo5k3t73ypjije.vrid8l.top/EE9C-4C27-5953-006D-FB43</a></li> <li><a href="http://52uo5k3t73ypjije.hlu8yz.top/EE9C-4C27-5953-006D-FB43" target="_blank">http://52uo5k3t73ypjije.hlu8yz.top/EE9C-4C27-5953-006D-FB43</a></li> <li><a href="http://52uo5k3t73ypjije.xmfru5.top/EE9C-4C27-5953-006D-FB43" target="_blank">http://52uo5k3t73ypjije.xmfru5.top/EE9C-4C27-5953-006D-FB43</a></li> <li><a href="http://52uo5k3t73ypjije.5b1s82.top/EE9C-4C27-5953-006D-FB43" target="_blank">http://52uo5k3t73ypjije.5b1s82.top/EE9C-4C27-5953-006D-FB43</a></li> <li><a href="http://52uo5k3t73ypjije.onion.to/EE9C-4C27-5953-006D-FB43" target="_blank">http://52uo5k3t73ypjije.onion.to/EE9C-4C27-5953-006D-FB43</a></li> </ol> </div> <hr> <h3>What should you do with these addresses?</h3> If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): <ol> <li>take a look at the first address (in this case it is <a href="http://52uo5k3t73ypjije.vrid8l.top/EE9C-4C27-5953-006D-FB43" target="_blank">http://52uo5k3t73ypjije.vrid8l.top/EE9C-4C27-5953-006D-FB43</a>);</li> <li>select it with the mouse cursor holding the left mouse button and moving the cursor to the right;</li> <li>release the left mouse button and press the right one;</li> <li>select "Copy" in the appeared menu;</li> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>move the mouse cursor to the address bar of the browser (this is the place where the site address is written);</li> <li>click the right mouse button in the field where the site address is written;</li> <li>select the button "Insert" in the appeared menu;</li> <li>then you will see the address <a href="http://52uo5k3t73ypjije.vrid8l.top/EE9C-4C27-5953-006D-FB43" target="_blank">http://52uo5k3t73ypjije.vrid8l.top/EE9C-4C27-5953-006D-FB43</a> appeared there;</li> <li>press ENTER;</li> <li>the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: <ol> <li>click the left mouse button on the first address (in this case it is <a href="http://52uo5k3t73ypjije.vrid8l.top/EE9C-4C27-5953-006D-FB43" target="_blank">http://52uo5k3t73ypjije.vrid8l.top/EE9C-4C27-5953-006D-FB43</a>);</li> <li>in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet. <hr> Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: <ol> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>enter or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loading;</li> <li>on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>run Tor Browser;</li> <li>connect with the button "Connect" (if you use the English version);</li> <li>a normal Internet browser window will be opened after the initialization;</li> <li>type or copy the address http://52uo5k3t73ypjije.onion/EE9C-4C27-5953-006D-FB43 in this browser address bar;</li> <li>press ENTER;</li> <li>the site should be loaded; if for some reason the site is not loading wait for a moment and try again.</li> </ol> If you have any problems during installation or operation of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=install+tor+browser+windows" target="_blank">https://www.youtube.com/</a> and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. <hr> <h3>Additional information:</h3> You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. <hr> Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. <hr> If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. <hr> Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files. </div> </body> </html>

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber
Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\\TapiUnattend.exe\""	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\\TapiUnattend.exe\""	TapiUnattend.exe

Contacts a large (522) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Deletes itself 1 IoCs

pid	Process
2452	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\TapiUnattend.lnk	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\TapiUnattend.lnk	TapiUnattend.exe

Executes dropped EXE 4 IoCs

pid	Process
2572	TapiUnattend.exe
768	TapiUnattend.exe
1544	TapiUnattend.exe
1532	TapiUnattend.exe

Loads dropped DLL 7 IoCs

pid	Process
2392	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe
2392	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe
2648	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe
2572	TapiUnattend.exe
2572	TapiUnattend.exe
1544	TapiUnattend.exe
1544	TapiUnattend.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\TapiUnattend = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\\TapiUnattend.exe\""	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\TapiUnattend = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\\TapiUnattend.exe\""	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\TapiUnattend = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\\TapiUnattend.exe\""	TapiUnattend.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\TapiUnattend = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\\TapiUnattend.exe\""	TapiUnattend.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TapiUnattend.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ipinfo.io

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\barrow	TapiUnattend.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp992.bmp"	TapiUnattend.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2392 set thread context of 2648	2392	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe	28
PID 2572 set thread context of 768	2572	TapiUnattend.exe	35
PID 1544 set thread context of 1532	1544	TapiUnattend.exe	40

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\piscators	TapiUnattend.exe
File opened for modification	C:\Windows\reassurers	TapiUnattend.exe
File opened for modification	C:\Windows\piscators	TapiUnattend.exe
File opened for modification	C:\Windows\reassurers	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe
File opened for modification	C:\Windows\piscators	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe
File opened for modification	C:\Windows\reassurers	TapiUnattend.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0006000000016c7c-59.dat	nsis_installer_1
behavioral1/files/0x0006000000016c7c-59.dat	nsis_installer_2

