f1cbc8dc31d4d92e24861352d6df7400e92cecde655927efa7840e5df8b860c0

Analysis

max time kernel
148s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 15:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

955645f4b83364230ce65a74468455f5_JaffaCakes118.exe
Size

40KB
MD5

955645f4b83364230ce65a74468455f5
SHA1

719864b058d7e4d8f99f523a043913e7d0c64466
SHA256

f1cbc8dc31d4d92e24861352d6df7400e92cecde655927efa7840e5df8b860c0
SHA512

24e7bd01426aecd1a393c01c4542335bb4f13643cbfb89e34acd3d22e276122404fad4e27299a5ed8e3408cbb4b49bffabadbc3ee53c449c071864c2d8f0bdfe
SSDEEP

768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtH6Q:aqk/Zdic/qjh8w19JDHf

Score

10^/10

google persistence phishing upx

Malware Config

Signatures

Detected google phishing page
phishing google

Executes dropped EXE 1 IoCs

pid	Process
2772	services.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2772-11-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0028000000016b5e-8.dat	upx
behavioral1/memory/2772-17-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2772-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2772-27-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2772-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2772-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2772-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2772-57-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2772-60-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2772-64-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2772-65-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2772-69-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2772-73-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2772-74-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2772-552-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	955645f4b83364230ce65a74468455f5_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	955645f4b83364230ce65a74468455f5_JaffaCakes118.exe
File opened for modification	C:\Windows\java.exe	955645f4b83364230ce65a74468455f5_JaffaCakes118.exe
File created	C:\Windows\java.exe	955645f4b83364230ce65a74468455f5_JaffaCakes118.exe

Modifies system certificate store 2 TTPs 10 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	955645f4b83364230ce65a74468455f5_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	955645f4b83364230ce65a74468455f5_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	955645f4b83364230ce65a74468455f5_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	955645f4b83364230ce65a74468455f5_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	955645f4b83364230ce65a74468455f5_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	955645f4b83364230ce65a74468455f5_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	955645f4b83364230ce65a74468455f5_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	955645f4b83364230ce65a74468455f5_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	955645f4b83364230ce65a74468455f5_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	955645f4b83364230ce65a74468455f5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2772	2504	955645f4b83364230ce65a74468455f5_JaffaCakes118.exe	28
PID 2504 wrote to memory of 2772	2504	955645f4b83364230ce65a74468455f5_JaffaCakes118.exe	28
PID 2504 wrote to memory of 2772	2504	955645f4b83364230ce65a74468455f5_JaffaCakes118.exe	28
PID 2504 wrote to memory of 2772	2504	955645f4b83364230ce65a74468455f5_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\955645f4b83364230ce65a74468455f5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\955645f4b83364230ce65a74468455f5_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e8c0da46b7605794a77709a269b9cb8

SHA1
8b5d292262ee031bdfd4803aa472b82107fa84fd

SHA256
8e5771aeae9cb461da06b4fe7b64721dd37e263025450d91b2af75a50cb64fcf

SHA512
3c34cb9075a99f34360f7b731231b2be90092cde0de910f498e2f492e3ace6d20b76f23e83108a984d5b3fd2b48a1273fcf2e8fbd0a64e9dfecbc967edfed8e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81c5c4321b4566747fdca5dc19f4ceb3

SHA1
33d5855e7ba2cad8714e3e539c7afcd2ef674803

SHA256
8d8f1f933ff1e7479c134cfe8afb5469f74e1038adfd1086c599a6b2cb7c6846

SHA512
cebfacf0776a28e2d92ee1c1a7eee207076822bef5f5770c6918df462dfa1691d5b21de095fad0f15725bcd127a439d1afa80144d13c004bf178e56b4d3a19f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5a4339f679e6c7ddcb4cdf7857d9ab6

SHA1
d11a282ed8f441a9f80693c073b6ecad85443945

SHA256
d6c69b81e0b3d52067ad3514f1691bf08ac4f68163f5b5e71abd1c3583dedb3b

SHA512
9de7e3587d50feb6fde497a743e44db2cf49c285719227dfc616537b3649fd548f6d5d0705890eff31c2a973b0135f6af9ea1ab69aa799ab3c90b9e8f29ed408

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77b81a139c77a4e821b451914a047913

SHA1
4866e4a2dc670c84e2ecbed44f441791ab7bf45c

SHA256
72d1a816231a820a0a02e67d02a82053b628307a3a7087b588ca8dc87081a9bb

SHA512
d6f5615b5658d12f5e685610ebfb33bd81c6f5760ec89d0bc34db098620a19591d846a358674b90679e190ba9a71ae5cd29cc879c68f0b59cddcbc36e4af0118

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aad483e9a764c1ccdeda95f44718a333

SHA1
58ef3f75f38ab2c2dd5cbe7ba331bd8080232cd5

SHA256
0fa13a470db90fc630d034fcff94714f872cd35711373947b1d1e36a2941cfbb

SHA512
3dabe9a0d98fd34c5e7f57c9ba63f6634445154b60b7c4ba957ec1a0f085b454d5998aa32b80d8974d1b9abd274a56ffe4c723380dff9f10f588d7f44c2cad19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4c93f5a0b09f25e59204d9db0c2f1b3

SHA1
d94625d035983d36b5e5079caa127358aa03b85d

SHA256
255e20f5a6f1b40679b7e3d56e978caf5d89c8a1e16ac82dc503d75c7a308b67

SHA512
94fb2283248353498bff51805d2d470f4d0a493a908f08329b2bed8cdd53d23b104614e70f16f6f4ccc562634e56ea9de5f565abd1d691be983c1ba86622cfc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86b4df9ee42c9d1129c2b6b8c4bb0662

SHA1
317e1afc5e1f507ed76029ae7aab4531452e8fae

SHA256
ec9e3d55b8ff300ab8ad2c4dd065976da4401db3b1eedae54d427657f4363989

SHA512
4d678643c45f89df3ba8d0f81709a245aa664447a4ca4eb1d81d58581f7cacdb93bca1981aced9792bf4139c29bec5efa870faea9cc26f47b313fece1fc4300b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e7ea91078fe48842ec520071ad74cd1

SHA1
57715f89ce82f08c6b417e8886b3dad541a1bd87

SHA256
a29bd223794cf587aaed1fec761c9d1e88741b600ce207043c6ae8a52e19a2fb

SHA512
9e0575598b964595568a05aa7d5a521d63f19c4ed5893d050e28773f1047d363064f03697b4c7cd6eddf21d2d7542a5fa5a080159a3f930c861978150450747c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c848d2ec0ab589b65fa0fb4733324bc2

SHA1
83e270c77c50049b5318e645e8d1bb4da041778c

SHA256
1f09044d821c4b5d126f3d0ab75a4a95e717556ab394caedbd8212de78cbac72

SHA512
d7608797610de66997165a83793b360aa7c03c83b99c4b67a45d337d2e81b193ccba5eedf232c783a143f842df525abb00bc935409f24524162bff30dfd2603d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7c265a1d73a488f7649918f39bf1ed1

SHA1
de326b3f0d642a78d147acff86341beed414d8fd

SHA256
98af98ed1eed443d741fd4fc634042065637b4c538cdd79e07e96b0e530d6bea

SHA512
7349abec4878c8ebfbffa7f87cc5b26df39492f0ee056c26cec5c832aa74ad7175636bec309179e864ffa01680973c7aad9f05c639e49bc51218b1a9731b5105

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c565cded440588eac2fec0e49dc78a1

SHA1
2698948f05d4fd609f4893900c978e66090271dd

SHA256
6c8cbdcabf90ca399241d49795cce49a09640425ee25827639134e5aede281db

SHA512
d3f3b9eb15a4a7431a5c3a4f4f9b36bb6f6f61b27376e9143e1cff666e004052e3b76c067b712a655b5cea5c3c8705c8f6a20b3345147da6e5269fb1eb81181f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6979d59c305420b2e449e7598a65806e

SHA1
a462b00242bbab999f72f2130889ab4c4302f3eb

SHA256
e8e319b6c53bb6a4abdc571dabf19d1bc58bd0914e5bb39bbbb9321d642f71cd

SHA512
05c859f4667b4bb16eef303db2703ccd96ccf0b316690d9e158d0fa6340a2096c5aa1385249feea0a13ec96c0447d517f982f842305e9bfb719f76280258f346

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
864f9196678c6ef5dabffc2188804421

SHA1
6e8f8d1de5a14d01644f16db424558fe6624e8e5

SHA256
ca2f3eb90985d235389263d01c8f77801c3e9fd6066ea6e9793c0669fce902d5

SHA512
156c07ee0f22455eef9a73fd4ade9ef73d02b202cf90857e82bf6ea5e809156a9e4155066ddb406d729a77ef2d8a84792c1af4a443ae51581b986a80579ed449

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ef5d73ee389d8ba470d46612c71b4b4

SHA1
39594ee397283ea093484a2e91efd07414795fd8

SHA256
12800cfb8de57c081596a8b9c7a4f2edb639c46576bf7d342d4d1ec4852101d9

SHA512
e1106beb458e636d1dd2f3c6b061af03994c6e35ecb81795701cfc561c91db798fdb39bf48725bad01c4fa11281541d0847a6c386647ea8c0dfc6885d32534bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a5ce13ee8ba30231803bae60edb001e

SHA1
ac6bb575a2a6e392e19559f7aebc7aff1456a0a1

SHA256
7f6f6d368c76d6e59621f41209dbc48e8d6cfbbf6750f9f35005a786b2b30900

SHA512
880252142a24e75f706aa90d995ede15a3b445cbfe62e42bce20d3226ba9e0f9abc26567958e5f562c4d428e34ac918b28dadae13cce5246fcdf75cf6b29c3e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa7befeccd405699fb2763c60a3b8099

SHA1
afd438a1bddf27557d33141f8f8a2a2942d270de

SHA256
24c1bcd77b7c7a5456b2abb5faa60aa638c9a8e5c64bbddb50708ff0b7ad1932

SHA512
0410e21ab451c76ae1d2fbb156a9e6a25dc32f3c8e4e53e0611be5d2c67eaec88f0ce5d371fbb2315f140a9a908717c5251aa922245e4bbe92e77574be7e0164

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9c211358d116e80b2a315e8d37890cc

SHA1
033a1d259b2714450c1734d59f77023a1952e1e1

SHA256
6ce178c3f139cba680693d339a808fa642aa86cdf64af15eab786101f0c2945a

SHA512
516e567a4d50a0b01568e50698032d1e7f11285e6a9151b02c8242a4d158ea532a0357eef9079ac56ad8b07f8fbded7b2e3795466221472f6b8138a3f0eeae55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\default[1].htm

Filesize
308B

MD5
ccfe63b884fe4225fa33f618a54ce37a

SHA1
bbb0778c1597eafe7fb9c5c65412f8ab04b2e311

SHA256
f7dd5bab49466a4cdb6a7f5a0e07a158f7a1567bd809ed745812469775b33112

SHA512
858f345503c89ba075b374764145fba5b1a9d3440d1628edeab0a3e02cc7cbfbe1119c20747026e69d630ed262d3c91c5073ef06823cf727dfcb11605c7c5ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\results[5].htm

Filesize
1KB

MD5
211da0345fa466aa8dbde830c83c19f8

SHA1
779ece4d54a099274b2814a9780000ba49af1b81

SHA256
aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5

SHA512
37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\search[3].htm

Filesize
167KB

MD5
70c27ad5eb36d2407ff286e56e9df21f

SHA1
ba3edff97b588e25d0bb1afdb4a31056caf2ee1e

SHA256
76492031a01e1eedba81f6aaa465f24c1e375273c0da84e90b0c7f3a18739ceb

SHA512
10826ecd16fa0156beb2238a9bd854e53b326834a5ce73053c0785ad88812950f9731eac9929946350c7cfa8d8f13715814af98b885c809c64e224fed18973d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\search[4].htm

Filesize
130KB

MD5
c515032f2b3aa0a98c7b828932260bc0

SHA1
325b277cf676252167d87cb10752d44d9cf76bd9

SHA256
be71b3a22abe62302d90c3b44523e9c0cabce734adfabfdb15cd8c2f99b09209

SHA512
8f6f380a5cf21844915af68905890106fe81be395f628f90a5d113469a1022d0651a19c32f954a7962292936d777f77d134db85b7183b3d76f96321b33b520cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9M0HR0P6\results[2].htm

Filesize
1KB

MD5
ee4aed56584bf64c08683064e422b722

SHA1
45e5ba33f57c6848e84b66e7e856a6b60af6c4a8

SHA256
a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61

SHA512
058f023cb934a00c8f1c689001438c9bdd067d923ddcbe7a951f54d3ca82218803e0e81fbc9af5c56375ff7961deed0359af1ffa7335d41379ee97d01a76ded6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9M0HR0P6\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9M0HR0P6\search[4].htm

Filesize
119KB

MD5
dc7ed3d3132321143138fc9ace90da76

SHA1
9f48115b4d2eeffbbb2a7f04aac14756c673d994

SHA256
4c7ec36e129e4305438262e8c5397a5dd7563f068019b42f9575076d50fa9036

SHA512
e5f2b2f58921fbd15705cbd3bbe445f17acfb092c10b768fd756e5fe62b0c0df448054852ba081f59892bf8b8a7818b48578dfcf3f5024b59143966f8d6494e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U8A9A2DI\6INEE4EE.htm

Filesize
176KB

MD5
92e2e5cce669f026e2918ed0d50a2070

SHA1
3e7bc503291dffea45d01e8a1011928eb6b0d35b

SHA256
8ff04a942855fddbd23f7668e199eaa55dc44ba940371ebd23c25d3f9020c89c

SHA512
ec8e04cefa935033c8313deec151a713e3f513cd245d97b161bb42af754c32471bb3aebcafed72799150698a61240b9237f2598119d8d4349d27f9b6cee5614f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U8A9A2DI\XIE0PGO7.htm

Filesize
176KB

MD5
42e0f31f3512c3f6551e9b6a0ff1c07d

SHA1
09fa8f7fa6fc508255603c1fbd06836bce70319b

SHA256
a72bca11ba1fd2f83804c35a132b2cb08be160b4816557376e08993e4962544f

SHA512
06f7d550118833c18528d0afa6899771fed77aa051ff32de8617f51d398d63a2141220aed5f8a65c203448cb72a912e7fc3b45d884d35a177cb2aa74bedfbe9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAE73.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAF11.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAF74.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA8FF.tmp

Filesize
40KB

MD5
37b84b662e50517a762265681bad83e9

SHA1
3b6363c2af4d799c85aca2b6f80edcb5ab58406a

SHA256
e6d408938be39f3894dc361d85d69f74d125c69af156ffef3b6baafe310efac6

SHA512
c5cdc5e51f535b38e8d09a6b15b06b8dcd6c2e969ac80a58442c28014039ed77babd215e62918b016d9c93d3a13ec1a67be46ee42bff8706f9e1eaf5dd163f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\yam3vgopNg.log

Filesize
1KB

MD5
0e2ad8cfd128a1201cebb3e06ef00931

SHA1
4a35e9604029934b4075929e48a119fc0fe6d662

SHA256
6e85e3e71c03a632c4f1bd38f54d71fafd6a08ba7e40dbaed9191b59b3fd871b

SHA512
1454f4a194818747174400eb1ade231be96ebfe3fad94519a0ec05b05afcd13ed81e1153bbf6456647f05033504d9c55258b07cd7456fc6be44d7df6b53cbd86

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
2cd82536bd7b74f3e08fe533275f44c6

SHA1
8d05d9fe4fa04daacd4bda7d2c06623afa913a3b

SHA256
7d8b2c2af2127a3f149104bf0d5a6436a2659b31d2a2cb83cf72fcfaa9b570cd

SHA512
dad321ed3d3233134780dcc8bd1625247421fc9eb1dece25b885c0953544501186ca8fe994f8fc05b6a82232b7e7011b9e71e6a17b45d67e93fe058e92cb93f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
7e2499b7589acdae28415312fe267be3

SHA1
6cc7c1b761210cb0b608b1a41aad4c0168b3a05e

SHA256
aff3d3736355b9d114694aaa9d1a3eb5d82e4ad496e4a8425b702d4db00edc02

SHA512
85cb9d0f9c2c9bcedf9206b1e4cccf60a2538eeb1be8d3e774ae4e5b19dcca9ae05efa0908626f56f55839d2f84b7e464d0a76ecccc52b1cf9d6f3f63096df25

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2504-22-0x00000000003A0000-0x00000000003A8000-memory.dmp

Filesize
32KB

Download
memory/2504-23-0x00000000003A0000-0x00000000003A8000-memory.dmp

Filesize
32KB

Download
memory/2504-10-0x00000000003A0000-0x00000000003A8000-memory.dmp

Filesize
32KB

Download
memory/2504-9-0x00000000003A0000-0x00000000003A8000-memory.dmp

Filesize
32KB

Download
memory/2504-0-0x0000000000500000-0x000000000050D000-memory.dmp

Filesize
52KB

Download
memory/2772-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-65-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-60-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-27-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-73-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-69-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-17-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-57-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-552-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-64-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads