2440b83564af4a3282cbf36b7c908d45bcd7bdb8a966967ac0ab59a9524e5912

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 23:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.exe
Size 3.3MB
Sample240612-27slnsvbne
SHA256 2440b83564af4a3282cbf36b7c908d45bcd7bdb8a966967ac0ab59a9524e5912
MD5 a2e00a7c5e60a5b5af80b0b68e934ad2
SHA1 9633e5d5a5c0d8ef1fe7af893a5daaa71f5e1356
SHA512 9549e7ced0831d5029c95b28d0e3ac37584f5a90855efe6c3fa6db98f76a64119fcad506446bd075e43c8f7dff2ff8ba29466dd3b883b0d763bbc924d8e393f2
SSDEEP 98304:QFP3VSn0DJIxv6a+UlPHKHws7+Rw+Gn88fWr7:cJIF3KHws7Mj8fWf
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

discovery evasion execution

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Executes dropped EXE 3 IoCs

pid	Process
1752	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp
4600	gentlemjmp_irow.exe
4696	gentlemjmp_irow.tmp

Loads dropped DLL 5 IoCs

pid	Process
4696	gentlemjmp_irow.tmp
4696	gentlemjmp_irow.tmp
4696	gentlemjmp_irow.tmp
4696	gentlemjmp_irow.tmp
4696	gentlemjmp_irow.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
636	powershell.exe
4656	powershell.exe

Enumerates processes with tasklist 1 TTPs 21 IoCs

Process Discovery

T1057

pid	Process
2236	tasklist.exe
2260	tasklist.exe
2320	tasklist.exe
1256	tasklist.exe
3080	tasklist.exe
4508	tasklist.exe
4400	tasklist.exe
3836	tasklist.exe
3280	tasklist.exe
4048	tasklist.exe
4100	tasklist.exe
4944	tasklist.exe
1300	tasklist.exe
972	tasklist.exe
1144	tasklist.exe
3928	tasklist.exe
4536	tasklist.exe
3236	tasklist.exe
3848	tasklist.exe
4832	tasklist.exe
3336	tasklist.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp

Gathers network information 2 TTPs 5 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1384	NETSTAT.EXE
2012	NETSTAT.EXE
1264	NETSTAT.EXE
3632	NETSTAT.EXE
2840	NETSTAT.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
636	powershell.exe
636	powershell.exe
4656	powershell.exe
4656	powershell.exe
4656	powershell.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	636	powershell.exe
Token: SeDebugPrivilege	3928	tasklist.exe
Token: SeDebugPrivilege	4508	tasklist.exe
Token: SeDebugPrivilege	4536	tasklist.exe
Token: SeDebugPrivilege	3236	tasklist.exe
Token: SeDebugPrivilege	4400	tasklist.exe
Token: SeDebugPrivilege	4944	tasklist.exe
Token: SeDebugPrivilege	3836	tasklist.exe
Token: SeDebugPrivilege	3280	tasklist.exe
Token: SeDebugPrivilege	2236	tasklist.exe
Token: SeDebugPrivilege	2260	tasklist.exe
Token: SeDebugPrivilege	3848	tasklist.exe
Token: SeDebugPrivilege	4832	tasklist.exe
Token: SeDebugPrivilege	2320	tasklist.exe
Token: SeDebugPrivilege	1300	tasklist.exe
Token: SeDebugPrivilege	4048	tasklist.exe
Token: SeDebugPrivilege	972	tasklist.exe
Token: SeDebugPrivilege	3336	tasklist.exe
Token: SeDebugPrivilege	3632	NETSTAT.EXE
Token: SeDebugPrivilege	2840	NETSTAT.EXE
Token: SeDebugPrivilege	1384	NETSTAT.EXE
Token: SeDebugPrivilege	2012	NETSTAT.EXE
Token: SeDebugPrivilege	1264	NETSTAT.EXE
Token: SeDebugPrivilege	1256	tasklist.exe
Token: SeDebugPrivilege	1144	tasklist.exe
Token: SeDebugPrivilege	3080	tasklist.exe
Token: SeDebugPrivilege	4100	tasklist.exe
Token: SeDebugPrivilege	4656	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 1752	220	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.exe	89
PID 220 wrote to memory of 1752	220	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.exe	89
PID 220 wrote to memory of 1752	220	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.exe	89
PID 1752 wrote to memory of 4160	1752	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp	91
PID 1752 wrote to memory of 4160	1752	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp	91
PID 1752 wrote to memory of 4160	1752	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp	91
PID 4160 wrote to memory of 636	4160	cmd.exe	93
PID 4160 wrote to memory of 636	4160	cmd.exe	93
PID 4160 wrote to memory of 636	4160	cmd.exe	93
PID 1752 wrote to memory of 1384	1752	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp	97
PID 1752 wrote to memory of 1384	1752	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp	97
PID 1752 wrote to memory of 1384	1752	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp	97
PID 1384 wrote to memory of 704	1384	cmd.exe	99
PID 1384 wrote to memory of 704	1384	cmd.exe	99
PID 1384 wrote to memory of 704	1384	cmd.exe	99
PID 704 wrote to memory of 3928	704	cmd.exe	100
PID 704 wrote to memory of 3928	704	cmd.exe	100
PID 704 wrote to memory of 3928	704	cmd.exe	100
PID 1752 wrote to memory of 4712	1752	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp	101
PID 1752 wrote to memory of 4712	1752	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp	101
PID 1752 wrote to memory of 4712	1752	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp	101
PID 4712 wrote to memory of 3308	4712	cmd.exe	103
PID 4712 wrote to memory of 3308	4712	cmd.exe	103
PID 4712 wrote to memory of 3308	4712	cmd.exe	103
PID 3308 wrote to memory of 4508	3308	cmd.exe	104
PID 3308 wrote to memory of 4508	3308	cmd.exe	104
PID 3308 wrote to memory of 4508	3308	cmd.exe	104
PID 1752 wrote to memory of 1512	1752	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp	105
PID 1752 wrote to memory of 1512	1752	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp	105
PID 1752 wrote to memory of 1512	1752	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp	105
PID 1512 wrote to memory of 1264	1512	cmd.exe	107
PID 1512 wrote to memory of 1264	1512	cmd.exe	107
PID 1512 wrote to memory of 1264	1512	cmd.exe	107
PID 1264 wrote to memory of 4536	1264	cmd.exe	108
PID 1264 wrote to memory of 4536	1264	cmd.exe	108
PID 1264 wrote to memory of 4536	1264	cmd.exe	108
PID 1752 wrote to memory of 2688	1752	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp	109
PID 1752 wrote to memory of 2688	1752	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp	109
PID 1752 wrote to memory of 2688	1752	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp	109
PID 2688 wrote to memory of 4124	2688	cmd.exe	111
PID 2688 wrote to memory of 4124	2688	cmd.exe	111
PID 2688 wrote to memory of 4124	2688	cmd.exe	111
PID 4124 wrote to memory of 3236	4124	cmd.exe	112
PID 4124 wrote to memory of 3236	4124	cmd.exe	112
PID 4124 wrote to memory of 3236	4124	cmd.exe	112
PID 1752 wrote to memory of 4624	1752	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp	113
PID 1752 wrote to memory of 4624	1752	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp	113
PID 1752 wrote to memory of 4624	1752	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp	113
PID 4624 wrote to memory of 4432	4624	cmd.exe	115
PID 4624 wrote to memory of 4432	4624	cmd.exe	115
PID 4624 wrote to memory of 4432	4624	cmd.exe	115
PID 4432 wrote to memory of 4400	4432	cmd.exe	116
PID 4432 wrote to memory of 4400	4432	cmd.exe	116
PID 4432 wrote to memory of 4400	4432	cmd.exe	116
PID 1752 wrote to memory of 4128	1752	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp	117
PID 1752 wrote to memory of 4128	1752	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp	117
PID 1752 wrote to memory of 4128	1752	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp	117
PID 4128 wrote to memory of 820	4128	cmd.exe	119
PID 4128 wrote to memory of 820	4128	cmd.exe	119
PID 4128 wrote to memory of 820	4128	cmd.exe	119
PID 820 wrote to memory of 4944	820	cmd.exe	120
PID 820 wrote to memory of 4944	820	cmd.exe	120
PID 820 wrote to memory of 4944	820	cmd.exe	120
PID 1752 wrote to memory of 1392	1752	a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp	121

C:\Users\Admin\AppData\Local\Temp\a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:220
- C:\Users\Admin\AppData\Local\Temp\is-G6BCI.tmp\a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-G6BCI.tmp\a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp" /SL5="$E005C,3142311,56832,C:\Users\Admin\AppData\Local\Temp\a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\ex.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4160
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -NoProfile -NoLogo -Command "& {$avlist = @(); $os = Get-WmiObject Win32_OperatingSystem; if ($os.ProductType -eq 3) {Write-Host \"ServerOS|0\";} elseif ($os.Version -like \"5.*\") {Get-WmiObject -Namespace root\SecurityCenter -Class AntiVirusProduct | ForEach-Object {Write-Host \"$($_.displayName)|$(if ($_.onAccessScanningEnabled) {\"4096\"} else {\"0\"})\"};} else {Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiSpywareProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};} Write-Host ($avlist -join \"*\")}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:636
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1384
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq newversion.exe" /FO CSV
      4⤵
      Suspicious use of WriteProcessMemory
      PID:704
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq newversion.exe" /FO CSV
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3928
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq newversion.tmp" /FO CSV
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3308
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq newversion.tmp" /FO CSV
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4508
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1512
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Setup.exe" /FO CSV
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1264
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq Setup.exe" /FO CSV
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4536
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Setup (1).exe" /FO CSV
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4124
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq Setup (1).exe" /FO CSV
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3236
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Setup (2).exe" /FO CSV
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4432
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq Setup (2).exe" /FO CSV
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4400
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4128
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq HMA! Pro VPN.exe" /FO CSV
      4⤵
      Suspicious use of WriteProcessMemory
      PID:820
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq HMA! Pro VPN.exe" /FO CSV
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4944
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:1392
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Fiddler.exe" /FO CSV
      4⤵
      PID:2896
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq Fiddler.exe" /FO CSV
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3836
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:3888
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Wireshark.exe" /FO CSV
      4⤵
      PID:816
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq Wireshark.exe" /FO CSV
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3280
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:3724
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Capsa.exe" /FO CSV
      4⤵
      PID:4368
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq Capsa.exe" /FO CSV
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2236
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:4204
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq ipscan.exe" /FO CSV
      4⤵
      PID:4004
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq ipscan.exe" /FO CSV
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2260
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:2096
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Procmon.exe" /FO CSV
      4⤵
      PID:844
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq Procmon.exe" /FO CSV
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3848
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c tasklist /FI "WINDOWTITLE eq Process Monitor*" |find "PID"
    3⤵
    PID:840
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "WINDOWTITLE eq Process Monitor*"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4832
  - - C:\Windows\SysWOW64\find.exe
      find "PID"
      4⤵
      PID:1512
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:2572
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq regedit.exe" /FO CSV
      4⤵
      PID:368
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq regedit.exe" /FO CSV
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2320
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:3588
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Taskmgr.exe" /FO CSV
      4⤵
      PID:4624
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq Taskmgr.exe" /FO CSV
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1300
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:4484
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq OLLYDBG.exe" /FO CSV
      4⤵
      PID:4128
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq OLLYDBG.exe" /FO CSV
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4048
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:3288
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Regshot-x64-Unicode.exe" /FO CSV
      4⤵
      PID:1392
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq Regshot-x64-Unicode.exe" /FO CSV
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:972
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:4304
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Regshot-Unicode.exe" /FO CSV
      4⤵
      PID:2852
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq Regshot-Unicode.exe" /FO CSV
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3336
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\cmd.bat""
    3⤵
    PID:3224
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C netstat -na | findstr /C:":5900 " | findstr /C:"ESTABLISHED"
    3⤵
    PID:2696
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      netstat -na
      4⤵
      Gathers network information
      Suspicious use of AdjustPrivilegeToken
      PID:3632
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /C:":5900 "
      4⤵
      PID:4248
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /C:"ESTABLISHED"
      4⤵
      PID:3464
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C netstat -na | findstr /C:":5901 " | findstr /C:"ESTABLISHED"
    3⤵
    PID:1312
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      netstat -na
      4⤵
      Gathers network information
      Suspicious use of AdjustPrivilegeToken
      PID:2840
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /C:":5901 "
      4⤵
      PID:1584
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /C:"ESTABLISHED"
      4⤵
      PID:1648
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C netstat -na | findstr /C:":5902 " | findstr /C:"ESTABLISHED"
    3⤵
    PID:2260
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      netstat -na
      4⤵
      Gathers network information
      Suspicious use of AdjustPrivilegeToken
      PID:1384
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /C:":5902 "
      4⤵
      PID:556
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /C:"ESTABLISHED"
      4⤵
      PID:1436
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C netstat -na | findstr /C:":5903 " | findstr /C:"ESTABLISHED"
    3⤵
    PID:2496
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      netstat -na
      4⤵
      Gathers network information
      Suspicious use of AdjustPrivilegeToken
      PID:2012
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /C:":5903 "
      4⤵
      PID:4508
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /C:"ESTABLISHED"
      4⤵
      PID:1428
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C netstat -na | findstr /C:":5904 " | findstr /C:"ESTABLISHED"
    3⤵
    PID:4092
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      netstat -na
      4⤵
      Gathers network information
      Suspicious use of AdjustPrivilegeToken
      PID:1264
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /C:":5904 "
      4⤵
      PID:1944
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /C:"ESTABLISHED"
      4⤵
      PID:4360
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:3248
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq TeamViewer_Desktop.exe" /FO CSV
      4⤵
      PID:3188
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq TeamViewer_Desktop.exe" /FO CSV
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1256
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:3636
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq DFServ.exe" /FO CSV
      4⤵
      PID:4556
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq DFServ.exe" /FO CSV
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1144
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:3216
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq unchecky_svc.exe" /FO CSV
      4⤵
      PID:4820
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq unchecky_svc.exe" /FO CSV
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3080
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:4016
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq unchecky_gb.exe" /FO CSV
      4⤵
      PID:936
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq unchecky_gb.exe" /FO CSV
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4100
- - C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\gentlemjmp_irow.exe
    "C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\gentlemjmp_irow.exe" go=ofcourse product_id=UPD xmlsource=C:\Users\Admin\AppData\Local\Temp\a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.exe
    3⤵
    - Executes dropped EXE
    PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\is-3A7AU.tmp\gentlemjmp_irow.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-3A7AU.tmp\gentlemjmp_irow.tmp" /SL5="$25004E,2829670,143360,C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\gentlemjmp_irow.exe" go=ofcourse product_id=UPD xmlsource=C:\Users\Admin\AppData\Local\Temp\a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4696
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-0QRIB.tmp\ex.bat""
        5⤵
        
        PID:4468
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -inputformat none -NoProfile -NoLogo -Command "& {$avlist = @(); $os = Get-WmiObject Win32_OperatingSystem; if ($os.ProductType -eq 3) {Write-Host \"ServerOS|0\";} elseif ($os.Version -like \"5.*\") {Get-WmiObject -Namespace root\SecurityCenter -Class AntiVirusProduct | ForEach-Object {Write-Host \"$($_.displayName)|$(if ($_.onAccessScanningEnabled) {\"4096\"} else {\"0\"})\"};} else {Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiSpywareProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};} Write-Host ($avlist -join \"*\")}"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3364,i,3144109701624127473,12586215149656995128,262144 --variations-seed-version --mojo-platform-channel-handle=1416 /prefetch:8
1⤵
PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Process Discovery

Query Registry

Software Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d9c5347ed06755feeb0615f1671f6b91e2718703da0dbc4b0bd205cbd2896dd4
MD5 0774a05ce5ee4c1af7097353c9296c62
SHA1 658ff96b111c21c39d7ad5f510fb72f9762114bb
SHA512 104d69fc4f4aaa5070b78ada130228939c7e01436351166fe51fe2da8a02f9948e6d92dd676f62820da1813872b91411e2f863c9a98a760581ec34d4aa354994
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 17KB
SHA256 ce97734ac2b70efe47ad57acba1fafb0c7aabedd5a695f002b049e6016600263
MD5 11a93d026bccc2981050041016d32b47
SHA1 08bfc317b1f24cab421b9a080687d37ff67e0b76
SHA512 cef8692bbe7f56aab00a94da46c5605df8006eaebbf836453cd460ae7254fbe7b72202f10925b1b8a5b2fc46ebe70ca4b9ef4a38433d2c7a682eafab0d79c869
SSDEEP 384:Lrf2XWW9i+BE0i30norBFzJk+o9oPATpK6seYuvHjJ/qi3SoubCpPSamwNlo21:ffhoEpEorvejoPATpNjF5SQlJmq2M
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_no4ivep5.4no.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_no4ivep5.4no.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

_shfoldr.dll

Path C:\Users\Admin\AppData\Local\Temp\is-0QRIB.tmp\_isetup\_shfoldr.dll
Size 22KB
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
SSDEEP 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5 SHA1 SHA512 SSDEEP

Submit Download

ex.bat

Path C:\Users\Admin\AppData\Local\Temp\is-0QRIB.tmp\ex.bat
Size 786B
SHA256 6cb8e3fa874249b8ebec7f6d500d2908095eeee9e718253dba366fcfdecc4d45
MD5 fb51559c0a681e847e421a23496ecea0
SHA1 62c8feff4eb2bacbc90760b0245821695725b1dd
SHA512 dcd4e93d9e481c2814bd8a4893178259a74eba9f9804fb34c1657714a484aa5797154842ca27b6429b5ca52b73f81ddb1f63584630d03aaccd73dec04b9a5caf
MD5 SHA1 SHA512

Submit Download

innocallback.dll

Path C:\Users\Admin\AppData\Local\Temp\is-0QRIB.tmp\innocallback.dll
Size 63KB
SHA256 6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
MD5 1c55ae5ef9980e3b1028447da6105c75
SHA1 f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA512 1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
SSDEEP 1536:+VqUE7JhgAzj/ZuhnOwKWSAXvze/V2C0mswp91:gWgAnB3XDAqt/p91
MD5 SHA1 SHA512 SSDEEP

Submit Download

isskin.dll

Path C:\Users\Admin\AppData\Local\Temp\is-0QRIB.tmp\isskin.dll
Size 385KB
SHA256 25fdb94e386f8a41f10aba00ed092a91b878339f8e256a7252b11169122b0a68
MD5 92c2e247392e0e02261dea67e1bb1a5e
SHA1 db72fed8771364bf8039b2bc83ed01dda2908554
SHA512 e938d2a1870ccb437d818b5301e6ecffaa6efbf4f0122e1a1ae0981057d7d0376039ea927c6fd326456da2d6904803fca26b87245367a4c5de2aebc47bdcd4b5
SSDEEP 6144:n7c4NO6ULQo2ITc9xrhIfuNnoY+mhTBHvnqIRi+md:7cHQo2qaphIAp+mhT5vnq8i
MD5 SHA1 SHA512 SSDEEP

Submit Download

itdownload.dll

Path C:\Users\Admin\AppData\Local\Temp\is-0QRIB.tmp\itdownload.dll
Size 200KB
SHA256 b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
MD5 d82a429efd885ca0f324dd92afb6b7b8
SHA1 86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA512 5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
SSDEEP 3072:lfb9mvexZXivFFmLFam1BEsW61HgAIwSMaentFGTaIgBx9rs0NBGZZuey2E0QeqB:lfbueviGLVUyHgAIwSMaenTrNWcmE
MD5 SHA1 SHA512 SSDEEP

Submit Download

gentlemjmp_irow.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-3A7AU.tmp\gentlemjmp_irow.tmp
Size 776KB
SHA256 520558c6fd09ba906540414482d0e8ad245d519b897e545557704b16d43eade4
MD5 69cfd0a4426e7c22178ce43933423877
SHA1 aca503edfe6a04b3be6a6229752307cfa173b46c
SHA512 0b4daa8355492998a6ae29a1be39777998ed2c8f6b246c46c5ad665de3061d7823ab0ad57b8c4c260b7b4cf5f7e22914126f67891def8e9f96db89398455bb02
SSDEEP 24576:HQQP8YXpc/rPx37/zHBA6plp+51CErza87mx9I6:n9urPx37/zHBA6pGPmBf
MD5 SHA1 SHA512 SSDEEP

Submit Download

a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-G6BCI.tmp\a2e00a7c5e60a5b5af80b0b68e934ad2_JaffaCakes118.tmp
Size 691KB
SHA256 bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
MD5 9303156631ee2436db23827e27337be4
SHA1 018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA512 9fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
SSDEEP 12288:7QszP8NRMXpc/rPx37/zHBA66pE+4p1YR71CERdH6rN9by7HaOMe3mxyF:7QQP8YXpc/rPx37/zHBA6plp+51CErzP
MD5 SHA1 SHA512 SSDEEP

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\CheckProc.cmd
Size 144B
SHA256 9daadc1e6c019a712e5236eafc29e687ea79efd4de1310dc2eeb1ed165ea26c3
MD5 e902b4bcf5b531d057d091d00be3daee
SHA1 0cd058fcfab51dbfe91b139dc52245d5a4326f55
SHA512 5f7a84040b4bbf46173ff5404d970af5cb3e54c0dfc0d6ab6b161c2f417b6b1a023abe7b9f2b723b2985511894649c54c045204de01b2a52a51d7143e8f82c11
MD5 SHA1 SHA512

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\CheckProc.cmd
Size 118B
SHA256 201c4e665ce446e067cb152d1c3834e416f6a09a9e6d7c45c20f1bc1cc74534d
MD5 f0315949ccc3d22d958503f5735cfbcc
SHA1 883bf4e366046eb1ef6e2d81fd74fe75ae73b2c0
SHA512 aa1faa44ba8f47052bf236d5135dc70f1293028663f4abbc7cc043277428217b047b25d6e6691c1685db52bd2065f0d5c4306d9db590696773c3becf2481a251
MD5 SHA1 SHA512

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\CheckProc.cmd
Size 120B
SHA256 ef7d9a0d456e1901b0bdebdce961d480bcf8270a7d7646591bdc2886c8716218
MD5 c842d438cebab4b876572a8bc032aabe
SHA1 e95c7d4e2f6246daba6f0baec8e1b94c91384c4d
SHA512 aa8a28a1b0a0b9b65db195863fec9b903ffa335ccee7d50dc514f5d9c63f2ca51b2bf52694879adf43021cedfc4c5f8e7c3c90bb6dc493114a700cd79cce183c
MD5 SHA1 SHA512

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\CheckProc.cmd
Size 126B
SHA256 735ca381b6d3cbb675e698aa92222566d5174c0fbdf7807605f105c512c9fa1e
MD5 110d64c0e450ff59542f81690a2d53b7
SHA1 7f2e989deb095a0530792989e5fa9d7279d5f3e7
SHA512 00b86a1fd4db9e8861d3973a395c34b41a5a277901552b66ac671ced492638174f256785f563bfad263bc93315544bce87c91d26bd48a39fbab7daccceae0d34
MD5 SHA1 SHA512

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\CheckProc.cmd
Size 132B
SHA256 6b398a1053c39530e13afb3bad98900d9a5a6d27523a0c5d44c746afb539fe99
MD5 410515fbd7d2a2b4fab0fb80c76c2a74
SHA1 f32bd4fc7ade9efdc92b99e79a0b2f95edfc5893
SHA512 f301aaeb96aa848eb6823830397c9fb12086db558663235c8b0882cefe2ae105cc75e2cc70315ce2fdfa17d3538427f4afa6a9cf24834a884a10cb4cb87652aa
MD5 SHA1 SHA512

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\CheckProc.cmd
Size 128B
SHA256 ca1bf4fe8a59a31f06a4f2d975671fbb2eeca33d40b0c35318f2131a118754cf
MD5 dae8768bbb8a4fddc4dca8eae7c4d65f
SHA1 385ffb932fcff489392536d62e291ed9e0beea98
SHA512 492feada84b7064547bd6d22ed13cf6949156eb3daa9af5aa9c3da44dd6ac7e540904c494de14a7858d498944ab51c7525caac3c9aa933d1e55ca35442c075b6
MD5 SHA1 SHA512

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\CheckProc.cmd
Size 126B
SHA256 b96251154ddbfd11d36e74eae84537229912a54dcb86f1277deab084322ce4dd
MD5 8fec1ab28e8ee7394915990458fb85dc
SHA1 c70e183a783a9621cd64584de99f8163deb40872
SHA512 c33223c094764b9704ced1ab6256aa227873c2be81acce328d12113504e55716563ad561641b726dcd2939c6237b4a4dad522512a4f59e3f805f91ffaf3a3be9
MD5 SHA1 SHA512

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\CheckProc.cmd
Size 130B
SHA256 4b6e256fc13fdb04ac97e583dda99f6ade2356f9c692f5150b262d3e464bd71e
MD5 0cbb771b9f9523adb96d5bae77154a05
SHA1 528330a335047039ab012b01bb7a3f585e6f5a8d
SHA512 41f44acafb84b24e15ebee4a18c2ae39c06ad401db2272939ad1d650c27e1a219d7c05df63a7ec2ab0676c7ed34ca5c7ed1d4cfaa143998e90ce12f13875f0f1
MD5 SHA1 SHA512

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\CheckProc.cmd
Size 128B
SHA256 e9f9690b327cf24e6c260f93232dd4b961d82a709c16589ba72aabcdba0c039c
MD5 6a745081c62a706c014a876f45b5a56b
SHA1 25f17fcc50dd202d2381c00970e2dc04c2ad9707
SHA512 a420efa894ef6fedad4fafd5e15042f947ff96a169031b7299afeba797bcaefa675508f72f57bfa8452a35d61314a544e26bc535ddb61a0cdfdca03c07ae372f
MD5 SHA1 SHA512

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\CheckProc.cmd
Size 132B
SHA256 55b728e4cc0974b19641d1dc77df0f381f244b254d39e2566dcf525b9d106cd8
MD5 97cc4c6dda23b9631b8c9185859ad061
SHA1 5f912a6c094bd918afe5e9f0c70cd45b36dff722
SHA512 cf82517f44425d402305129821cff7668c5db27d5427b8a8886e99146a1a56ef43b8055e6c62929fbfdf293a88664a760e49443ac89453fa3163ed1ebfb8469e
MD5 SHA1 SHA512

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\CheckProc.cmd
Size 122B
SHA256 953998031a5ac3582232545f923b32f02587fb233791a0326b889f28af4cfabc
MD5 b921f2f9f97a642d513e1307f7685e0f
SHA1 3489b63a484a6114f1828100908bbbc622b07ed1
SHA512 1da42e0ed2dca9f2a559739c6a0c6b28a54e0d8d0617bec542729a362dd0f36f9287bcd4433c9cabd7db7430e7295f6879c7777a86035c4f3c86b3b05847ae0e
MD5 SHA1 SHA512

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\CheckProc.cmd
Size 126B
SHA256 9b78165c2b44ba6675654f776e34815c19482a84c87e6a7dc9d1a68d3d5a5e53
MD5 b35e8ab65e7f8a4edb3663885f775681
SHA1 49b66b2e3cff64dd7d8315c53d852c19a46e8609
SHA512 3ec1fad817117f00f620103666b1caa2ece51b9cc1a9b3fb2142d57aedc745e9bc69608e0cb2a2eff1879c7ad6741b66751049020620bac8659598080404adcc
MD5 SHA1 SHA512

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\CheckProc.cmd
Size 118B
SHA256 a02aa2b143a8e126b1a044e1f036a912a0ac134e8e1f56836805b15819e43f6b
MD5 f1b6aae3dcd94b94aee326517e3dc583
SHA1 3418fdda1ad30df64d7bac068e1a0c4e305cfd75
SHA512 dae27c24d2ef685e4f968dcd91cda18bfa605fd924b1bf928307107630bd671d6623e78451d3f397dfc93cc4e1c0f74c25e962b5669e2350a79b72ec061ec1ba
MD5 SHA1 SHA512

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\CheckProc.cmd
Size 120B
SHA256 c3fabcab01d67640320ce0a5354e4fc6a7832beebe2e9a7610f43614eefce32c
MD5 d93cc818d32f755945cddfc02b29fb89
SHA1 fc564e791326d269d005c894cfca674352dae814
SHA512 62c20691da188a45b59c468826706ed47ad285d9e23996b714c03b4c639d87d93b57e22f9e4504be42a742ee4c64657d87565f9ce65b677d05f66d0bbef0e0d5
MD5 SHA1 SHA512

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\CheckProc.cmd
Size 122B
SHA256 e3c86ead8667eac8c9ea88e2ee5f5f14f0f0be59a54864f99cbee17d554f74e5
MD5 660d266764b1952b43431d6c7dc0dfa9
SHA1 809794738d6ca580d6ec14e77a717e831b0d0e5c
SHA512 6fc27ec6f453c2791aa9d0c38817128ed8e2fff26748fbe0cfee6411d8a120970494b3504078a3079c90d409434f22b35974efd5cbbaf14ce3657715fc18f4c3
MD5 SHA1 SHA512

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\CheckProc.cmd
Size 122B
SHA256 2a5b80a6a1522b75fda6e7f99ceb912bc7db1bd6be11995fdcbde1ab7d836dba
MD5 59a8010aab7eb203cd9fda8f6be1beca
SHA1 b9a07636b921183c88880320294e279c935cddd7
SHA512 26ae700f89e827f9d5f8d29c7f393eb3e5885d32266591d61b20ffd7ba1d08dfbc0e6e9368c94288185a01960cbd0a8ce96b063187396465e640e963e9b3666e
MD5 SHA1 SHA512

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\CheckProc.cmd
Size 122B
SHA256 ff1f1293c860b0709d0244a8c6a29294543efdc698a70469e1cd388c0db84493
MD5 a59dd0f9883ea39c5119831b0eed46cc
SHA1 8c9354051f7d92310636f0f17e5770aede9d1ad3
SHA512 4a07eac5507fc174879eb960becf19b3a20b224232f74dfeb28d393bed3f181a0d4020efb9b656000d4ce756491c44f4f5a86dec184feca593c9bf6bd8700dac
MD5 SHA1 SHA512

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\CheckProc.cmd
Size 122B
SHA256 39863141871b63880b4282066451321a902a7e6b97264c9ffdfd8128ac8293b8
MD5 32b997a9d994996a4369a580e6541b7d
SHA1 d61b48404dd6f6dd43d90858ffb7ddb967ecb1f1
SHA512 f3ff262b5986436671b4cf970d2ab4eb0dfd3d70651e7e84c8ae38788ef12032db825b81e6e1d8c4f20f0aa5a8067e6e7943b7e3e3c9817e97f0ab227f3fbe1f
MD5 SHA1 SHA512

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\CheckProc.cmd
Size 146B
SHA256 176a95493ca3bbfc9a68b4283b53a291faef0f9a7c413b43e1bdad86834a820d
MD5 f0b99c1273d3787f7769feb4d56e6803
SHA1 6105232df9585072be8ca04712f8760812943cbf
SHA512 73b313c0046f6fcec974f2af64859c0af122e9f86503c7427519b7d2aaaf67e2f8cc68de17b93f24604aff815b843fce9a01571c1db48d3c12867e49daab0133
MD5 SHA1 SHA512

Submit Download

CheckProc.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\CheckProc.cmd
Size 138B
SHA256 cfe680c9896cade2f5163ee0a463a7f7dbae7ee4aadf8de15c6c119a1d582016
MD5 755c6764b8ecbb83798450705f51510f
SHA1 deb141c4fc3220f0ff5c16eabf1adf850bf55610
SHA512 a6292b9416cbbc4a407d143acd502b6a726abb5411309e292f6696a7e55ecb5b78b4bdc764dc3484e85a5a40f21d410018172544b00882759b251aa9dce5df89
MD5 SHA1 SHA512

Submit Download

av.txt

Path C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\av.txt
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

cmd.bat

Path C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\cmd.bat
Size 81B
SHA256 758ab706cff6cd44d8d559e8af095c23d054d96855203f37a00f2247dcdbe6f3
MD5 c188314a3ec2d8b636c1631bdc24884c
SHA1 8f46113d3ffb821812102c020acfae3793ca439d
SHA512 d4ddf18cf8547436048aca8e5845c99128cbd073b2e2ac8f53eaed86703fb77a505ba59888ae9ca9f6c4ec377143c06acec4211cff8500229c163d2ef5c86972
MD5 SHA1 SHA512

Submit Download

ex.bat

Path C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\ex.bat
Size 786B
SHA256 7d201c033be1148db29a2b25726330e392e5e51a69be05b4cbca594b4e572ad3
MD5 26565e22a44a7dffe837b4473a71b13a
SHA1 4e488f4abc8d5bf5d0122820e2a2f59a82c8f4ad
SHA512 78daaac8fb6e6fabeb3fb305485a7e5eea90e383d5a2ec922b3f3de1acebf34221fcd4d5672f576de28b234d132e401f6b348c3ecd555480906b474e4fe16968
MD5 SHA1 SHA512

Submit Download

favicon.ico

Path C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\favicon.ico
Size 10B
SHA256 dd7aaa38192189cbf2adfc9416289be6ea3c2e10f2ca08bae453cb1df66babc1
MD5 f0b81e3ecd1b5d144558da07bece8803
SHA1 9ee5bf12a207859d89dc893b8d02bd5c739edb52
SHA512 774a7485d316be62ca6a2303cf0e8f59611b804eb2d518dd76bcdbf755544818032be367d9c2d5ad778059b0c2da2d5a0e46e2a5420d6fd2da3cc0b2bcbe34a6
MD5 SHA1 SHA512

Submit Download

gentlemjmp_irow.exe

Path C:\Users\Admin\AppData\Local\Temp\is-ST7NP.tmp\gentlemjmp_irow.exe
Size 3.0MB
SHA256 9684c5954cc5d4795a31ea284befd02c2bfb9ac4fc928d1bdcc5bdb84b393374
MD5 26268a4ccaa1c4447c572efc39206ff7
SHA1 79007dee2e32d55aeec84310cc1be1f8cee217be
SHA512 8694d7e9ce44011c800b9f7bf1e2d2c8aa055ac7216bab214026518d79028b6b44bd6920203d0c676529f4aa262dafe9b109a8bf0c72098fd60477ab62b41ddd
SSDEEP 98304:FcVrROcpoXYUt9HRX1aPBHVzNBls1//lvi7U:aVtOKbUt5aP1Vzps1//lK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/220-2-0x0000000000401000-0x000000000040B000-memory.dmp

Download

memory/220-144-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/636-21-0x00000000060D0000-0x0000000006136000-memory.dmp

Download

memory/636-15-0x0000000003130000-0x0000000003166000-memory.dmp

Download

memory/636-33-0x0000000006730000-0x000000000677C000-memory.dmp

Download

memory/636-34-0x0000000007700000-0x0000000007796000-memory.dmp

Download

memory/636-31-0x0000000006140000-0x0000000006494000-memory.dmp

Download

memory/636-35-0x0000000006C00000-0x0000000006C1A000-memory.dmp

Download

memory/636-20-0x0000000005FF0000-0x0000000006056000-memory.dmp

Download

memory/636-19-0x0000000005820000-0x0000000005842000-memory.dmp

Download

memory/636-36-0x0000000006C70000-0x0000000006C92000-memory.dmp

Download

memory/636-41-0x0000000073D10000-0x00000000744C0000-memory.dmp

Download

memory/636-18-0x0000000073D10000-0x00000000744C0000-memory.dmp

Download

memory/636-17-0x00000000058D0000-0x0000000005EF8000-memory.dmp

Download

memory/636-16-0x0000000073D10000-0x00000000744C0000-memory.dmp

Download

memory/636-32-0x00000000066F0000-0x000000000670E000-memory.dmp

Download

memory/636-38-0x0000000008990000-0x000000000900A000-memory.dmp

Download

memory/636-14-0x0000000073D1E000-0x0000000073D1F000-memory.dmp

Download

memory/636-37-0x0000000007D60000-0x0000000008304000-memory.dmp

Download

memory/1752-7-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/1752-143-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/4600-141-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4600-92-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4656-123-0x0000000005EF0000-0x0000000006244000-memory.dmp

Download

memory/4656-134-0x0000000006710000-0x000000000675C000-memory.dmp

Download

memory/4696-117-0x0000000003D30000-0x0000000003D45000-memory.dmp

Download

memory/4696-110-0x0000000003B70000-0x0000000003BAC000-memory.dmp

Download

memory/4696-139-0x0000000003B70000-0x0000000003BAC000-memory.dmp

Download

memory/4696-140-0x0000000003D30000-0x0000000003D45000-memory.dmp

Download

memory/4696-138-0x0000000000400000-0x00000000004D2000-memory.dmp

Download