Kills process with taskkill 2 IoCs

evasion

pid	Process
2788	taskkill.exe
1608	taskkill.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\\TapiUnattend.exe\""	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop	TapiUnattend.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\\TapiUnattend.exe\""	TapiUnattend.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000997a72849858b54b85d20329605d4dd3000000000200000000001066000000010000200000007b6dd225a8e5c9490a7c060aab3fe2f1b5bdc24debac000c570932df5f3f2f1c000000000e8000000002000020000000987a6156b6c952a66b0c48bb456fe79c83d3c179e65833d16991256c2742d01890000000cbf835206b7a255cbdd6b00d53c19b290fac8b423cd6b89fb0372856b36425327d8eee0b0bc6aa23aee55535574bf2e43a5a94b3a2950e2dc215661937ae3bcaaad56e197ef0214b119dd03f3a51f06a85c9f95c58200ac1e20e1456e9a672fd603f9ae77c0af05704f853f3b3d388c39b09bfc0633f3adee917b9cf392deb207a2afe6a32b5cdedcb779bcd6a65000140000000d84b5623aff90c8fd39ad92eb987b33d096a30aaed643c90eb53835d757dc268820808ddcfa2c83c6ed149e10b141dbc34f6f5020fbef1e81060292808c4dac9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a09d7c8972b3da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C6B6E681-1F65-11EF-B69B-6AA5205CD920} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423332613"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C6C2CD61-1F65-11EF-B69B-6AA5205CD920} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000997a72849858b54b85d20329605d4dd30000000002000000000010660000000100002000000097a87fcf07d4c0472a165e274cf3fbf888cee6f6c65b461257d259aca96926e1000000000e8000000002000020000000ee2e8c5c8bfd3c23bf5d98f0c48ff0e814b8ff468d20c67774ece4601d1bf9cd20000000943983d09eeabee53729223dfc43623447ce8b0f7c15c4fe5df48b93a4a567da4000000073023733b020cf17c0dfa7eb607fc24ab0f8fec4cb075eedefb1929b407306efe3f4bbff27dfd2a24228a8660f85923b3494d966dcaf443428988f4ef0abab75	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2148	PING.EXE
452	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe
768	TapiUnattend.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2648	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe
Token: SeDebugPrivilege	2788	taskkill.exe
Token: SeDebugPrivilege	768	TapiUnattend.exe
Token: SeDebugPrivilege	1532	TapiUnattend.exe
Token: SeDebugPrivilege	1608	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1088	iexplore.exe
1088	iexplore.exe
2264	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1088	iexplore.exe
1088	iexplore.exe
1088	iexplore.exe
1088	iexplore.exe
1640	IEXPLORE.EXE
1640	IEXPLORE.EXE
2264	iexplore.exe
2264	iexplore.exe
1100	IEXPLORE.EXE
1100	IEXPLORE.EXE
1536	IEXPLORE.EXE
1536	IEXPLORE.EXE
1100	IEXPLORE.EXE
1100	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2648	2392	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe	28
PID 2392 wrote to memory of 2648	2392	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe	28
PID 2392 wrote to memory of 2648	2392	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe	28
PID 2392 wrote to memory of 2648	2392	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe	28
PID 2392 wrote to memory of 2648	2392	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe	28
PID 2392 wrote to memory of 2648	2392	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe	28
PID 2392 wrote to memory of 2648	2392	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe	28
PID 2392 wrote to memory of 2648	2392	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe	28
PID 2392 wrote to memory of 2648	2392	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe	28
PID 2392 wrote to memory of 2648	2392	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe	28
PID 2648 wrote to memory of 2572	2648	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe	29
PID 2648 wrote to memory of 2572	2648	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe	29
PID 2648 wrote to memory of 2572	2648	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe	29
PID 2648 wrote to memory of 2572	2648	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe	29
PID 2648 wrote to memory of 2452	2648	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe	30
PID 2648 wrote to memory of 2452	2648	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe	30
PID 2648 wrote to memory of 2452	2648	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe	30
PID 2648 wrote to memory of 2452	2648	878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe	30
PID 2452 wrote to memory of 2788	2452	cmd.exe	32
PID 2452 wrote to memory of 2788	2452	cmd.exe	32
PID 2452 wrote to memory of 2788	2452	cmd.exe	32
PID 2452 wrote to memory of 2788	2452	cmd.exe	32
PID 2452 wrote to memory of 2148	2452	cmd.exe	34
PID 2452 wrote to memory of 2148	2452	cmd.exe	34
PID 2452 wrote to memory of 2148	2452	cmd.exe	34
PID 2452 wrote to memory of 2148	2452	cmd.exe	34
PID 2572 wrote to memory of 768	2572	TapiUnattend.exe	35
PID 2572 wrote to memory of 768	2572	TapiUnattend.exe	35
PID 2572 wrote to memory of 768	2572	TapiUnattend.exe	35
PID 2572 wrote to memory of 768	2572	TapiUnattend.exe	35
PID 2572 wrote to memory of 768	2572	TapiUnattend.exe	35
PID 2572 wrote to memory of 768	2572	TapiUnattend.exe	35
PID 2572 wrote to memory of 768	2572	TapiUnattend.exe	35
PID 2572 wrote to memory of 768	2572	TapiUnattend.exe	35
PID 2572 wrote to memory of 768	2572	TapiUnattend.exe	35
PID 2572 wrote to memory of 768	2572	TapiUnattend.exe	35
PID 1600 wrote to memory of 1544	1600	taskeng.exe	39
PID 1600 wrote to memory of 1544	1600	taskeng.exe	39
PID 1600 wrote to memory of 1544	1600	taskeng.exe	39
PID 1600 wrote to memory of 1544	1600	taskeng.exe	39
PID 1544 wrote to memory of 1532	1544	TapiUnattend.exe	40
PID 1544 wrote to memory of 1532	1544	TapiUnattend.exe	40
PID 1544 wrote to memory of 1532	1544	TapiUnattend.exe	40
PID 1544 wrote to memory of 1532	1544	TapiUnattend.exe	40
PID 1544 wrote to memory of 1532	1544	TapiUnattend.exe	40
PID 1544 wrote to memory of 1532	1544	TapiUnattend.exe	40
PID 1544 wrote to memory of 1532	1544	TapiUnattend.exe	40
PID 1544 wrote to memory of 1532	1544	TapiUnattend.exe	40
PID 1544 wrote to memory of 1532	1544	TapiUnattend.exe	40
PID 1544 wrote to memory of 1532	1544	TapiUnattend.exe	40
PID 768 wrote to memory of 1088	768	TapiUnattend.exe	43
PID 768 wrote to memory of 1088	768	TapiUnattend.exe	43
PID 768 wrote to memory of 1088	768	TapiUnattend.exe	43
PID 768 wrote to memory of 1088	768	TapiUnattend.exe	43
PID 768 wrote to memory of 556	768	TapiUnattend.exe	44
PID 768 wrote to memory of 556	768	TapiUnattend.exe	44
PID 768 wrote to memory of 556	768	TapiUnattend.exe	44
PID 768 wrote to memory of 556	768	TapiUnattend.exe	44
PID 1088 wrote to memory of 1640	1088	iexplore.exe	45
PID 1088 wrote to memory of 1640	1088	iexplore.exe	45
PID 1088 wrote to memory of 1640	1088	iexplore.exe	45
PID 1088 wrote to memory of 1640	1088	iexplore.exe	45
PID 1088 wrote to memory of 1100	1088	iexplore.exe	47
PID 1088 wrote to memory of 1100	1088	iexplore.exe	47

C:\Users\Admin\AppData\Local\Temp\878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Users\Admin\AppData\Local\Temp\878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe"
  2⤵
  - Adds policy Run key to start application
  - Drops startup file
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies Control Panel
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Users\Admin\AppData\Roaming\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\TapiUnattend.exe
    "C:\Users\Admin\AppData\Roaming\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\TapiUnattend.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Users\Admin\AppData\Roaming\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\TapiUnattend.exe
      "C:\Users\Admin\AppData\Roaming\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\TapiUnattend.exe"
      4⤵
      Adds policy Run key to start application
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Checks whether UAC is enabled
      Sets desktop wallpaper using registry
      Modifies Control Panel
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:768
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1088
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1088 CREDAT:275457 /prefetch:2
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1640
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1088 CREDAT:537601 /prefetch:2
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1100
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt
        5⤵
        
        PID:556
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"
        5⤵
        
        PID:660
    - - C:\Windows\system32\cmd.exe
        
        /d /c taskkill /t /f /im "TapiUnattend.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\TapiUnattend.exe" > NUL
        5⤵
        
        PID:2420
      - C:\Windows\system32\taskkill.exe
        
        taskkill /t /f /im "TapiUnattend.exe"
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1608
      - C:\Windows\system32\PING.EXE
        
        ping -n 1 127.0.0.1
        6⤵
        Runs ping.exe
        
        PID:452
- - C:\Windows\SysWOW64\cmd.exe
    /d /c taskkill /t /f /im "878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe" > NUL
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:2452
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /t /f /im "878a47f7dd1e1a6409debe922daaca1a_JaffaCakes118.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2788
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2148

C:\Windows\system32\taskeng.exe
taskeng.exe {E7599CA0-4E8B-4374-A924-1AC605B6B7FC} S-1-5-21-3627615824-4061627003-3019543961-1000:SCFGBRBT\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Users\Admin\AppData\Roaming\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\TapiUnattend.exe
  C:\Users\Admin\AppData\Roaming\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\TapiUnattend.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Users\Admin\AppData\Roaming\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\TapiUnattend.exe
    C:\Users\Admin\AppData\Roaming\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\TapiUnattend.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1532

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2264
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2264 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1536

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
1⤵
PID:1400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt

Filesize
10KB

MD5
c95446e027172bbb4ac68be1dd4f4e18

SHA1
c536298a01a0b8be0cb31ea443082d6c882bb084

SHA256
6e6aa94ff33f784d6f72bf21a8afa8f3908362127d10db6836627e88503d6fec

SHA512
694b9fa2f68f4b4588b2dc07743b5b90e86ff7da82880615d521635590ddbed3c36bc9f9addc4ea355a36f349fa551c23fcb40e81ad0018f74bf150277083b9e

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.url

Filesize
90B

MD5
790e3b4f1497c144fc4e61fd6666dcb6

SHA1
7cf11e40c5b772443162e32d2193179ddde4c921

SHA256
a83c316e6012996aabb2102e4c168f07d7a26303914fc32b1768d7df3aeeea19

SHA512
7c84f6c9de8f3d752bb0a89460798e95d7414b135fb968407823071dab16fd34be8fdff3bfb1b1cbd44ad7c074d8f5dc3182894a6bcc8c6ddb947e9f28167dde

Download Submit
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html

Filesize
12KB

MD5
19eaa367316faafecb8f83fd837f2f66

SHA1
b3a3ee0cd20f4d319ee83be06abc3e72f5bbbe02

SHA256
50fe44086e15ed74c021336caabe7acadbcbae3fc8008da0f16217d306f6a3e8

SHA512
9465a8b1574ecce9480473786518ba6d07ce1ba3955eb0390a45294766066f09d405d733104a2f7462d9deef9c531b67cdd55d2d735a4bfaac8f97b19fe0df83

Download Submit
C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.vbs

Filesize
234B

MD5
6f84dbf74ef41dc3d861f5fb3e0f45ff

SHA1
3e5f17e9b9589f33ce6add7f2518a666ff2253a4

SHA256
df5f432d7e0d2bd1c4dddb1fabbf1e77bd1065b9020f71abaf1a45fbb950bbb8

SHA512
9f9ec25b815be7b20df26244d31848c9a4896b130241b63636d63511a290eaad78d289a9bb04592c0ba31492064671351b4c7359310f03469e27764132a20a5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
25a6b9f9e066ee99d56d75033ceacd10

SHA1
0a7aa7ab7b579e15424eb3521e5cad6e1ee791fd

SHA256
a93f4e8ccd0e7fe99607c6b367307f09e841f0ac668564e3de3ae67b751f24d7

SHA512
07f874d6223c999f8d7e905fbda7a7fef4e7f646939ef170cabec83301d624243f1daf2cc949b3c81157d6cb92bb8d86a0f5e1564c49db3b9689156e2a75148c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1a771bdb7c9150e9f45e81e852e6193

SHA1
524147776da52ea6e9626c850b4f2bc813c66112

SHA256
4058f00454bf90650578488fd3d95f8ee3aa3423853618100c6aabb2fc3b983d

SHA512
4fbef0440e7533e70c5f728f8ac6a2b75a12a29fef5a98e2780d5fbfdebb74d470334b46d7ae46afcd0b432fab934faa92131302c074a6497a8309fd3e924853

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac1a1d79ca831fcc48e5092d19320e69

SHA1
146cbb61691fb72c1d3ce5b74766a3af0c78bd1a

SHA256
c9b3b526eedcaa8f87133e506fbfe1c27c5109e4febad499af2527b65fa944ef

SHA512
efff922ce2b3ec7116541e55bd75c3786b17d0caa8977017c5625aeec335be16e8105ce4d86ef94215c5252fe5fd8f0c99aa6b7211d444561fdf2c0ea17e3965

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5243618b66df1cd43d6e75147750bb7b

SHA1
6973007dbdbc54997eab977cc255510c53a5c32c

SHA256
add0bd6636eefe11b5fdbeb14cdeb9b1c835cd9b288bc9a2a5bb05be17899b40

SHA512
2c92ad0bc501379e0f2debeedd06bb64a9a6fe6803f11cb48fc789ae809af06c045fa6dfcb07599bb8575cb5196756fd207c39ec9f9f6cc27927d0e59d0fa480

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35e4db9078447dfa3a1de7ef5bfb72d6

SHA1
f9b56bc0b9aa24ce709c39365544cd06cdacf0e8

SHA256
22c46b585118ea1ecc9c9fad0fee239e9da0ead1db76e2de89f243b6d1dc0d54

SHA512
8a689aa4a212ceab14cd640bbb4ba2827b30a18f7a096e8c0710898c7da13b09549174d13a873bdfd53adcd3e681f0b8409f1504135b9930d3f840758f67e7a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de85b3b36cfc44d609ccd759282a7468

SHA1
0615626a63758da41111a1d2dae83acdc6389aac

SHA256
fb96b8a4d018ec073a2164f37d8b27543c3682b91c763029977f4091d3b48ff5

SHA512
94745af56400dcf43d5f5c45226905e775c9860c584d850e6ac7c42a399d7c96b41998825d7037515f19cbff0fa95e66c2791f815eb5997477dd7ed29f90de90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23ae85666f23519d7fbe30c50187e04d

SHA1
0418531a7428733fcfb1e161030ae3e74316aeb8

SHA256
5cfd8cdcc262d94810eddc992ff51696ab660884339ba6f630e803e61d21d290

SHA512
0658b3b5499e86618df3210866e257bcd2c7ddd24b3caa7dafcad390a0a783ccda89c43f09686b30313386d7a4c37e2757e88445f18c84ab10d55ea1ba61d31f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d2cc2b97cc96de6b7de8c2abbd217d7

SHA1
5482a4bdb045fbbdac76cac5d47e8830995aa220

SHA256
2f23a191e53cff173a8ca5b1cadaaba6970d74d698472c5083e625fea5d2b841

SHA512
45c57cb063cdac9335ec563ffd0e7b6508ffcabe62faf9ceb0ec4eb0a9945629886b209822f17cc3b93ccb32e5b38494eb51ae879ec25445d03f05c27bf40dd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f14c1cdde3a54582f7d06f8170f1d4f7

SHA1
dd27a2ce10fb91ceac2421b663fa7d3d93b34ef4

SHA256
7f489a6f1dd3716e67a6b52617d4b35241713625e110afa3bfa8bb799c0c83c1

SHA512
29d80b9c36a835a10f7800dc04c739f46711cf11624bf3b76c0adffb5e44739904a9f69008a86a506881387dae99887beb3edfc0768a05cf750ccde74997ee1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6944bd0d817c9702724728fc3ca99be4

SHA1
d92e5a5b9069a3b4d52421449b0efc39c76cca95

SHA256
da4d16e4e530a379b0f0c2278b431b88a806b5d2c73b54e2698fa39bf390ef18

SHA512
94412c04d28d995fd393348b0a4fc4ba5208c3ddc8941e7a62e8ed39cd7b2f0a4795c7d397389ae6826921d6bc3481160f8bbaba935595387e49ac2fdd742a79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
909d17b74bf30e64e07969c1fc5d987f

SHA1
a4f813538fd44584f591fc149192b56df9696f5f

SHA256
ff316ef48559f83e3bda6dcf6029907ac05df161053c9ccaff878eecedc21001

SHA512
b1cd76c97ee67671508d8fb81d86a285d3735c20d33343f73759b131aa23a1218d20317bbb3422ee4fcd5eaeb41602394234c7891ba5f7902a6c115b5227d40c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5258f96628d9927ea6f2f2a3ca0dc184

SHA1
c759f92cadd656e8386d47795956b005a005c316

SHA256
79b943bf0fa4ed2e775715d3fb66ae01f62d4fab6f75967679e563b3da8abbb3

SHA512
014ddc0991166110117a44fb0e2fde48e0c335ce0d02d70172eae25c319ffd52b510cf03d357e07aff5631c2e9b20dbe8242a61694852ff9997973f8cbd75135

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da2cb5fde3499c01b5aa6ad6d82b1b83

SHA1
7939bf7d76b6f5f3aa69e17a77814213ea97a48a

SHA256
a75f24c48f08a52e253a1cb0485a68ace20a0772bf238a25b6116acf160ce7f4

SHA512
d65ef69931eea4bd526deb2ad41b34a273514f9175ea1e647a13047aeb52bf0a735894011b9be8c34ba589cb3b03ade5d7f2a32ca40c117fe1d91c209a92dcc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16ed4793cacee8fe5d7ccaa5154ca620

SHA1
4a04d3b7d5b2ee39e292cdba6ea1fd0068f2c599

SHA256
5bb55dc48bc32fb4b306fbe45b1ba145ca133929c50f0893b707ed2882419503

SHA512
c0d3700eafd3d60c53a188b9a37caa34dcb707bd29fc5f139711a5ff7882970c784311446f66ff1e2ef946d080e3b424d3ea032fa24202444a2cdac38a9a6b89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76aa1de891f9cbc960c7830cd597161b

SHA1
8a55ad665e3454e74c6875f7903746c5a090ef37

SHA256
522f5b3bd41ac3a5815d66ba7cb8dd3249df7f61147685203356ba704fea9784

SHA512
fc200050a125c07781a6fbcfac9e8bf30f81613820fb61c5f482b8a99134388fc753fca0fe53c25de34e9e770826cb2117000089869517017d31bd1f9596d602

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ca7e756dd8233a208a0b0d43b8ba734

SHA1
158e7cc8ed9d78f22aa56f52dc5a30a1d56cb709

SHA256
09e204f33a283f4bd902b590847ef58194b9838098bd5c0efe546cbf77b2a1e0

SHA512
bc3fc11451e2cacb18b254b7b2df201647a0147ac399140044deeb993e56338cad23d8860ffde8053d1006443ead40887b2fb40972b7b8d704e913d627b755f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf213aa80acfc29df1d959ff53526404

SHA1
ecdfedce2b4e64edcd20a17f82f0d0a54327aecb

SHA256
bdd5dadc42554106f16bdd67e236b1c7f304dcf74730d01e8be5a5e4fcbe3b06

SHA512
181fd1e0870e59fb7facfedb768dcadb4833c87ca8f5a20e2a3392897b0588b3f3906385a21843ca54ab36958a8e82065fdf9ce8e5b6bf7dc863f3da3ee61b7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d786a630556c553854bca0b395bdfcb9

SHA1
e95110c4be039fae2fad9add4d906e6fb48240e2

SHA256
c07bbc72c2b84e71dd50cfe11fdae3a67cfe8a90e7deeac38fb05bf90903332c

SHA512
b3901965fee2ba185ab132c5f5a863aefa6b05bebfbece383d6c486f57da00c2c3d1aaa9bf9c1e74ac841704ac3e971e2265d04774e3b5889dcf08ce0102718b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9667dc5041f23a117970099424fcf4bf

SHA1
94a77907f0627e0d01a5adfb984628baea6b4787

SHA256
c0301bee1234dfee9dcd9d84e8467463174ae08b1ab32ff8a84a5d6b6bee29d5

SHA512
76017da9739922e18664a8c0e4e3f05643e5e0aaf0cf537af72713e0a351e54428d52a0782a262bae7e0c9d1f073442161ab7ead1228890928ea935a69cb4981

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38a01cb032236803d502734ee3f85341

SHA1
a77e8a1a77f994253e6c1481948bc823795b5d6a

SHA256
9160e1e84566639ffd26427048692ede3d0813427804dfb6d26e65966ff77b73

SHA512
1470082b782892dc05dd0a1cfa7e911db72ceb1af42449179714b7e81445726d5025fec14c869cea51ee733742e44efdffadc2aed66b7f1ce52be187c25d1e8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae69faa41c3bf884bb2186d553ef5137

SHA1
2f3699fe715b332a6d2a3469d3aebfd8a5a0c321

SHA256
8d3fa2ae1a650963d81cec90f149c7420bc6ff3af7c9fea156c819a33e9614a4

SHA512
d9a350e42de0cc3d532c1f6c1aba8ab3aec4b0309e472555bf13a48cbb521a3b2063980c05f493f318827745702fc6a9bf13fbc3705b0fda5167832e8092f322

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
47839ed87a84aa3f429627de3d90d8e9

SHA1
5d25ee38ca02120c99e24ef6b61e7362026a0a45

SHA256
6122866a5e610423f15fb1ef579486808257e88f819a4994867f8649cd978433

SHA512
00f38032c7260413ba9581e5ed01c4e1ad054470c7557cf8d6cb59aa6d991dfa992a0b42255ea125d588937e62d1c357b70647c8049fd5b76a7c2724600b4d45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2340.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\20-fix-globaladvance.conf

Filesize
912B

MD5
fbad2da072b8609477d89a59a167705a

SHA1
6abf7a770a5a46e0e4a463e03b6477a2aedd2df9

SHA256
5930f65c5864754bdeea36362beb91f2756b46504508f1d381cb49784f52880f

SHA512
2bda5a262a2832a17ba9d4ffc4aa4e8c4e45d46a877d2cb8702224f9d8904a1916fc2dea4a45e7ebec86d2adfc09609cc1860df5bcbf9680b19f78026b421e5b

Download Submit
C:\Users\Admin\AppData\Roaming\401-5.htm

Filesize
1KB

MD5
431b67e464486add8912ba19ba8dba03

SHA1
1e19d1844548c0aed8d9723dca02de0e500e7f4c

SHA256
a8b19979f9011710e1a839690d109188eba8d4ba9890efcb1333b056bf0f831f

SHA512
b2fc415ad7255f24a06c1f345edff3bb2059b4328f2a7f5cf78e6592baa59aaa88af7b0da533e0a59b4b58761b5bba07d7c0ee9cdec31af0df20e1fb28e3d9ff

Download Submit
C:\Users\Admin\AppData\Roaming\BCY green 3.ADO

Filesize
524B

MD5
9a26cb6467c4c9ebb9113925df963ccd

SHA1
ac5b505c30092191be86b79c5a09d87cdc6a9ca7

SHA256
c9024465c4c4131a62e0c557453f9bd55ac79afc96e0ee8cf1138cbb0113056e

SHA512
b248ddd375838ef0e4e07864d0f39a66c48e814bd54ec350664d0da84edee9e5e00b97b03769f36bd75659f53e4991aa42b73c479c328d1624b7d548db3b1a09

Download Submit
C:\Users\Admin\AppData\Roaming\Banjul

Filesize
77B

MD5
d8bf90c6c458e81d3fb17371cc1ab80e

SHA1
39843cd866b512e8dd4764c299068f025d2b96ff

SHA256
18eba9d5e645204556fd02348e43728a82ab429ee4580fea323475d4ed021b19

SHA512
1d688c68157b370ebdc3dfbdec6a11e38084b2df2f27fd706053a35ce466d841d7091ba7fe3d6cdedcf6222105ebfda225ac216d056e35086af173a1531f848d

Download Submit
C:\Users\Admin\AppData\Roaming\Bl normal CG9 CG2.ADO

Filesize
524B

MD5
78a7847d2199fe20f20b9f74bc0da3e6

SHA1
22b536f65a15481f41a2a4da715e608f7d6adb2a

SHA256
137e25e3018879d470db96c595164e5c8e0833b68a0a3e81042a3fd95da4ae71

SHA512
c886d510c6452204e610b22acc98fe618e2cd1357f3a942cb8a1a818bb3374cfb43808831c97152be038bcb6dbbb0bfaa45a96ebc2f3230b3d2c78eee1854dc2

Download Submit
C:\Users\Admin\AppData\Roaming\ExampleXML2FO.java

Filesize
3KB

MD5
7cd4291588c932a60b8db4ca8d336b9c

SHA1
f5716cbcae64d72dcc622418587b125b832e943d

SHA256
9e51838001368de751bd0ab37da350d5d0d6f50016f6271807c0ee9be55ddf21

SHA512
d4bdb75c0dfdee9d39eecbce8a7f43895fb2031fa49c16567977821065fc7d5edf737c0dc8f3a91ee4a3d22b89ae7bb6b38c15f6b0238b956e5aa95098d0d290

Download Submit
C:\Users\Admin\AppData\Roaming\GBK-EUC-V

Filesize
3KB

MD5
f7d4e3604733bccfc64a2cc3dfd4366b

SHA1
6d5d2e02a35238637cebc8854046859e9e3e3f3a

SHA256
852f2d823b856778c7386b884d467e8e19bfe8d677c042c54a078221ab5bf50c

SHA512
1d6d2dda9255fee9f338b31976b3b84976e713c2bd6b779e9f725d12d82d1068585b066d448c727cb95e72949f51577a76e623878dcf07f763f1ddb50d2c26ce

Download Submit
C:\Users\Admin\AppData\Roaming\GMT-4

Filesize
27B

MD5
4bc6b6291a5e77acb663283b05cdbb02

SHA1
6ebebc4883fd74246e5f39d211a51d6ffe21e7b4

SHA256
bd6b0557cdab100425a5d39783174e7ae4134cc59ebe6dd3ee837944eb76381e

SHA512
ed98d7547a5aa0506253fd7f37c39ad323a57b8ff184ee7a88fd0031dcc210c91bb5c1c0266b5b528568425206dfd49faadd693ff8c61cd84023a18766fba335

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\TapiUnattend.lnk

Filesize
1KB

MD5
6007987b66f807f9b18bb6b070416102

SHA1
6438bb9d7144d54acbe00c02ae1927e39a09b21a

SHA256
28fb28b627e0f763c84a60fcb2b8cfa33143e9ae79218361fb0f0dc5b2c39281

SHA512
7f4efb897972f170419262a2cdef590e2d0d2657d2250d6a35a04a23b3f82f81aba04b2d512df4c95b118f3c41a58670de8e3786dd27855ecca6e69afd79d595

Download Submit
C:\Users\Admin\AppData\Roaming\Secondo.HS8

Filesize
128KB

MD5
93d90330e7eae33291fe3a1f0a0acbf6

SHA1
6650c43e8584eeec15fdc3d683dbe1b0a85d6718

SHA256
caf1bd22f50cd080edce1fc6e56b115242a0fed02defe89070cb89f85526573e

SHA512
0e9b41234e44976fec2c10c10b2bc03d5d20f52a549be6c9b446da9b3864aa4641ad0cfcb3ff89497a441974a4e56f3fe137de0ffc8784d36f6dfc40292224c4

Download Submit
C:\Users\Admin\AppData\Roaming\VerbidCollimator.y

Filesize
5KB

MD5
ef1f8418db7f8f4a081c2296c8ffa749

SHA1
22e98eb6b2a434479757e15c458c0a640ef12865

SHA256
3dedfa73ae9aa3c9514d47f1521fe122a1132ed471de12abeba2b7077c506571

SHA512
e46ac922d61e5f8f162a6567c7ef3c9b5b655de147be5848bf576d406edfd7bb1ea97a5bfae4e8ef423b67d97d99b847b98dcc078055a3f9a0debfd693339ef1

Download Submit
C:\Users\Admin\AppData\Roaming\add_licenses.png

Filesize
1KB

MD5
e8a2b07854032ed884e15558d45cf227

SHA1
733914f98c81adb9ca0e0c5e90a264e446c7308a

SHA256
441d8eac3139cc3d28d7f3ca5f8412a99f0ef37466d1d578abfdc315b4840d7e

SHA512
d13ea83232a9d76049e9b79ba70bea422e51fd113505082da81044d6ebfa10c1b4510507b960f2b6d4c66f82a819c586416645e5fc4171ae2d08b24a7bff3391

Download Submit
C:\Users\Admin\AppData\Roaming\additional_tools_drivers_downloads_icon.png

Filesize
3KB

MD5
fcf5ffa7dc5b1c6a15080c471b0af12c

SHA1
1ffbbf1cb9f7693c8885bb3c49c131b2f28fafd6

SHA256
b38509363359adc76bfa7ec26d925da303afd53bda018550d1f73694a76dd4f1

SHA512
bcf14e77543d05de9635ea8a53b029df4dc504770ea79bcab535e19df14416699721e16f30a62312f34929ca75a06e8838b6e7516e087b7db6da48e898860983

Download Submit
C:\Users\Admin\AppData\Roaming\annot-open.png

Filesize
837B

MD5
8961808067af5253f333cdf0c8139004

SHA1
29adf64660e293b41583decab8a05df8edc93740

SHA256
96108677136e482951437c3b41e0f6aec42526cb065b8654ef5b81343f788be9

SHA512
ef88d7aa922ff6ce6b75f87c4b380a861db60dce94c4b0b958f5fdcd6685739a3a49ba5ff574a6df9e1f6673cd1d4b615a6327834dd53e25658e1c1e76be9c92

Download Submit
C:\Users\Admin\AppData\Roaming\archive_inactive_unhovered.png

Filesize
2KB

MD5
2706a9691f646f678220600f5a3da66d

SHA1
18aca6b122fb4eeb132ff80378a3ebc5c7e76acb

SHA256
5709aef07360ffe1cc827e1f77d0c23d5eb97d5f328ac8293911aa888dcf4ba0

SHA512
8263f29d2dc33e2060c8c4b5ca34abff26a3c79c08e019f9b3eb3d8cc6504f26786a65ea20ae968ae5f42dda9c6a446a4394ca0886003c50bfc068b9009609b6

Download Submit
C:\Users\Admin\AppData\Roaming\arrow_right.png

Filesize
4KB

MD5
173e366fffd028392021ec476d4f9698

SHA1
997275beeaca6e1faad125a7ec1b966d23cf8d3c

SHA256
96c6c0233623cdf2993bfec1641e2374d5d83af2090fda8c20e41af7b94cec45

SHA512
d06ac9de5b67395c6eb10b9d498d526e4c5d7a031dfce2a2c1b203fb73d750e1b4fb55c556af391810c0c996fa1e8a44029fea0e6f5396b2b9249a667c6c4aca

Download Submit
C:\Users\Admin\AppData\Roaming\brt.fca

Filesize
4KB

MD5
0ed71cc470bac3c2175010c85ce17f01

SHA1
e3596b38a653f92d3a83e6398575d72df8e6ab55

SHA256
b571de53b04684fdb90a3686ffaac3b301e58c5070467da60de59e14820579bd

SHA512
1f6f0d351e27426759e97b4335d5b0064f3e4d1148cb3e2cef40dec81050fe7ce81ae1b5afe7ef9db09b084a4166905fb8f48da95150e0139333358e01f1f632

Download Submit
C:\Users\Admin\AppData\Roaming\buckoes.qfv

Filesize
64KB

MD5
b2b80f40e73df9d5f7400e6b0820dc46

SHA1
dd5695e83a88c7a02c023a96f06102052e0e6f18

SHA256
d5304a90b2058ce143957c8d1a9ebcb7e3638d2da35a5e8a87a0d0d5105cf795

SHA512
eda9a817bc75c90137c6b8d4f4dea58f9973ec80a16ca2510628441eceabdc4d70daaef0a260346899866c6061b4702e6cc017ad720aa7dc048c00d12359f1c6

Download Submit
C:\Users\Admin\AppData\Roaming\chunk.toc.xml

Filesize
1017B

MD5
d676d37a6291b4f2c52a9c009646b249

SHA1
e9cc72d677d255c9a931704ceac14f06dae9c670

SHA256
8c2b119b31c6ab582ef93f9f3788f149fdb59a56ba428bbaec05f9640de5b43c

SHA512
0fd48ecf86eece84371a6aaeaa4f7a30e7cb5c2e17a182b802ec59c24f46da8309584b8c69a118ebf91be50f6dccbbc393c0ccbda9a16ecce6482cdc9d94c019

Download Submit
C:\Users\Admin\AppData\Roaming\citerefentry.link.xml

Filesize
1KB

MD5
f5318e3b3e9ea56e31cbb672cfa327d8

SHA1
bcd6758368b4583bf80066bc1284f5a96e558efe

SHA256
e0f55229bebe71a2b94cdfb33060a28347ca69ee7480fb42bec2f2edfa464e1f

SHA512
0735d6e8fe1f0aa1e8504a5ecf86c7f576f5a3c47388f895fbd82ada7d9a5b3abbed748f33f29aa6583ddde52a9f80465a12e1586a29a94205b4475ce476873e

Download Submit
C:\Users\Admin\AppData\Roaming\component.xml

Filesize
691B

MD5
137d64c837e42916568685e05be6ca27

SHA1
3cc124359aa623bc4ca2511805e8f8e1f9fe5ff5

SHA256
f9aa7c2759c4fc6b67add7710d6fa40750c2cf131fb576bad7c8f7fb008fa78a

SHA512
8a8144c82b27163e3aba9fa5400f7eb7a4088c3822aa010bc6a8869ab1daf9a98d2ad483ff0f32727d8251ee23bd062a56f616b1f7cac98f79c0190b6abfdfa6

Download Submit
C:\Users\Admin\AppData\Roaming\computer_diagnostics.png

Filesize
3KB

MD5
bd8078dcc074aaebdc63ba53082e75c2

SHA1
a3887f75154e5de9921871a82fe3d6e33b7b5ba7

SHA256
9e35270e3510c195a64635292dfcc6dc508e93dcb5715c3e30cf3ec15af6951e

SHA512
9a0b6c67c52ba0a0c9175a62680e9e35793676e4e06dfc6b5bafbff3b50474c94c5434e700d19eff4c46ee84ef0a424e850a3e7fd78d6f62d1d19912a8a38e66

Download Submit
C:\Users\Admin\AppData\Roaming\error_1.png

Filesize
3KB

MD5
6f42ca6b4105204fcd946cc2ae17d9a1

SHA1
7d4a234e40ef4564943ece66d46d9e1417586887

SHA256
7d4b3a73836005095e230d6d34297baa68f816b71cc6b78ced7a6f60b46c829c

SHA512
724726aa1b898646522140872210fb4766d5c9998eed3192f112313081377e68077536f6589d98f3300909592584bf3b65820da253feea8eeb558153900cf97a

Download Submit
C:\Users\Admin\AppData\Roaming\f22.png

Filesize
1KB

MD5
d8abf78e144e7521df20ceac8ee7810c

SHA1
764b28f968978640ca24049a8a0eb322f3dcb734

SHA256
be6934004ed9c71b7bda54bc4eed7f98bef46a7bcbe8463d03a7730116cfcd4e

SHA512
c997a3ba1442200fef03a31435f2250d72e188c09e9497ed67adbb327c73ea6046be6a8197d798a958fbfbc793f554c31307859d64fa22a917f605309ddc56e0

Download Submit
C:\Users\Admin\AppData\Roaming\getLayerShape.jsx

Filesize
521B

MD5
8d660544f0aa8fb4fcd9ff5e16eeae21

SHA1
82fc69814d602299c43f7fd18c5b9813cebd94aa

SHA256
3ea5850570ea785ced2ad11acdb81ee69c875d355a3411c15ea1276b611c18a3

SHA512
d314d3522f009d5f088a9c61e3515aa274d5ffa4a2a82c02484bfb8f4d5f862cf98e20f76b72c50e5e857957e05521ef458442c4437b2eefd4d895e5f3a97d1a

Download Submit
C:\Users\Admin\AppData\Roaming\slurs.bka

Filesize
63KB

MD5
89efba3dd01b85ce66489a11ec35d3fa

SHA1
a3571e5687eea33512f7bb235fbc60448ca40660

SHA256
d375e6922370e33875e13ebd58cd6804a01f5a7c01618096007e8ea1a3b380f5

SHA512
f0684c0fc1cc40955bbca9da2297a94e950e12966be8128dcfc24aebc905f57fb19b3affadb7ac6c05449359dfac430be1f57ef790c29156c97a9ef9f26597a5

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1A07.tmp\System.dll

Filesize
11KB

MD5
a436db0c473a087eb61ff5c53c34ba27

SHA1
65ea67e424e75f5065132b539c8b2eda88aa0506

SHA256
75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

SHA512
908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

Download Submit
\Users\Admin\AppData\Roaming\ProxySettings.dll

Filesize
241KB

MD5
ed431cc4cd9381bb561bcfde8d3fbc20

SHA1
94393c56423fc53430e8a759eef80034b6dd93de

SHA256
810c908192654c74ee3816170fad05c8e61a3a31a0bb67ae7835de621d7951ba

SHA512
5f3060c26a097bf82378e9ed8c61bf9e26733fc6611c444728df1e6a5b9e7088cc840fb94daf90f2cc79c4a8be18975fa0e85591ec9602bec7a6cbf388354174

Download Submit
\Users\Admin\AppData\Roaming\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\TapiUnattend.exe

Filesize
261KB

MD5
878a47f7dd1e1a6409debe922daaca1a

SHA1
87d2a81c575dc2494fe26e5d883f66155ff4a847

SHA256
e6455cb52653e906492659ee0624ac089690ea3ad2e91a761746eb9baab47489

SHA512
692c790e0487f2af5cf020f03656939a1a3a8b2257b1f0e6ffd8260139a88e5348ccaa11c1d24664480f644d1e412102aadf73614d5bf239ca128a09c1636b4a

Download Submit
memory/768-151-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/768-149-0x0000000001F20000-0x0000000001F21000-memory.dmp

Filesize
4KB

Download
memory/768-147-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/768-153-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/768-146-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1532-232-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1532-233-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1544-229-0x0000000003060000-0x00000000030A8000-memory.dmp

Filesize
288KB

Download
memory/1544-214-0x0000000003060000-0x00000000030A8000-memory.dmp

Filesize
288KB

Download
memory/2392-34-0x0000000002920000-0x0000000002968000-memory.dmp

Filesize
288KB

Download
memory/2392-49-0x0000000002920000-0x0000000002968000-memory.dmp

Filesize
288KB

Download
memory/2572-129-0x0000000000840000-0x0000000000888000-memory.dmp

Filesize
288KB

Download
memory/2572-143-0x0000000000840000-0x0000000000888000-memory.dmp

Filesize
288KB

Download
memory/2648-52-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2648-54-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2648-53-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2648-38-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2648-40-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2648-42-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2648-44-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2648-46-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2648-48-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2648-36-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2648-55-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2648-68-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download