0e2981a4721244cf5ecf6173f8e638fce033d90bcc23cb31295761ceb8ed5b06

Analysis

max time kernel
143s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8913f9090dab53c13b6859b2ad8e270b_JaffaCakes118.exe
Size

40KB
MD5

8913f9090dab53c13b6859b2ad8e270b
SHA1

1f08460ac991db16cfec45ed83023ce1a6b967e7
SHA256

0e2981a4721244cf5ecf6173f8e638fce033d90bcc23cb31295761ceb8ed5b06
SHA512

ac36b4fe022ac2abd161011eed4c28fbc2691179dd591b90799c39cf9465c26a3a708f5c2af3e10a587a9f757868bc2e14cd216eb1adbdc2edcd26f9e3f7fee2
SSDEEP

768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtHS:aqk/Zdic/qjh8w19JDHS

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2748	services.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x003300000001416f-6.dat	upx
behavioral1/memory/2748-11-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2748-17-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2748-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2748-27-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2748-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2748-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2748-52-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2748-53-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2748-57-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2748-61-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2748-62-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2748-66-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2748-349-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2748-1234-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2748-2201-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	8913f9090dab53c13b6859b2ad8e270b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	8913f9090dab53c13b6859b2ad8e270b_JaffaCakes118.exe
File opened for modification	C:\Windows\java.exe	8913f9090dab53c13b6859b2ad8e270b_JaffaCakes118.exe
File created	C:\Windows\java.exe	8913f9090dab53c13b6859b2ad8e270b_JaffaCakes118.exe

Modifies system certificate store 2 TTPs 10 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	8913f9090dab53c13b6859b2ad8e270b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	8913f9090dab53c13b6859b2ad8e270b_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	8913f9090dab53c13b6859b2ad8e270b_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	8913f9090dab53c13b6859b2ad8e270b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	8913f9090dab53c13b6859b2ad8e270b_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	8913f9090dab53c13b6859b2ad8e270b_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	8913f9090dab53c13b6859b2ad8e270b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	8913f9090dab53c13b6859b2ad8e270b_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	8913f9090dab53c13b6859b2ad8e270b_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	8913f9090dab53c13b6859b2ad8e270b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2748	2324	8913f9090dab53c13b6859b2ad8e270b_JaffaCakes118.exe	28
PID 2324 wrote to memory of 2748	2324	8913f9090dab53c13b6859b2ad8e270b_JaffaCakes118.exe	28
PID 2324 wrote to memory of 2748	2324	8913f9090dab53c13b6859b2ad8e270b_JaffaCakes118.exe	28
PID 2324 wrote to memory of 2748	2324	8913f9090dab53c13b6859b2ad8e270b_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\8913f9090dab53c13b6859b2ad8e270b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8913f9090dab53c13b6859b2ad8e270b_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd76c31df126642360ac76ddfd0e991a

SHA1
e9d269215f88452757d146f5668444bf778d1b0e

SHA256
69439b4c91225bb691d8d7e1a76ef8ac594fe580f01d514ea41b8e35d4cb2a3c

SHA512
9ae5ca2c23e0fd8b7984ac87acea1ba346c1052cc72fef26536dce1b9e5f1c3999a2be45b6a1a8c584c9436e7fd42ba071a7eace7dd9d280663141fccc1e9d78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b1b76bc431ad12c727a760900f8fada

SHA1
6f6f5c5dff50ba224683e63a9aac9a4356c7a7f5

SHA256
3699b85c42d68165b6cac7ae1312549f8af9bc5b1bf4675553c8fdb885b5bc04

SHA512
10f7e94e1f07ac3315c9e3280f9c3f03bfa09db30a2f410fabc80ac0143fae98cac42f203b235af7adfb00c87e09f237a0085144aa3f3eb34841d6a7dd88c1df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f4768538a1bfdd2c9b569843b79358e

SHA1
b1f8588e1eaaf7d1fc235b2f3f350519cfe3c4d9

SHA256
c43b47670046c51de4c3505b1861d6b56a9930e5f15cabcfcf407f165a66c4b1

SHA512
3af914d5f22a757e6facd6c4ac5a76d50c1207562e1996e090f87bc371eca1c682bf800ba8f2c5d530eb19448fed57ba2179759791d924584a336174dcf9b543

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44bd98da6692fd7aaca583df565c4aca

SHA1
ce802e8c63ad7921a440a6992bd2de28bc4c2a74

SHA256
50355bc30cf8a40640af5bf3e88b0c17d1d2408128750de3d0f8a9468f368927

SHA512
a8a81b7c7e0cde3a0ed29d80bb956a837b3605913955001d33ee7e43c0b38e994160a9db356d8c649ea6c13fe244ca71ccebb9bd6d24b67f992712dcf25728f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bceb114bc1850a7f32d5483dc966374

SHA1
484e34eeffbb59a6d5e0de1e017a0ff827e17c23

SHA256
098a539a12f26f01a99c5710f33fb22b702bf362fb58801ede702df881c76e73

SHA512
502caced2d1c44f774b760c99768c71f57559a9600ca7542dbab30273e58efb20f3122478fc93b00e5d2104e69071e98026a6ace03e754b5cdf317737ecc60cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d2bb3e2a0dddc5fe245e1f43844383b

SHA1
0d5097810fb5d63ef79ab0c8e638c266f3e948a2

SHA256
fade0183213a5958a4463e491e084ae056c7c047c267cc94c0d60a5811418cd4

SHA512
3aff706b3d2789f947549f91a953c1102cbd768023521f42a933b59b3449e21255af6442b8dfdb63b7c6ff6e91cfb03a402ee83649b860cf3e0404397b46432e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01e0e80060da9e994d0232dc2250c566

SHA1
e711541d26daaa150f02a107e4d3308f0c527192

SHA256
61e91e18f064c6bec59d7a25aa8b898fe5900a4a490fb6e2d3184a59fae61642

SHA512
049922d8657500ad1a3985362543b5ec3d3e2259ed07cc32ef2ee9a7ae9980255f21b92e077cbd5b5d6e683aa299921cc2eed3a030b2db036389f6064a7d8028

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e59222dbb075167f028c85c9ba4b783

SHA1
856fb78250038cad7fdcc1182d7bdc744ea7955d

SHA256
a7527f312adbca36a771bc5092cb369d8d36735cb76adc5be53538f7954bb69b

SHA512
cce95ac9d1211602072cb3dc431c951de900c148eff71888f618d77f06a04dda623ac61402570e732a57ce7db1376b7d36d9d3ebaeb4d2f9fe4382199ce36fcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59b7ea7de1ce873dbb72d54955ded472

SHA1
7c1f75e6d514dfe377d4c57049205abcd31f67f7

SHA256
4587861e9c9bc20bc0ba1fbe79d096f63fb23a10c913c4ed1c9f4725c6fc3bdf

SHA512
291d158a6c2a38cf0c3966aeb6aedc4cf6e67369bf44e1f86594df0d91d22c9bfdeca83306c907aeef64c85b6d77c8f9ed3d48e4e3e586d3d65b96b25ebb88e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d716b7e0223b3dcbbc239b0d590fc657

SHA1
6b33c8e106dd5e59d68be3dba1b9337c57a3d57a

SHA256
880c4c1a594cb8cf209d7f0d5b92ce0e1a5dc615314b75f147ade5a2c8a3fe6d

SHA512
977830939b5a77683678dd10c9ec149bc547f886c0ed34db4943cf1719788c559b20c8712088916847a55d4dca3928666185eb221b8ba2d98e6a2cdb8d77f67e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3136ff76b007a6709dc9c665c492e387

SHA1
bcb78ff22b88a8b3c8a82702a8b69f28b1a8d207

SHA256
68ab20d335ab561f95f16c203d563250c8416db95bc7ce0ac8c1a4a9468b5973

SHA512
9b354e9d3e94017782ea771a0c595b93b824b48466e2b4a367a7e2ef017c6779bf04439e1d08a0c29e60357bf4f7bc5cf6adad2507bc8c86220ba5c3724a9830

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
789d19a4f59c3f19aa38bc8d87175a77

SHA1
92f8d60eadb369f16f589c41361b2d0b1d74945b

SHA256
dd0cc44f65ffbc3a514955c99c267d2c5a6a5d1642bf5c1cc7f4815d62b6819f

SHA512
e924b55e28f197dc8a1e0b3b223f6f2e0b371edad39ff0d87b8012d6675ca8cd52d93ab6211af4fc4da1fd070d4dbafb0a6538d13e086a82ba3cfbe1671288a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ce5f1859957be45dc380785272afafb

SHA1
6cdb3258d653df02d23648bb59b30076387520e9

SHA256
b6df63b0758af03905e13b4a94a5cd665d6395d433bcbc4e9b78ec0c8811b098

SHA512
70768a1ec7d3c11caf66883dacea10e3057a72a53c198424aa07cf92ccf41ae84bab27f1c3d86b5f2f6017d9e1abc2eeeb41228b099d5a8e970ec78c2bacd77b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fe21bfd0189da3ba923fa81e50cb640

SHA1
c29442ec413d979f3866fb65422da7d401619f30

SHA256
b7f6d124109cb98c4a280f202b732b6f39541df48d6dea5f9612764488735a28

SHA512
00273a7a93adde0557627f322a013adfbbe5abf9cbbfd800206e091a8eac629593bb9eaeac5a7a963c917d2fc0ff58d9e7d5caa7630c4c10f80798460937116e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
931356fa9c293881f2798801ee25bc61

SHA1
77f5aa112a6524dcc0b3ce7b34bb575e19d353ec

SHA256
d2c60366fbf2b644d3307967548939627bb07771420cd0ebfeddcbcfde95fe49

SHA512
8f25c283b068a6a86902f6e6b528f9371fd85cca82eef22f6c318b5bd617dea35e824e92c0cbb7317e426c4dd3517a3f2962c832647dc68a23d1e527f2f37e17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3fbe06920b64f8c5be0eb4c35d01548

SHA1
75ba53551d4623bb9a19718c170b549a84792eb0

SHA256
c3a334b2dcf917c31573eb4fd894869cdcb370c77f8de1b87d18f8892a48cc45

SHA512
d538870f03cbae064a04a3311e3cff2d0a754f916bae84bd7d7d5ddad3057a9eec42e892d3d5fe0ab0a7613afea3b41af91f6f73a343c2d9abaeb4cff27b81f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8829a1a676843ceeb7ec9cda127b107f

SHA1
d4a8b341953fdf7639d0c291adbbc9b54b639ce2

SHA256
c68ebd65b9bac57db633889ae0f7a7d784005d83b9157abafd6277c1d15ae8c0

SHA512
7fc92fd26d738baa0bd20763bf835ad6c9aad4e4a240e2263c232e2c6aca0015324c4256cd9540fc85e7c36cd2207d2b914e4c95253b216da21abcf702333e9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6fa0226ad0b359c5a9ff0a38445021fc

SHA1
099ce769a98968ace83f09d8e73270e598578785

SHA256
68dfca48ef28987e39642b62abcda15b7700d0788dde8368a33310223be9d316

SHA512
973528249504dad0d966aaf4d184b7fb07c071c50be1484a3d99c01ce1b22f088bc046f941ca99b248b1f046ef502d93477159ab2cb7792fe441bb2949c03952

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f74439147ba3b8e2a210d1e3efc19a68

SHA1
88f4d21fe3551bc0435839cf31ad667b0a55c17e

SHA256
f8221b987bce43d81fbc8620f051478ba0607a7405cdeeb4c914a1f4afeaf854

SHA512
17355ecaee2e9e7bc5269a76201b3e014f22955146da81324b9674b0023b964a55a6b239cfe82fd453b484dcbf58c30b759e8d27198612499567f27bf0c94c33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7251ae0b92141796bc549c7f76e9f3a8

SHA1
c63a475d6a5859d05fe2960d92bc7ed8a0b444ea

SHA256
682d357a6cdc6c62f1565e51340e806023b02a2889de06bd0e9d7adba6d44237

SHA512
f5a8e051503e26952024b05d2440d51b434f62c8d7a244c7702415092183ed02e502b04e5fd24daa5f474592dad1b5e6fab62bfd5cff5100ff7bb77c666fe4c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8836867a9f24d4890a0aef571d26ed8f

SHA1
a70bd5da9efa60b8560ed3b4f3d9315504d1b5cd

SHA256
b95b2aa734a0ad7b0cf405c03df67d7f62b4bc6e686d3fbaf7a9da0e7bf4947a

SHA512
648b5faee91a68251a9614487f01cd17927e5220966e62a2b6bc3bc94bcfad72842ed52d389d507ba0c0c5de7b69e00785d1f387f7ba4fceb87710917e3375c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
640de4cecc6273e6b8b7044706e56a29

SHA1
79101bffeedbddc4705e455edda715f3c75cf046

SHA256
e19b1be1ee47662d319da28824d7cd7bffa70f2d75e51f641bdfa17310bdad79

SHA512
74802e6235bba58f420f13b61a010abe0602972154815d69f22af80b597c869b0195f94d7ce2c41fbc5ffb8e113800ee46dfd49db293c539780102097b48e42d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d2f8ba82f97c75b4492a02032573984

SHA1
88ea071979cfddea3553f6d83d444b1336cb7f2d

SHA256
41d4786911625c6196b52903aa288050975576323fc81a388ade95831ebe8153

SHA512
481d01d6133e4f09f771f0fae2427de4db161bc49c925cb34a66cf03fdae8107c21679c4de3755d3a679b8c37f2ae2453192bded7ae6c7c030231b16cde80d9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
869a111a9e0cd4370691096d62e80936

SHA1
f00a3a12e7b61e774615389baaa5f2ff6735fb7b

SHA256
d1f1a825215a77d22ba1e05d80e3ebff0d94e1e081e8718fb47d0d77e4712a07

SHA512
b4c3c1fc5006a55de3245379d7702c371eadc69f4688efa5a723f27d8b51a01689d2c4076c65751f485909dd0ef1e854395a5064e33deef6218f7c31217ca086

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B1014REI\default[1].htm

Filesize
305B

MD5
157431349a057954f4227efc1383ecad

SHA1
69ccc939e6b36aa1fabb96ad999540a5ab118c48

SHA256
8553409a8a3813197c474a95d9ae35630e2a67f8e6f9f33b3f39ef4c78a8bfac

SHA512
6405adcfa81b53980f448c489c1d13506d874d839925bffe5826479105cbf5ba194a7bdb93095585441c79c58de42f1dab1138b3d561011dc60f4b66d11e9284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B1014REI\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE7E8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE8C7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE8A6.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE939.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpECF0.tmp

Filesize
40KB

MD5
0096cb8a79b4bb622a0cd03eaf27c466

SHA1
3241d814b8ca89bc2ae4b64904f5708715c50409

SHA256
eb3743da71903f743013fbb875fb0530961413589585682efc2dad53f088b7dc

SHA512
fa16197778dd231ca17e24e44f56ed2fc1077b372cf00d3b328f40c63c85945f2134c2122ba581739c37da86c6f4c25a5577da881dde55d6d071c0aa5b006aaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
d562394f77f5eb72e54f66ddfc738f44

SHA1
49493c75a2565e5291f3612f07ba671d88afd3bb

SHA256
a0435fdd922bcda4e88f92f4156f1e8a6c4425a4753295062242724b8e73e03b

SHA512
ca17b15e7393b6289e24073aef0787bc12dc34914c2427251960a071294a5fea0a627f944ed0ed9a3c7e5d8b83ad85a7d5efc7554e4473afe73b25bdeabaccd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
075f912dfd04512c72f138805e3c9ef1

SHA1
33d70088cc695512c7aa515c9f045cf92abb7113

SHA256
098dfedbb49c74b79951f45f0797f38801816a8417f3274958a4a475cbc414e1

SHA512
1fb533db5e1a0afaaa2e226972b13927c02af15c788831062f31e5e75966ed596e64e590050f229f5f6ac6e9b89bb6450426e26b8d6ac51721713e69d3365feb

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2324-23-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2324-9-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2324-0-0x0000000000500000-0x000000000050D000-memory.dmp

Filesize
52KB

Download
memory/2324-22-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2324-10-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2748-62-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2748-2201-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2748-17-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2748-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2748-1234-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2748-349-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2748-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2748-66-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2748-61-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2748-57-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2748-53-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2748-52-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2748-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2748-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2748-27-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads