2b554069e95325e2d71e8d75a6d624b0b3c31abe8ed6cb29f72ecbae65e4545c

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
90e190e1b975158170d5cd0d59f4c7af_JaffaCakes118.exe
Size 9.0MB
Sample240603-hlt3tsfc8t
SHA256 2b554069e95325e2d71e8d75a6d624b0b3c31abe8ed6cb29f72ecbae65e4545c
MD5 90e190e1b975158170d5cd0d59f4c7af
SHA1 493fce42a79faff5c45aa519284504f5192cab44
SHA512 f7910890deee41491f9fcb6ed56468d92dc16c49c1825a68f0d249adcae6c358e3ebf2c2b5ac802b6a964e1cf9e6014f98457f69ab8a927e1b564d85fb8ff067
SSDEEP 49152:pBW5GKin2v7LOSOJ/RX88xHM67MQaBNJ6lW1mWEBMbU7DePqTAwxQ+Hyxzdca5NU:pBn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion execution

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	UAnPigDW.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2356	powershell.exe

Disables Task Manager via registry modification
evasion

Modifies Windows Firewall 2 TTPs 11 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
396	netsh.exe
4040	netsh.exe
968	netsh.exe
3420	netsh.exe
3872	netsh.exe
4452	netsh.exe
1052	netsh.exe
3676	netsh.exe
3464	netsh.exe
4972	netsh.exe
2312	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	UAnPigDW.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	UAnPigDW.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	90e190e1b975158170d5cd0d59f4c7af_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Local Network Service.bat	xcopy.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Local Network Service.bat	xcopy.exe

Executes dropped EXE 6 IoCs

pid	Process
3232	video-45274.exe
1904	start.exe
2672	UAnPigDW.exe
2908	Installer.exe
1000	Installer.tmp
1212	7z.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Wine	UAnPigDW.exe

Loads dropped DLL 4 IoCs

pid	Process
2800	MsiExec.exe
2800	MsiExec.exe
2800	MsiExec.exe
1212	7z.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2672	UAnPigDW.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e576419.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI79E6.tmp	msiexec.exe
File created	C:\Windows\Installer\e576419.msi	msiexec.exe
File opened for modification	C:\Windows\DXM.reg	cmd.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File created	C:\Windows\Installer\e57641d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI661C.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe
File created	C:\Windows\Installer\SourceHash{A6010187-3BF3-47C4-B77D-D6709ADE5FC6}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7744.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI787E.tmp	msiexec.exe
File created	C:\Windows\DXM.REG	cmd.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4704	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x0007000000023424-13.dat	nsis_installer_1
behavioral2/files/0x0007000000023424-13.dat	nsis_installer_2

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3260	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4484	timeout.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7810106A3FB34C747BD76D07A9EDF56C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7810106A3FB34C747BD76D07A9EDF56C\ProductName = "Installer (Wrapped using MSI Wrapper from www.exemsi.com)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7810106A3FB34C747BD76D07A9EDF56C\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7810106A3FB34C747BD76D07A9EDF56C\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7810106A3FB34C747BD76D07A9EDF56C\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7810106A3FB34C747BD76D07A9EDF56C\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7810106A3FB34C747BD76D07A9EDF56C\PackageCode = "69CC984D515CD3F499D4F3786E967933"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\47A35E06E11F0A794893A2BPAF606457\7810106A3FB34C747BD76D07A9EDF56C	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7810106A3FB34C747BD76D07A9EDF56C\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7810106A3FB34C747BD76D07A9EDF56C\ProductFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7810106A3FB34C747BD76D07A9EDF56C	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7810106A3FB34C747BD76D07A9EDF56C\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7810106A3FB34C747BD76D07A9EDF56C\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\47A35E06E11F0A794893A2BPAF606457	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7810106A3FB34C747BD76D07A9EDF56C\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7810106A3FB34C747BD76D07A9EDF56C\SourceList\PackageName = "Installer.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7810106A3FB34C747BD76D07A9EDF56C\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7810106A3FB34C747BD76D07A9EDF56C\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7810106A3FB34C747BD76D07A9EDF56C\Version = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7810106A3FB34C747BD76D07A9EDF56C\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7810106A3FB34C747BD76D07A9EDF56C\DeploymentFlags = "2"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7810106A3FB34C747BD76D07A9EDF56C\SourceList\Media\1 = ";"	msiexec.exe

Runs .reg file with regedit 1 IoCs

pid	Process
464	regedit.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2672	UAnPigDW.exe
2672	UAnPigDW.exe
3256	msiexec.exe
3256	msiexec.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
1000	Installer.tmp
1000	Installer.tmp
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2356	powershell.exe
2356	powershell.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2356	powershell.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe
2672	UAnPigDW.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1784	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1784	msiexec.exe
Token: SeSecurityPrivilege	3256	msiexec.exe
Token: SeCreateTokenPrivilege	1784	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1784	msiexec.exe
Token: SeLockMemoryPrivilege	1784	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1784	msiexec.exe
Token: SeMachineAccountPrivilege	1784	msiexec.exe
Token: SeTcbPrivilege	1784	msiexec.exe
Token: SeSecurityPrivilege	1784	msiexec.exe
Token: SeTakeOwnershipPrivilege	1784	msiexec.exe
Token: SeLoadDriverPrivilege	1784	msiexec.exe
Token: SeSystemProfilePrivilege	1784	msiexec.exe
Token: SeSystemtimePrivilege	1784	msiexec.exe
Token: SeProfSingleProcessPrivilege	1784	msiexec.exe
Token: SeIncBasePriorityPrivilege	1784	msiexec.exe
Token: SeCreatePagefilePrivilege	1784	msiexec.exe
Token: SeCreatePermanentPrivilege	1784	msiexec.exe
Token: SeBackupPrivilege	1784	msiexec.exe
Token: SeRestorePrivilege	1784	msiexec.exe
Token: SeShutdownPrivilege	1784	msiexec.exe
Token: SeDebugPrivilege	1784	msiexec.exe
Token: SeAuditPrivilege	1784	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1784	msiexec.exe
Token: SeChangeNotifyPrivilege	1784	msiexec.exe
Token: SeRemoteShutdownPrivilege	1784	msiexec.exe
Token: SeUndockPrivilege	1784	msiexec.exe
Token: SeSyncAgentPrivilege	1784	msiexec.exe
Token: SeEnableDelegationPrivilege	1784	msiexec.exe
Token: SeManageVolumePrivilege	1784	msiexec.exe
Token: SeImpersonatePrivilege	1784	msiexec.exe
Token: SeCreateGlobalPrivilege	1784	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeDebugPrivilege	2672	UAnPigDW.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe
Token: SeRestorePrivilege	3256	msiexec.exe
Token: SeTakeOwnershipPrivilege	3256	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1000	Installer.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 5052	1608	90e190e1b975158170d5cd0d59f4c7af_JaffaCakes118.exe	86
PID 1608 wrote to memory of 5052	1608	90e190e1b975158170d5cd0d59f4c7af_JaffaCakes118.exe	86
PID 1608 wrote to memory of 5052	1608	90e190e1b975158170d5cd0d59f4c7af_JaffaCakes118.exe	86
PID 1608 wrote to memory of 3152	1608	90e190e1b975158170d5cd0d59f4c7af_JaffaCakes118.exe	87
PID 1608 wrote to memory of 3152	1608	90e190e1b975158170d5cd0d59f4c7af_JaffaCakes118.exe	87
PID 1608 wrote to memory of 3152	1608	90e190e1b975158170d5cd0d59f4c7af_JaffaCakes118.exe	87
PID 1608 wrote to memory of 3232	1608	90e190e1b975158170d5cd0d59f4c7af_JaffaCakes118.exe	90
PID 1608 wrote to memory of 3232	1608	90e190e1b975158170d5cd0d59f4c7af_JaffaCakes118.exe	90
PID 1608 wrote to memory of 3232	1608	90e190e1b975158170d5cd0d59f4c7af_JaffaCakes118.exe	90
PID 5052 wrote to memory of 464	5052	cmd.exe	91
PID 5052 wrote to memory of 464	5052	cmd.exe	91
PID 5052 wrote to memory of 464	5052	cmd.exe	91
PID 3232 wrote to memory of 1904	3232	video-45274.exe	92
PID 3232 wrote to memory of 1904	3232	video-45274.exe	92
PID 3232 wrote to memory of 1904	3232	video-45274.exe	92
PID 1904 wrote to memory of 5096	1904	start.exe	93
PID 1904 wrote to memory of 5096	1904	start.exe	93
PID 1904 wrote to memory of 5096	1904	start.exe	93
PID 5096 wrote to memory of 1784	5096	cmd.exe	95
PID 5096 wrote to memory of 1784	5096	cmd.exe	95
PID 5096 wrote to memory of 1784	5096	cmd.exe	95
PID 1608 wrote to memory of 2672	1608	90e190e1b975158170d5cd0d59f4c7af_JaffaCakes118.exe	96
PID 1608 wrote to memory of 2672	1608	90e190e1b975158170d5cd0d59f4c7af_JaffaCakes118.exe	96
PID 1608 wrote to memory of 2672	1608	90e190e1b975158170d5cd0d59f4c7af_JaffaCakes118.exe	96
PID 3256 wrote to memory of 2800	3256	msiexec.exe	99
PID 3256 wrote to memory of 2800	3256	msiexec.exe	99
PID 3256 wrote to memory of 2800	3256	msiexec.exe	99
PID 2800 wrote to memory of 868	2800	MsiExec.exe	100
PID 2800 wrote to memory of 868	2800	MsiExec.exe	100
PID 2800 wrote to memory of 868	2800	MsiExec.exe	100
PID 2800 wrote to memory of 2908	2800	MsiExec.exe	102
PID 2800 wrote to memory of 2908	2800	MsiExec.exe	102
PID 2800 wrote to memory of 2908	2800	MsiExec.exe	102
PID 2908 wrote to memory of 1000	2908	Installer.exe	103
PID 2908 wrote to memory of 1000	2908	Installer.exe	103
PID 2908 wrote to memory of 1000	2908	Installer.exe	103
PID 1000 wrote to memory of 3928	1000	Installer.tmp	104
PID 1000 wrote to memory of 3928	1000	Installer.tmp	104
PID 1000 wrote to memory of 3928	1000	Installer.tmp	104
PID 3928 wrote to memory of 2356	3928	cmd.exe	106
PID 3928 wrote to memory of 2356	3928	cmd.exe	106
PID 3928 wrote to memory of 2356	3928	cmd.exe	106
PID 2800 wrote to memory of 3500	2800	MsiExec.exe	111
PID 2800 wrote to memory of 3500	2800	MsiExec.exe	111
PID 2800 wrote to memory of 3500	2800	MsiExec.exe	111
PID 3928 wrote to memory of 4920	3928	cmd.exe	113
PID 3928 wrote to memory of 4920	3928	cmd.exe	113
PID 3928 wrote to memory of 4920	3928	cmd.exe	113
PID 4920 wrote to memory of 5044	4920	wscript.exe	114
PID 4920 wrote to memory of 5044	4920	wscript.exe	114
PID 4920 wrote to memory of 5044	4920	wscript.exe	114
PID 3928 wrote to memory of 4484	3928	cmd.exe	116
PID 3928 wrote to memory of 4484	3928	cmd.exe	116
PID 3928 wrote to memory of 4484	3928	cmd.exe	116
PID 5044 wrote to memory of 1212	5044	cmd.exe	117
PID 5044 wrote to memory of 1212	5044	cmd.exe	117
PID 3928 wrote to memory of 2508	3928	cmd.exe	124
PID 3928 wrote to memory of 2508	3928	cmd.exe	124
PID 3928 wrote to memory of 2508	3928	cmd.exe	124
PID 2508 wrote to memory of 5012	2508	net.exe	125
PID 2508 wrote to memory of 5012	2508	net.exe	125
PID 2508 wrote to memory of 5012	2508	net.exe	125
PID 3928 wrote to memory of 4704	3928	cmd.exe	126
PID 3928 wrote to memory of 4704	3928	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\90e190e1b975158170d5cd0d59f4c7af_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\90e190e1b975158170d5cd0d59f4c7af_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dtm.bat" "
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Windows\DXM.reg
    3⤵
    - Runs .reg file with regedit
    PID:464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nfo.bat" "
  2⤵
  PID:3152
- C:\Users\Admin\AppData\Local\Temp\video-45274.exe
  "C:\Users\Admin\AppData\Local\Temp\video-45274.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Users\Admin\AppData\Local\Temp\start.exe
    "C:\Users\Admin\AppData\Local\Temp\start.exe"C:\Users\Admin\AppData\Local\Temp\Install.cmd
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1904
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Install.cmd""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5096
    - - C:\Windows\SysWOW64\msiexec.exe
        
        msiexec.exe /i C:\Users\Admin\AppData\Local\Temp\Installer.msi /quiet
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1784
- C:\Users\Admin\AppData\Local\Temp\UAnPigDW.exe
  "C:\Users\Admin\AppData\Local\Temp\UAnPigDW.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2672

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 85323A7AABB8810C2EE99AECE219D1F2
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\SysWOW64\expand.exe
    "C:\Windows\System32\expand.exe" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\MW-d0f5c48a-03b3-4f60-a288-2be3a2125c0a\files\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-d0f5c48a-03b3-4f60-a288-2be3a2125c0a\files\Installer.exe" /VERYSILENT
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Users\Admin\AppData\Local\Temp\is-HC2MP.tmp\Installer.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-HC2MP.tmp\Installer.tmp" /SL5="$801E4,1963023,57856,C:\Users\Admin\AppData\Local\Temp\MW-d0f5c48a-03b3-4f60-a288-2be3a2125c0a\files\Installer.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1000
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Roaming\Windows Defender\21lSxhRdCn598o3En63VelN0I9tBDI.bat""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3928
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "&Add-MpPreference -ExclusionPath ""C:\Users\Admin\AppData\Roaming\Windows Defender"""
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2356
      - C:\Windows\SysWOW64\wscript.exe
        
        wscript.exe "C:\Users\Admin\AppData\Roaming\Windows Defender\db85LACT3x2r3wNY1Ggv2kP3RWm7g6.vbs"
        6⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:4920
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Windows Defender\db85LACT3x2r3wNY1Ggv2kP3RWm7g6.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5044
        
        C:\Users\Admin\AppData\Roaming\Windows Defender\7z.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Defender\7z.exe" x "C:\Users\Admin\AppData\Roaming\Windows Defender\c8D84mXwdLSb50E79TFa4wbaH3M7xF.7z" -pH0opbn2tYq2DXR0y10FhC04CNtv49Z -y -o"C:\Users\Admin\AppData\Roaming\Windows Defender"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1212
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 30
        6⤵
        Delays execution with timeout.exe
        
        PID:4484
      - C:\Windows\SysWOW64\net.exe
        
        net stop wuauserv
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2508
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        7⤵
        
        PID:5012
      - C:\Windows\SysWOW64\sc.exe
        
        sc config wuauserv start= disabled
        6⤵
        Launches sc.exe
        
        PID:4704
      - C:\Windows\SysWOW64\netsh.exe
        
        C:\Windows\system32\netsh.exe advfirewall firewall add rule name="OpenVPN1.0" dir=in action=block program="C:\Program Files\AhnLab\V3Lite30\MUpdate2\MUpdate2.exe"
        6⤵
        Modifies Windows Firewall
        
        PID:968
      - C:\Windows\SysWOW64\netsh.exe
        
        C:\Windows\system32\netsh.exe advfirewall firewall add rule name="OpenVPN1.0" dir=out action=block program="C:\Program Files\AhnLab\V3Lite30\MUpdate2\MUpdate2.exe"
        6⤵
        Modifies Windows Firewall
        
        PID:4972
      - C:\Windows\SysWOW64\netsh.exe
        
        C:\Windows\system32\netsh.exe advfirewall firewall add rule name="OpenVPN2.0" dir=in action=block program="C:\Program Files\ESTsoft\ALYac\AYUpdSrv.aye"
        6⤵
        Modifies Windows Firewall
        
        PID:2312
      - C:\Windows\SysWOW64\netsh.exe
        
        C:\Windows\system32\netsh.exe advfirewall firewall add rule name="OpenVPN2.0" dir=out action=block program="C:\Program Files\ESTsoft\ALYac\AYUpdSrv.aye"
        6⤵
        Modifies Windows Firewall
        
        PID:3872
      - C:\Windows\SysWOW64\netsh.exe
        
        C:\Windows\system32\netsh.exe advfirewall firewall add rule name="Torrentservice" dir=in action=block program="C:\Program Files\Naver\NaverVaccine\NvcAgent.npc"
        6⤵
        Modifies Windows Firewall
        
        PID:4452
      - C:\Windows\SysWOW64\netsh.exe
        
        C:\Windows\system32\netsh.exe advfirewall firewall add rule name="Torrentservice" dir=out action=block program="C:\Program Files\Naver\NaverVaccine\NvcAgent.npc"
        6⤵
        Modifies Windows Firewall
        
        PID:1052
      - C:\Windows\SysWOW64\netsh.exe
        
        C:\Windows\system32\netsh.exe advfirewall firewall add rule name="Msn Messenger" dir=in action=block program="C:\Program Files\AVAST Software\Avast\setup\instup.exe"
        6⤵
        Modifies Windows Firewall
        
        PID:3420
      - C:\Windows\SysWOW64\netsh.exe
        
        C:\Windows\system32\netsh.exe advfirewall firewall add rule name="Msn Messenger" dir=out action=block program="C:\Program Files\AVAST Software\Avast\setup\instup.exe"
        6⤵
        Modifies Windows Firewall
        
        PID:396
      - C:\Windows\SysWOW64\netsh.exe
        
        C:\Windows\system32\netsh.exe advfirewall firewall add rule name="Skype updater" dir=in action=block program="C:\Program Files\AhnLab\Safe Transaction\MUpdate2\MUpdate2.exe"
        6⤵
        Modifies Windows Firewall
        
        PID:3676
      - C:\Windows\SysWOW64\netsh.exe
        
        C:\Windows\system32\netsh.exe advfirewall firewall add rule name="Skype updater" dir=out action=block program="C:\Program Files\AhnLab\Safe Transaction\MUpdate2\MUpdate2.exe"
        6⤵
        Modifies Windows Firewall
        
        PID:3464
      - C:\Windows\SysWOW64\netsh.exe
        
        C:\Windows\system32\NetSh.exe Advfirewall set allprofiles state on
        6⤵
        Modifies Windows Firewall
        
        PID:4040
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /xml "C:\Users\Admin\AppData\Roaming\Windows Defender\MONc9J95EdRlxj47bi0MaF4oLN24b2.xml" /tn "Windows Local Network Service"
        6⤵
        Creates scheduled task(s)
        
        PID:3260
      - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy /s /y /k /f "C:\Users\Admin\AppData\Roaming\Windows Defender\Windows Local Network Service.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
        6⤵
        Drops startup file
        Enumerates system info in registry
        
        PID:3624
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-d0f5c48a-03b3-4f60-a288-2be3a2125c0a\files"
    3⤵
    PID:3500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

e57641c.rbs

Path C:\Config.Msi\e57641c.rbs
Size 7KB
SHA256 60ead6de312420a6cf925a1acd875d7e177da53ac8b56ccfeea3fcb8e358b5b1
MD5 e4eb8799e7151f6e96b43f35f11baa89
SHA1 a621c1a6803ce5cf25c9c818deb8e102dda30eac
SHA512 c0367de02a7c9884c66cf4f881d303a485b2c530808dbbb88d0b07078735e86a7fb6093e49eabd0b07f26cdacbf8a3414e9afd0c010b17cdfef58dc010934f8e
SSDEEP 96:m3BAlLaBA4ZBeu4QhUARzCsThqUUARzC6jl5z2BAkThq9HNBAaF5wZWAKA7AMoBF:m3BLBRBe8aIuICIuXBdyBP2sBoMpV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.cmd

Path C:\Users\Admin\AppData\Local\Temp\Install.cmd
Size 92B
SHA256 545c9c3bdbbe76c162690681d751fecd9af0c4b202565639cc7877df1821be16
MD5 4ed605278a54e4a410eefba0848d1cbb
SHA1 4fc987b331ac5d36ff629c67934454228cd88538
SHA512 1e2714c9be87000fc1db688625743c7af80d941c563c1e52ce2008e590fd0eb6fe1f1755d856a1346600efd156736051a503aa94d85baeb1c810a7a0b127ad3b
MD5 SHA1 SHA512

Submit Download

Installer.msi

Path C:\Users\Admin\AppData\Local\Temp\Installer.msi
Size 2.2MB
SHA256 4d64c1e066c4be224813120885bf8bb00aeed7be670b59485a4e65ff2101919b
MD5 85b0ae2e002d45d566e9058a19ba57af
SHA1 a522ddb52aa0d360092b87863786c7c301efe80d
SHA512 f993de6bcd0a88ee234a403277eff1652d116ac79a96bb1ece52f1025d411002f7f848b38f7e843cb7a3b8bff816b4e6f19f2ffbf83214d0076850ac4b18e347
SSDEEP 49152:smX7xGcCQNvLz+ITPayaRgUdZIUcpBngD6I5ornOuAYWkTqm66:smXCMv3iya6Ud6/Bnz7rOjYDH
MD5 SHA1 SHA512 SSDEEP

Submit Download

files.cab

Path C:\Users\Admin\AppData\Local\Temp\MW-d0f5c48a-03b3-4f60-a288-2be3a2125c0a\files.cab
Size 2.1MB
SHA256 dbc3fb3a384dc3d88ca9a6938c18edf6a08e339796d128f5a938165a173e3f6f
MD5 82225cf24536153c48c9486281b0c617
SHA1 b7b2c58f020c56c2567af0599b057e4bfa59754b
SHA512 be18a3da7145dc8a71d6c9324afc4e28dbf0298a2a05008a97bec753e155f025b60db1e9c9fafb77c47645f981dec64cc9baca4767f63583e1560dc861ff4b13
SSDEEP 49152:vmX7xGcCQ7+ITPayaRgUdZIUcpBngD6I5ornOuAYWkTqm66N:vmXC4iya6Ud6/Bnz7rOjYDHN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Installer.exe

Path C:\Users\Admin\AppData\Local\Temp\MW-d0f5c48a-03b3-4f60-a288-2be3a2125c0a\files\Installer.exe
Size 2.1MB
SHA256 c06b1ae75c1f254da3921b41d7c8818de9e1d5de384e63a338d8129fc798c6b0
MD5 e3c6ade8dccf38202512fa167c6d06d2
SHA1 f7c7164315f32a812271dd9d07abec849c6027e6
SHA512 7806d1b74713022035015cc09035feddaf176f1590d64e1e12fd013bd025154824dcdcf8d1b9e7d6a6eaf4b5e423e63cc327b8e26d02019b5ef10d7a499b2dea
SSDEEP 49152:z75tRo5Y4exGsCgazUe1JygQgGPnlRH0QsgUjI5jzUPH1YxG+sm8Y3:X5tRo5YvCjjygNGPl6QsvkzmVYhX3
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-d0f5c48a-03b3-4f60-a288-2be3a2125c0a\msiwrapper.ini
Size 452B
SHA256 e8042edda9b252e5790d3bccbe0cd9361eb04cce45f2f9c30dd3fd9d57f2f33d
MD5 a38b36e1ec93ee86ab51f9cb9a5a84c5
SHA1 68615d6e7b164a0e90c681375244e8cf92580506
SHA512 bda30908519a13a3f66306114ec1f11a48d617b51d98d61439482c4ab1e60896510bcb63d4d2503e6f5125abe88e6f3637a86773b797124a3031b2426b6e5cd4
MD5 SHA1 SHA512

Submit Download

UAnPigDW.exe

Path C:\Users\Admin\AppData\Local\Temp\UAnPigDW.exe
Size 4.4MB
SHA256 62f732852c78377637ef74f0f70a0c559732397766735b538fa4309a8c578c33
MD5 541a036fe8919f11cb0d509a8c900a1f
SHA1 422c27537b69835ebe96bbf57a9d998b454e2947
SHA512 5d47e6c7ca23832838dde6fa3510e872e7ed863d7f2d67643bb0bb95840d4a3f1c6742b7b5975c390441cf89039b8f9da4514a0a13b36b3e1974c1eebfabc089
SSDEEP 98304:VRAi4IBG+KisQJEK8PkWbgsts7WUTaXzV2cvfORi/Lb6:81IBG+Hs03WB67YXztHOgDb6
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_p2yyqseq.p3t.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p2yyqseq.p3t.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

dtm.bat

Path C:\Users\Admin\AppData\Local\Temp\dtm.bat
Size 409B
SHA256 5a419808133e8d80b7a2e3a21f1dd7904fb182cf52a5b2c2059d2f14c13cc25c
MD5 8c88e91a4900b79b7d7e01d01fc6a419
SHA1 ef1987c7bedd559d340ac2060218565142c3bd20
SHA512 97afb31bef1038633921b10a98ef825fce2845a1ff8cd903919fd3e5dd5ff2df8b9fab6cb4eeeb225208a957ec6e0c53758ac0ff8d81fd96ef9691ef0f30b0ce
MD5 SHA1 SHA512

Submit Download

Installer.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-HC2MP.tmp\Installer.tmp
Size 697KB
SHA256 cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3
MD5 832dab307e54aa08f4b6cdd9b9720361
SHA1 ebd007fb7482040ecf34339e4bf917209c1018df
SHA512 358d43522fd460eb1511708e4df22ea454a95e5bc3c4841931027b5fa3fb1dda05d496d8ad0a8b9279b99e6be74220fe243db8f08ef49845e9fb35c350ef4b49
SSDEEP 12288:usMLIMoi3rPR37dzHRA6nX0D9OKWbO7SERb5rNUK1bce0syxyR:JMcMoi3rPR37dzHRA6G7WbuSEmK50syQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

nfo.bat

Path C:\Users\Admin\AppData\Local\Temp\nfo.bat
Size 265B
SHA256 1de07fb1046547772acaef98af7f50cf43fb25ec3b5ae2ddfe5f78d40fb32d34
MD5 f2307667d4e15476c2cd41390f505f70
SHA1 a2340725ee50b37c1fbd6871905a1af0735e585e
SHA512 ba03743b889eff4c775a9d1a52f8d7655ff0065647b1090cebe3bf39373403ac1f6da5197cee4e5d8653e7513ca8e855448564df2e39589f65b4c12c0ab8cd91
MD5 SHA1 SHA512

Submit Download

start.exe

Path C:\Users\Admin\AppData\Local\Temp\start.exe
Size 134KB
SHA256 c2ce4d67b631743a928a7918834388afebd710dc4fbc49e7ddda40404f72f4c2
MD5 9ba86db6e72bba69f93e3bab9487c0c8
SHA1 45d7f86d8bd5d36e29bb90129b878b5c2dffce96
SHA512 75a02c6dd4a858df9cbdb70d07aaf5ab553ab6859404b2508c2728b5d013384459360c64ace5d754ee96352115bdc6609ec796ef59abd248edfd7b622dd4dbc4
SSDEEP 1536:3WlRZeVzEJihKJXbOEAmDbRwELnr/BzfaYKUJdSjtHjorgcJYilnIen0VJ+:imEgUTRwwdLDHdJYilnIen0VJ+
MD5 SHA1 SHA512 SSDEEP

Submit Download

video-45274.exe

Path C:\Users\Admin\AppData\Local\Temp\video-45274.exe
Size 2.3MB
SHA256 664c24d2a7594903515c628e356cc13bebdd0296ea48b7ae010fad35a9fc60e5
MD5 fc4b900206a00e4fc637c15b084fc982
SHA1 12940ac1158540cdb9a565410f27534e7c53bc56
SHA512 e839349ac647820db8120913c399b49308f981be39d8828777aca590f0fc1f4f76a68fc2dbce4e670621a12f67056318faa61afebda59dd7a5ac3eb818c383bc
SSDEEP 49152:12jtxGstColYt/uyMDO6JZmccT75WD+I5oZnQ8A4Mstkm4A2R:12XtCRWyMK6J8975j7ZQB4Nx2R
MD5 SHA1 SHA512 SSDEEP

Submit Download

21lSxhRdCn598o3En63VelN0I9tBDI.bat

Path C:\Users\Admin\AppData\Roaming\Windows Defender\21lSxhRdCn598o3En63VelN0I9tBDI.bat
Size 2KB
SHA256 f6ff5127c8bd505d7e626aa3540826c95c900a8da07a09497ae0e6dd9006429f
MD5 c89040d0b1025de007f65ddf7003977d
SHA1 f89504976f39bbad39aa5cb20722e3ddf0a95344
SHA512 58d717c5d1cda5e4c5fd83bd54307efe7644859245301d6626a7d332c9d54547ef5784e72dc07175e712ce2095d6f0e97d590a36add95c9700e0c640154acd88
MD5 SHA1 SHA512

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Roaming\Windows Defender\7z.dll
Size 1.6MB
SHA256 3dce36d583ba1c741e95df1a265e47f0de581bef77ab48165dd67266be7a42ef
MD5 7580437d0fb8c1ae60d96dafb6883d30
SHA1 be89b488b258555a8cf971e4d29c40ce92bf881d
SHA512 e67be84fb4c9bc87c20b72a1169f068b0afdbc9872be2cb0bfcf9eff65b2b246c60c7237350cbb38cefc004a75645f49d30c9acab12efb0e914450886c21e1eb
SSDEEP 24576:9nCGMETTlVpmD8mCnL4GOnEZmNT6BQCBSA5no:xtTTlVID58LmNbeSo
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Roaming\Windows Defender\7z.exe
Size 451KB
SHA256 47462483fe54776e01d8ceb8ff9fd5bf2c3f1f01d852a54d878914f62f98f2d3
MD5 614d994a6b4275506037747ec162df5e
SHA1 11f7c47a7935560aa9c8c30ac1cecc974000b392
SHA512 f0950dfe0ea067f7be450aa9032a8713f7726540c56fd7a4fa861cea36d3f6d3cb524d4bcbf22c6b5d2ad018c6169d65a9cb40facf4ca62eea0e34b677d9a26e
SSDEEP 12288:5C8TNi6LjSNacKiFzkae6N31+njiipWGc4:TNDjSNacKwNZiYJ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

MONc9J95EdRlxj47bi0MaF4oLN24b2.xml

Path C:\Users\Admin\AppData\Roaming\Windows Defender\MONc9J95EdRlxj47bi0MaF4oLN24b2.xml
Size 1KB
SHA256 68aac96bbf360b79f14341a57c213e4a1b058de982afd88168dd146c0b2f286d
MD5 f537e86a8456064d64322c226923fe5e
SHA1 2308da11f12b0a576f92aecca1b7e57607244667
SHA512 55c2fddec1583bff479337a22e39e2d93e19203a5997e02d16f5bf45c4f2f64eda891f51570131e71105dc0886e8363b97c9846ff6aafaef5fe4cdc2f7e49eef
MD5 SHA1 SHA512

Submit Download

Windows Local Network Service.bat

Path C:\Users\Admin\AppData\Roaming\Windows Defender\Windows Local Network Service.bat
Size 105B
SHA256 88ca72a739ab57ed977a5d30e85e48452e05d4926c069a0c08ce401ec1d0e7d8
MD5 ee54ef1725c0f50917f7776322782b9a
SHA1 610963e1a67a61700c18776c4e40ad01a38a6ee4
SHA512 3a25d240bf62ba0f18f9b8a61268ecc4112229dd4c0cfebfba5bd3d487e5fa0b768594effd6e67355b90a0a07515ad6e028cd3add1274116d8ec62bb9697f218
MD5 SHA1 SHA512

Submit Download

c8D84mXwdLSb50E79TFa4wbaH3M7xF.7z

Path C:\Users\Admin\AppData\Roaming\Windows Defender\c8D84mXwdLSb50E79TFa4wbaH3M7xF.7z
Size 1.0MB
SHA256 84ac6f20881b16b7452936a4a714197d3afd2e8f44876c7feff00cc1c39f1422
MD5 df42d5fadbe93e30f72c744e19fc01bc
SHA1 d9f06f630dc39dfd14de6e2740ba45092c2c4c0f
SHA512 8ab8b37fe228df9176cb67eb2cda3c082f7b9ff55286d9e222882225748025d645f2e0fbb675c698dc86aedfb46e9f2fc83bed85cb77b8aca47a966e3de0a0bb
SSDEEP 24576:QCDErelKauRC3+JRS6gVI39rTbhb86tMKujrXMs41xL54x1tnLvkt7:oxlC3+IC39rTV8LKGIxxL5+Tkt7
MD5 SHA1 SHA512 SSDEEP

Submit Download

db85LACT3x2r3wNY1Ggv2kP3RWm7g6.bat

Path C:\Users\Admin\AppData\Roaming\Windows Defender\db85LACT3x2r3wNY1Ggv2kP3RWm7g6.bat
Size 277B
SHA256 73a3d78ef59f9f9e85a2ed5ef965568a4c5d6df4f5e224598ba1d6e7968342e5
MD5 f2b98bb1e458e9131d3c1b790eaaa29f
SHA1 3b8c56881fb8348f31da1e496123356f9dff5f58
SHA512 81e1b1220b3aeb855eaac476739a6c3cea8507778ebcbbdb212d894742bf0360b777902179659c975beb55eadca621f8058511f81498fb9d2b7b73ecaad1ee4d
MD5 SHA1 SHA512

Submit Download

db85LACT3x2r3wNY1Ggv2kP3RWm7g6.vbs

Path C:\Users\Admin\AppData\Roaming\Windows Defender\db85LACT3x2r3wNY1Ggv2kP3RWm7g6.vbs
Size 174B
SHA256 715ac9d03901a2115fa57012e9ebd0f3738fbe38087a34f3a5ea2359c877e1e5
MD5 79e9e67f6ce0751bc0bd8d286ff3bb1b
SHA1 cb801164b05ee2ff67b6c38e70707876d5bdac95
SHA512 6d3dccdc599cbed75f376f723724d2e24825a5f6362b0e63afe5e8d1d837e6d3e8b96637976d9f1999ec25059ef4483f7003e61a8e806138d0b5ea1a56eb3f41
MD5 SHA1 SHA512

Submit Download

DXM.REG

Path C:\Windows\DXM.REG
Size 228B
SHA256 74d31b08b87d2d325590a817fdd1f0670d71f37c554646695fa6c3962ad29996
MD5 344b5f44ae4efbe707cc73e4bfa3a5ff
SHA1 1eaf5db01012ccdd662132f19295a645e3b4ee26
SHA512 d59f5d53783311c09227347b75edad6a13393e3742e5ad31bf752e4d860abe93d683731fba8b92b28fd2ada47b9d3f0bcadac8da23a61af344dfef5f1ccfc92c
MD5 SHA1 SHA512

Submit Download

MSI661C.tmp

Path C:\Windows\Installer\MSI661C.tmp
Size 129KB
SHA256 ea31d23bf26c387f9ad67d2965e96faeb76544cd0fbe4c3a51a930c9cfdd3ef1
MD5 a5cb2395953ef099448e5780c8de0f5d
SHA1 5e5feaeebf2ca0c3f3c1fecce7285f6a74a3fc43
SHA512 375f1ecb66db26decba9d4dbcc3a6bdeef21c3c7a33218e36d1754b22c6f92cb29e7b9c52b866aa0ab4da708c6f2d7754b1b6e7ccfee1aca97f27023b4df4367
SSDEEP 3072:NYNtZ1nLeY3bKMhXvW7BgcMwMM35hwtp9:OnLetAXvWxTbQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1000-142-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/1608-0-0x0000000074DB2000-0x0000000074DB3000-memory.dmp

Download

memory/1608-1-0x0000000074DB0000-0x0000000075361000-memory.dmp

Download

memory/1608-2-0x0000000074DB0000-0x0000000075361000-memory.dmp

Download

memory/1608-48-0x0000000074DB0000-0x0000000075361000-memory.dmp

Download

memory/2356-185-0x0000000007A10000-0x0000000007A1A000-memory.dmp

Download

memory/2356-181-0x0000000007FE0000-0x000000000865A000-memory.dmp

Download

memory/2356-127-0x0000000005E90000-0x0000000005EF6000-memory.dmp

Download

memory/2356-128-0x0000000006000000-0x0000000006066000-memory.dmp

Download

memory/2356-125-0x00000000057B0000-0x0000000005DD8000-memory.dmp

Download

memory/2356-138-0x0000000006070000-0x00000000063C4000-memory.dmp

Download

memory/2356-139-0x0000000006680000-0x000000000669E000-memory.dmp

Download

memory/2356-140-0x00000000066A0000-0x00000000066EC000-memory.dmp

Download

memory/2356-124-0x00000000050B0000-0x00000000050E6000-memory.dmp

Download

memory/2356-191-0x0000000007CC0000-0x0000000007CC8000-memory.dmp

Download

memory/2356-190-0x0000000007CE0000-0x0000000007CFA000-memory.dmp

Download

memory/2356-169-0x000000006E640000-0x000000006E68C000-memory.dmp

Download

memory/2356-179-0x0000000006C30000-0x0000000006C4E000-memory.dmp

Download

memory/2356-168-0x0000000007650000-0x0000000007682000-memory.dmp

Download

memory/2356-180-0x0000000007690000-0x0000000007733000-memory.dmp

Download

memory/2356-126-0x0000000005620000-0x0000000005642000-memory.dmp

Download

memory/2356-182-0x00000000079A0000-0x00000000079BA000-memory.dmp

Download

memory/2356-189-0x0000000007BE0000-0x0000000007BF4000-memory.dmp

Download

memory/2356-186-0x0000000007C20000-0x0000000007CB6000-memory.dmp

Download

memory/2356-187-0x0000000007BA0000-0x0000000007BB1000-memory.dmp

Download

memory/2356-188-0x0000000007BD0000-0x0000000007BDE000-memory.dmp

Download

memory/2672-63-0x0000000007850000-0x000000000785A000-memory.dmp

Download

memory/2672-64-0x0000000007980000-0x00000000079D6000-memory.dmp

Download

memory/2672-62-0x00000000078E0000-0x0000000007972000-memory.dmp

Download

memory/2672-61-0x0000000007DF0000-0x0000000008394000-memory.dmp

Download

memory/2672-55-0x0000000007750000-0x00000000077EC000-memory.dmp

Download

memory/2672-54-0x00000000006C0000-0x0000000000DF2000-memory.dmp

Download

memory/2672-219-0x00000000006C0000-0x0000000000DF2000-memory.dmp

Download

memory/2672-53-0x00000000006C0000-0x0000000000DF2000-memory.dmp

Download

memory/2672-47-0x00000000006C0000-0x0000000000DF2000-memory.dmp

Download

memory/2908-95-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2908-144-0x0000000000400000-0x0000000000415000-memory.dmp

Download