cerber | 6a6e355d48de45bbf5a31ee44455aa0ec5f704421a35c6fc3a63d72b10dd524e

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 12:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe
Size

235KB
MD5

b8af782f98793a4b4ce9171b1b320291
SHA1

5fbd09b0a10eca16802880083f9df314b8a18f50
SHA256

6a6e355d48de45bbf5a31ee44455aa0ec5f704421a35c6fc3a63d72b10dd524e
SHA512

d158f22a1d381324e56169bba328247d046dbf26ab641f93acda007de595aeba4c3db5513181c411c0bd184b01af468c521da4553ae0a0aa6575079b897de927
SSDEEP

6144:2wHyslfEpazAAN91h1wOQ/dICSae2c4UJ8ltV2a:NlfcaF7BwOQ/dIqeh4S8l3

Score

10^/10

cerber defense_evasion discovery evasion execution impact ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# HELP DECRYPT #.html

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Cerber Ransomware</title> <style> a { color: #47c; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #333; font-family: "Helvetica Neue", Helvetica, "Segoe UI", Arial, freesans, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; } hr { background-color: #e7e7e7; border: 0 none; border-bottom: 1px solid #c7c7c7; height: 5px; margin: 30px 0; } li { padding: 0 0 7px 7px; } ol { padding-left: 3em; } .container { background-color: #fff; border: 1px solid #c7c7c7; margin: 40px; padding: 40px 40px 20px 40px; } .info, .tor { background-color: #efe; border: 1px solid #bda; display: block; padding: 0px 20px; } .logo { font-size: 12px; font-weight: bold; line-height: 1; margin: 0; } .upd_on { color: red; display: block; } .upd_off { display: none; float: left; } .tor { padding: 10px 0; text-align: center; } .url { margin-right: 5px; } .warning { background-color: #f5e7e7; border: 1px solid #ebccd1; color: #a44; display: block; padding: 15px 10px; text-align: center; } </style> </head> <body> <div class="container"> <h3>C E R B E R   R A N S O M W A R E</h3> <hr> Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great! You have turned to be a part of a big community "#C3rber Ransomware". <hr> If you are reading this message it means the software "Cerber" has been removed from your computer. <hr> <h3>What is encryption?</h3> Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. <hr> <h3>Everything is clear for me but what should I do?</h3> The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !Any attempts to get back your files with the third-party tools can be fatal for your encrypted files! The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files! When you make a puzzle, but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. <hr> There are several plain steps to restore your files but if you do not follow them we will not be able to help you, and we will not try since you have read this warning already. <hr> For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: <ol> <li>decrypt all your files;</li> <li>work with your documents;</li> <li>view your photos and other media;</li> <li>continue your usual and comfortable work at the computer.</li> </ol> If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. <hr> <div class="info"> There is a list of temporary addresses to go on your personal page below: <ol> <li>Please wait...<a class="url" href="http://52uo5k3t73ypjije.gg4dgp.bid/7748-A23A-C3C3-029F-5571" id="url_1" target="_blank">http://52uo5k3t73ypjije.gg4dgp.bid/7748-A23A-C3C3-029F-5571</a>(<a href="#updateUrl" onClick="return updateUrl();" style="color: red;">Get a NEW address!</a>)</li> <li><a href="http://52uo5k3t73ypjije.f0jlbj.bid/7748-A23A-C3C3-029F-5571" target="_blank">http://52uo5k3t73ypjije.f0jlbj.bid/7748-A23A-C3C3-029F-5571</a></li> <li><a href="http://52uo5k3t73ypjije.91006j.bid/7748-A23A-C3C3-029F-5571" target="_blank">http://52uo5k3t73ypjije.91006j.bid/7748-A23A-C3C3-029F-5571</a></li> <li><a href="http://52uo5k3t73ypjije.o8hpwj.top/7748-A23A-C3C3-029F-5571" target="_blank">http://52uo5k3t73ypjije.o8hpwj.top/7748-A23A-C3C3-029F-5571</a></li> <li><a href="http://52uo5k3t73ypjije.onion.to/7748-A23A-C3C3-029F-5571" target="_blank">http://52uo5k3t73ypjije.onion.to/7748-A23A-C3C3-029F-5571</a></li> </ol> </div> <hr> <h3>What should you do with these addresses?</h3> If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): <ol> <li>take a look at the first address (in this case it is Please wait...<a class="url" href="http://52uo5k3t73ypjije.gg4dgp.bid/7748-A23A-C3C3-029F-5571" id="url_2" target="_blank">http://52uo5k3t73ypjije.gg4dgp.bid/7748-A23A-C3C3-029F-5571</a>);</li> <li>select it with the mouse cursor holding the left mouse button and moving the cursor to the right;</li> <li>release the left mouse button and press the right one;</li> <li>select "Copy" in the appeared menu;</li> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>move the mouse cursor to the address bar of the browser (this is the place where the site address is written);</li> <li>click the right mouse button in the field where the site address is written;</li> <li>select the button "Insert" in the appeared menu;</li> <li>then you will see the address Please wait...<a class="url" href="http://52uo5k3t73ypjije.gg4dgp.bid/7748-A23A-C3C3-029F-5571" id="url_3" target="_blank">http://52uo5k3t73ypjije.gg4dgp.bid/7748-A23A-C3C3-029F-5571</a> appeared there;</li> <li>press ENTER;</li> <li>the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: <ol> <li>click the left mouse button on the first address (in this case it is Please wait...<a class="url" href="http://52uo5k3t73ypjije.gg4dgp.bid/7748-A23A-C3C3-029F-5571" id="url_4" target="_blank">http://52uo5k3t73ypjije.gg4dgp.bid/7748-A23A-C3C3-029F-5571</a>);</li> <li>in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet. <hr> Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: <ol> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>enter or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loading;</li> <li>on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>run Tor Browser;</li> <li>connect with the button "Connect" (if you use the English version);</li> <li>a normal Internet browser window will be opened after the initialization;</li> <li>type or copy the address http://52uo5k3t73ypjije.onion/7748-A23A-C3C3-029F-5571 in this browser address bar;</li> <li>press ENTER;</li> <li>the site should be loaded; if for some reason the site is not loading wait for a moment and try again.</li> </ol> If you have any problems during installation or operation of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=install+tor+browser+windows" target="_blank">https://www.youtube.com/</a> and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. <hr> <h3>Additional information:</h3> You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. <hr> Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. <hr> If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. <hr> Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files. </div> <script> function getXMLHttpRequest() { if (window.XMLHttpRequest) { return new window.XMLHttpRequest; } else { try { return new ActiveXObject("MSXML2.XMLHTTP.3.0"); } catch(error) { return null; } } } function getUrlContent(url, callback) { var xhttp = getXMLHttpRequest(); if (xhttp) { xhttp.onreadystatechange = function() { if (xhttp.readyState == 4) { if (xhttp.status == 200) { return callback(xhttp.responseText.replace(/[\s ]+/gm, ""), null); } else { return callback(null, true); } } }; xhttp.open("GET", url + '?_=' + new Date().getTime(), true); xhttp.send(); } else { return callback(null, true); } } function server1(address, callback) { getUrlContent("http://btc.blockr.io/api/v1/address/txs/" + address, function(result, error) { if (!error) { var tx = /"tx":"([\w]+)","time_utc":"[\w-:]+","confirmations":[\d]+,"amount":-/.exec(result); if (tx) { getUrlContent("http://btc.blockr.io/api/v1/tx/info/" + tx[1], function(result, error) { if (!error) { var address = /"vouts":\[{"address":"([\w]+)"/.exec(result); if (address) { return callback(address[1], null); } else { return callback(null, true); } } else { return callback(null, true); } }); } else { return callback(null, true); } } else { return callback(null, true); } }); } function server2(address, callback) { getUrlContent("http://api.blockcypher.com/v1/btc/main/addrs/" + address, function(result, error) { if (!error) { var tx = /"tx_hash":"([\w]+)","block_height":[\d]+,"tx_input_n":[\d-]+,"tx_output_n":-/.exec(result); if (tx) { getUrlContent("http://api.blockcypher.com/v1/btc/main/txs/" + tx[1], function(result, error) { if (!error) { var address = /"outputs":\[{"value":[\d]+,"script":"[\w]+","spent_by":"[\w]+","addresses":\["([\w]+)"/.exec(result); if (address) { return callback(address[1], null); } else { return callback(null, true); } } else { return callback(null, true); } }); } else { return callback(null, true); } } else { return callback(null, true);

Extracted

Path

C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# HELP DECRYPT #.txt

Ransom Note

C_E_R_B_E_R R_A_N_S_O_M_W_A_R_E ######################################################################### Cannot you find the files you need? Is the content of the files that you looked for not readable??? It is normal because the files' names, as well as the data in your files have been encrypted. Great! You have turned to be a part of a big community "#Cerb3r Ransomware". ######################################################################### !!! If you are reading this message it means the software "Cerber" has !!! been removed from your computer. !!! HTML instruction ("# DECRYPT MY FILES #.html") always contains a !!! working domain of your personal page! ######################################################################### What is encryption? ------------------- Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. ######################################################################### Everything is clear for me but what should I do? ------------------------------------------------ The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !!! Any attempts to return your files with the third-party tools can !!! be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle, but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. ######################################################################### !!! There are several plain steps to restore your files but if you do !!! not follow them we will not be able to help you, and we will not try !!! since you have read this warning already. ######################################################################### For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: 1. decrypt all your files; 2. work with your documents; 3. view your photos and other media; 4. continue your usual and comfortable work at the computer. If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. ######################################################################### There is a list of temporary addresses to go on your personal page below: _______________________________________________________________________ | | 1. http://52uo5k3t73ypjije.gg4dgp.bid/7748-A23A-C3C3-029F-5571 | | 2. http://52uo5k3t73ypjije.f0jlbj.bid/7748-A23A-C3C3-029F-5571 | | 3. http://52uo5k3t73ypjije.91006j.bid/7748-A23A-C3C3-029F-5571 | | 4. http://52uo5k3t73ypjije.o8hpwj.top/7748-A23A-C3C3-029F-5571 | | 5. http://52uo5k3t73ypjije.onion.to/7748-A23A-C3C3-029F-5571 |_______________________________________________________________________ ######################################################################### What should you do with these addresses? ---------------------------------------- If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): 1. take a look at the first address (in this case it is http://52uo5k3t73ypjije.gg4dgp.bid/7748-A23A-C3C3-029F-5571); 2. select it with the mouse cursor holding the left mouse button and moving the cursor to the right; 3. release the left mouse button and press the right one; 4. select "Copy" in the appeared menu; 5. run your Internet browser (if you do not know what it is run the Internet Explorer); 6. move the mouse cursor to the address bar of the browser (this is the place where the site address is written); 7. click the right mouse button in the field where the site address is written; 8. select the button "Insert" in the appeared menu; 9. then you will see the address http://52uo5k3t73ypjije.gg4dgp.bid/7748-A23A-C3C3-029F-5571 appeared there; 10. press ENTER; 11. the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling. If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: 1. click the left mouse button on the first address (in this case it is http://52uo5k3t73ypjije.gg4dgp.bid/7748-A23A-C3C3-029F-5571); 2. in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address. If for some reason the site cannot be opened check the connection to the Internet. ######################################################################### Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: 1. run your Internet browser (if you do not know what it is run the Internet Explorer); 2. enter or copy the address https://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER; 3. wait for the site loading; 4. on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed; 5. run Tor Browser; 6. connect with the button "Connect" (if you use the English version); 7. a normal Internet browser window will be opened after the initialization; 8. type or copy the address ________________________________________________________ | | | http://52uo5k3t73ypjije.onion/7748-A23A-C3C3-029F-5571 | |________________________________________________________| in this browser address bar; 9. press ENTER; 10. the site should be loaded; if for some reason the site is not loading wait for a moment and try again. If you have any problems during installation or operation of Tor Browser, please, visit https://www.youtube.com/ and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. ######################################################################### Additional information: You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. ######################################################################### Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. ######################################################################### If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. ######################################################################### Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files.

URLs

http://52uo5k3t73ypjije.gg4dgp.bid/7748-A23A-C3C3-029F-5571

http://52uo5k3t73ypjije.f0jlbj.bid/7748-A23A-C3C3-029F-5571

http://52uo5k3t73ypjije.91006j.bid/7748-A23A-C3C3-029F-5571

http://52uo5k3t73ypjije.o8hpwj.top/7748-A23A-C3C3-029F-5571

http://52uo5k3t73ypjije.onion.to/7748-A23A-C3C3-029F-5571

http://52uo5k3t73ypjije.onion/7748-A23A-C3C3-029F-5571

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
844	bcdedit.exe
1560	bcdedit.exe

Contacts a large (522) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Deletes itself 1 IoCs

pid	Process
228	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
2016	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe
2016	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpD72D.bmp"	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2016 set thread context of 2264	2016	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe	28

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BLANK.ONE	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# HELP DECRYPT #.html	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# HELP DECRYPT #.txt	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# HELP DECRYPT #.url	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BUSINESS.ONE	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\PLANNERS.ONE	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ACADEMIC.ONE	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2696	vssadmin.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2140	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 61 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20522292b4c0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CF6D63E1-2CA7-11EF-AC6D-CE8752B95906} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000009daf94e7b858f082d6f439e01980ef52eb4d51d1235c191195f5204802301395000000000e800000000200002000000040c219016593c09cb35e191ddcbcd27a24949e519e4c8c13b7f6e4efcf83a10590000000694ab1c782280a10557a6e73c930a9b752dd99d3c3709ca3336ffa4d1adb61e8cde7d2e286adcc991a264942980efc679af19a52cf5e8b5fc039974d42011bd7a63b4dcbb85ded0451c8eb8c1215be4837ae23f36b4547185e492020f97c640c0b796822f3e1d660aaed974c680f77c4c46ae9657fb571734d81efd1c11b5144b2b3b30e1d857a0cbfd81e15d64fa07f4000000022f50cfbe5f1cf4e2a93c7fcf948d0b5a0f9518285fbf8b199f5368b27a38d4a084e489cfd3a3d57121b25225d091e6375220dbb99489864d88ed2c8e90c0a5d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a039050000000002000000000010660000000100002000000075df34862ca2fb3a3d99a13ce26c0a9985f0fc59506e9e52d1dc16aabcb88ca8000000000e800000000200002000000093492e897b7020f3c1906b82548f10feef6077d63de0b02eb3cb5af1e5f1330020000000c8893898e4b4e421ed8f225ecac5b2f192c827e771b150395425485bea4f3ff5400000000872c838e10852c5d775ee9ada597df03f286c2d194b3c3fc08da01cb01f3885013a56749966999cb21301062c764cfac60270da320ab2d745116d39f6b86c5e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CF63DE61-2CA7-11EF-AC6D-CE8752B95906} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424790339"	iexplore.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2572	PING.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2264	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe
2264	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe
2264	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe
2264	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe
2264	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe
2264	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe
2264	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe
2264	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe
2264	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	2264	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe
Token: SeBackupPrivilege	2756	vssvc.exe
Token: SeRestorePrivilege	2756	vssvc.exe
Token: SeAuditPrivilege	2756	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2908	WMIC.exe
Token: SeSecurityPrivilege	2908	WMIC.exe
Token: SeTakeOwnershipPrivilege	2908	WMIC.exe
Token: SeLoadDriverPrivilege	2908	WMIC.exe
Token: SeSystemProfilePrivilege	2908	WMIC.exe
Token: SeSystemtimePrivilege	2908	WMIC.exe
Token: SeProfSingleProcessPrivilege	2908	WMIC.exe
Token: SeIncBasePriorityPrivilege	2908	WMIC.exe
Token: SeCreatePagefilePrivilege	2908	WMIC.exe
Token: SeBackupPrivilege	2908	WMIC.exe
Token: SeRestorePrivilege	2908	WMIC.exe
Token: SeShutdownPrivilege	2908	WMIC.exe
Token: SeDebugPrivilege	2908	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2908	WMIC.exe
Token: SeRemoteShutdownPrivilege	2908	WMIC.exe
Token: SeUndockPrivilege	2908	WMIC.exe
Token: SeManageVolumePrivilege	2908	WMIC.exe
Token: 33	2908	WMIC.exe
Token: 34	2908	WMIC.exe
Token: 35	2908	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2908	WMIC.exe
Token: SeSecurityPrivilege	2908	WMIC.exe
Token: SeTakeOwnershipPrivilege	2908	WMIC.exe
Token: SeLoadDriverPrivilege	2908	WMIC.exe
Token: SeSystemProfilePrivilege	2908	WMIC.exe
Token: SeSystemtimePrivilege	2908	WMIC.exe
Token: SeProfSingleProcessPrivilege	2908	WMIC.exe
Token: SeIncBasePriorityPrivilege	2908	WMIC.exe
Token: SeCreatePagefilePrivilege	2908	WMIC.exe
Token: SeBackupPrivilege	2908	WMIC.exe
Token: SeRestorePrivilege	2908	WMIC.exe
Token: SeShutdownPrivilege	2908	WMIC.exe
Token: SeDebugPrivilege	2908	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2908	WMIC.exe
Token: SeRemoteShutdownPrivilege	2908	WMIC.exe
Token: SeUndockPrivilege	2908	WMIC.exe
Token: SeManageVolumePrivilege	2908	WMIC.exe
Token: 33	2908	WMIC.exe
Token: 34	2908	WMIC.exe
Token: 35	2908	WMIC.exe
Token: SeDebugPrivilege	2140	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1636	iexplore.exe
1636	iexplore.exe
1192	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1636	iexplore.exe
1636	iexplore.exe
2256	IEXPLORE.EXE
2256	IEXPLORE.EXE
1636	iexplore.exe
1636	iexplore.exe
1192	iexplore.exe
1192	iexplore.exe
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2264	2016	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe	28
PID 2016 wrote to memory of 2264	2016	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe	28
PID 2016 wrote to memory of 2264	2016	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe	28
PID 2016 wrote to memory of 2264	2016	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe	28
PID 2016 wrote to memory of 2264	2016	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe	28
PID 2016 wrote to memory of 2264	2016	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe	28
PID 2016 wrote to memory of 2264	2016	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe	28
PID 2016 wrote to memory of 2264	2016	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe	28
PID 2016 wrote to memory of 2264	2016	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe	28
PID 2016 wrote to memory of 2264	2016	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe	28
PID 2016 wrote to memory of 2264	2016	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe	28
PID 2264 wrote to memory of 2612	2264	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe	29
PID 2264 wrote to memory of 2612	2264	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe	29
PID 2264 wrote to memory of 2612	2264	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe	29
PID 2264 wrote to memory of 2612	2264	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe	29
PID 2612 wrote to memory of 2696	2612	cmd.exe	31
PID 2612 wrote to memory of 2696	2612	cmd.exe	31
PID 2612 wrote to memory of 2696	2612	cmd.exe	31
PID 2612 wrote to memory of 2908	2612	cmd.exe	34
PID 2612 wrote to memory of 2908	2612	cmd.exe	34
PID 2612 wrote to memory of 2908	2612	cmd.exe	34
PID 2612 wrote to memory of 844	2612	cmd.exe	36
PID 2612 wrote to memory of 844	2612	cmd.exe	36
PID 2612 wrote to memory of 844	2612	cmd.exe	36
PID 2612 wrote to memory of 1560	2612	cmd.exe	37
PID 2612 wrote to memory of 1560	2612	cmd.exe	37
PID 2612 wrote to memory of 1560	2612	cmd.exe	37
PID 2264 wrote to memory of 1636	2264	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe	43
PID 2264 wrote to memory of 1636	2264	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe	43
PID 2264 wrote to memory of 1636	2264	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe	43
PID 2264 wrote to memory of 1636	2264	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe	43
PID 2264 wrote to memory of 2940	2264	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe	44
PID 2264 wrote to memory of 2940	2264	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe	44
PID 2264 wrote to memory of 2940	2264	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe	44
PID 2264 wrote to memory of 2940	2264	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe	44
PID 1636 wrote to memory of 2256	1636	iexplore.exe	45
PID 1636 wrote to memory of 2256	1636	iexplore.exe	45
PID 1636 wrote to memory of 2256	1636	iexplore.exe	45
PID 1636 wrote to memory of 2256	1636	iexplore.exe	45
PID 1636 wrote to memory of 2608	1636	iexplore.exe	47
PID 1636 wrote to memory of 2608	1636	iexplore.exe	47
PID 1636 wrote to memory of 2608	1636	iexplore.exe	47
PID 1636 wrote to memory of 2608	1636	iexplore.exe	47
PID 1192 wrote to memory of 2736	1192	iexplore.exe	48
PID 1192 wrote to memory of 2736	1192	iexplore.exe	48
PID 1192 wrote to memory of 2736	1192	iexplore.exe	48
PID 1192 wrote to memory of 2736	1192	iexplore.exe	48
PID 2264 wrote to memory of 228	2264	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe	49
PID 2264 wrote to memory of 228	2264	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe	49
PID 2264 wrote to memory of 228	2264	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe	49
PID 2264 wrote to memory of 228	2264	b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe	49
PID 228 wrote to memory of 2140	228	cmd.exe	51
PID 228 wrote to memory of 2140	228	cmd.exe	51
PID 228 wrote to memory of 2140	228	cmd.exe	51
PID 228 wrote to memory of 2572	228	cmd.exe	52
PID 228 wrote to memory of 2572	228	cmd.exe	52
PID 228 wrote to memory of 2572	228	cmd.exe	52

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Users\Admin\AppData\Local\Temp\b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe"
  2⤵
  - Checks whether UAC is enabled
  - Sets desktop wallpaper using registry
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Windows\system32\vssadmin.exe
      C:\Windows\system32\vssadmin.exe delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:2696
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe shadowcopy delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2908
  - - C:\Windows\system32\bcdedit.exe
      C:\Windows\system32\bcdedit.exe /set {default} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:844
  - - C:\Windows\system32\bcdedit.exe
      C:\Windows\system32\bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1560
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# HELP DECRYPT #.html
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1636
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1636 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2256
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1636 CREDAT:603137 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2608
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# HELP DECRYPT #.txt
    3⤵
    PID:2940
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:228
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "b8af782f98793a4b4ce9171b1b320291_JaffaCakes118.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2140
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2572

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2756

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
1⤵
PID:2704

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1192 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# HELP DECRYPT #.html

Filesize
19KB

MD5
77b4d26b627ca341be9d77adcced2f1d

SHA1
577bbd03ec0589a9122af6e9b27c1795b61d718f

SHA256
fb513e97ed277c9cfc35e2f0f1f5b1084f842a20e59e5013054f45fc31c20589

SHA512
061f2a2c25e570d6618e6885fc399e5327b8fa973ebe60a694224c8dd0cf07070aadfcdea9b6acf73e101550f0664863cdf84441e92468c2c3902a88375fb556

Download Submit
C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# HELP DECRYPT #.txt

Filesize
10KB

MD5
730749b4be5e472772d74185e17ca53a

SHA1
2f23c605c78374f333dc17ea8405ac57680739e0

SHA256
1800329c734c4a2042a0948a002c9293feb4e6d0fb38e5cb6059bac0090fe8d8

SHA512
34d2f570e072eaddd738f6c4cae40941fba0f0cb8bb3d3a7a77a768301c5301ff1e69504f9b65c19356cd26627b56c14d079535511cbbce21d1f23ee4f32d3b7

Download Submit
C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# HELP DECRYPT #.url

Filesize
90B

MD5
20a6552a7a90aa289fb6072411815a2a

SHA1
b1c40d877cf7891d384f4784e34a3285627dcd05

SHA256
1f5cdd4e898c0dd8d0200b17a63b5e25bcfcae55a6cfb36cad5267bc5e0a4ee1

SHA512
0bd85827d16f16c47108e947c687e6e549c427c33f5681bca5a73dd3f519606a2419b0c53ee2b46e70958ab5d99a277eafa3ecc543783bd29d13529f9a263ace

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87f2d755c3524f6449f9c5a5f9b1c3b7

SHA1
1d2adf967a9de3ca46d4c763713b628a20f063cc

SHA256
33c0835673fd7a27ead0e6f11ed3916e2cc73a0deb61f834a6df9986936c1771

SHA512
f4e3ebee13ae816b8c25231fe6acd3dba5f6bdd62aa453b1df6a00ed7e446b04af0902f2b3f96eae5a8f5c907fbbe251fc907ef032160f70267802623c3ffa02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8cfe40d9bf239f0fe09e38619c973081

SHA1
1060476b5b23b0cc4d9ba741a965096ad8728223

SHA256
72ebe01d752984f8b2de19f30962bd2783b3dcb48c0800356ddf6372cae85c2a

SHA512
c3a1a379e0b679e7760ca5e8451933ed937f3535a2463f431b1ab761ff0c0492b1e5b9bc5c02c3c9677919470b10d8c580ea0617aacac11766b90a3b0899caa4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98d0caa0b2b3ecf8f7ed75dc19e078fd

SHA1
cfbc29e995cdf675ec551cb85ed8d480f9ba6b4f

SHA256
e655edea486eecd07491193c6c0c416dd19077556e69d89d133f8c9ea252afaf

SHA512
b4d9340a76c2d9f23544b9f29418a4cb7e911a0a0925275eeb4ce7cc0785e6d0c02e6a7e0eae3543f8d86b52b11850951c9f6c1d897280550cde6a887ae229d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6b0c6856dfd7cc4d85eb3bfdad67713

SHA1
0e2690461dcb24b248de6385d62c01b77718c9e0

SHA256
630bec3025828f0cc26b0f069760626e73081dc5e644b214b73c4b567f7fc7e4

SHA512
be6b567d087695abde9080b279f13c1f2bf37bf2a4f978d0e792b5cbf2b56accee68f99ebb987b659c9600d9c6bc46c03adfc367230453b72bbe2591943d727d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e4fc5d6ff5a02b562a5d06eca595089

SHA1
468036107dee40a665999c6d775b9e5cb858584a

SHA256
2f7aa8ea4127affd173204ebf6f36fb7f7bc6ae576bf8829384a00871f270f07

SHA512
7ddf93f0ff68ce652f364c6089ae09e93f04fcb32cb4ebc6c91dec166de1c9808c77e28475ee5fbd46215509eb14c4745c117071d505ea626c9c7f925f1dfd6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
212bf583da023b9077be1fe120ead5d8

SHA1
b4fa3036db2a2db1353fda24bcfdb392cc0ecec0

SHA256
a16d1ecaf78f2a7107f21b282cfaf292983de8679c90a0e1e64f26988f8fa8db

SHA512
c80d51cc9f1b461f71048900817ee83fbd16404ad48b1a91a457db5e0d1a58031302456b14fe45ca0313bf55c7ed6282326caf992367b82cd223ffd9082259c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df87379b007ec125719a4ad692031440

SHA1
45f03d87ff5cf2f49c660266dc62adc180e8fcf9

SHA256
790e6ba661b55f7afa8cbfb0f256d5938c2f27dd2b42d7fece4ecb033481f7d2

SHA512
6bfb918017a655c178f7ce3cf3dc5e1704fc4f9ae9af64a44d08a015125ccd0910456857affe27259e6afeba7b5b6b109bb247e10ff3c24a35a3a17788a360a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
950b3eefd210251a0c123932cc2d45f4

SHA1
d184ca7d879196850e7386b33228b020039f9329

SHA256
6a01998165e410abbf1c901f55ddfa62138cd360d36467265d6972cc21753144

SHA512
52f684616c3d1b3e734ec7494422a028374dc2e5837e7e8806a58f7561dbcb226bd2003f880930b19e2b309759be0f623c5a62d96814c994fef4f3876b981416

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d9b085590310df91d0b25946ed06860

SHA1
70ab9edf45d5b306454f0c8e7f32ee4a50263cde

SHA256
7e57a818eee3af66125b2604183b353649906488f952af12b03838d8a8af7bc9

SHA512
7348fe10c39fa5451ad0458a9d2c4d0d81e616f0f8bb1bf1b349b3cf0957033e5d24edb62c5201fa5a4c041b8446beffccfaa17d568e8e21899d8c6ba6dda6f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
883105a156245097fea4f47df99b61c5

SHA1
02a384ab7887039990e6eb49d99b88ed81a31abf

SHA256
87b1cee22ce4a7f6e8c04b5ce5d12d8686de8013531f9f159c8a6ecc7fbb0780

SHA512
ca1e4475d1c8bdc455199bd7be064a526f206f00df837d7993ee6b842d629037099fc470b197932538e61f35faea0feee5f11e0f746e42e20dd212b3126d45c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce78e840d9bedcaf945b380392480908

SHA1
7f800c55330e8ee7854a38347c5a84c6059db727

SHA256
aa5487e9b64a562a94b4011b63acdc39c5cec2363ed91f1067aaf98602b5bfcf

SHA512
555edfabcdb07f0100fb02fff68892c7be11f8baf2245ea436497a30dfe54217f48fa74577cb7c392d051658ceff3f99991b369f3490224d9d5cd6292387eb8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2034be14233ab812eebd11f62a75803e

SHA1
a8a0b6b5b8a61d2b04738f73d0774abc8de31f9f

SHA256
a374131116f5874d8f6c7d477bb3524a0ffdef91d8b0c5519d1acf08ea986558

SHA512
7995ef9b175f6aa6060d85480d9d86510fe32d59ac6356ced4da65136ccca4c506372e712f5ada8ed1c5db53f92aabb8c3f20dc42ec6da877b9341d1a154f6ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10fe679be580c6d10e494ae0adfb91e4

SHA1
3afcc37d1f4c010bb13cd880d875844ae65da213

SHA256
9caeccd1f307a31b56f9a4aef401aa3493bf9a3ba7c9bf625fc41978abf25daa

SHA512
217aeb21f218e88dc9624e20b0a7c8b5845e868aa9db31bb13667a0e80a0ceb3b0d495dbede0f8cb1aea411fbcdfdcd52b13ed392c09c40573517fe67f827b81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98dc9b80ed9a436525b03b2235c19995

SHA1
f2b5a27c0bbe25715eae5bf7181566d620112004

SHA256
47d827e5f995c308b86715b1335080a13bb54748e922828a3c6e568dc4e8ffa2

SHA512
98f8f2d432331f842561bee61047e6e1abb650f01aebe64258000f9c97bfacf1268b5444dd9622778f9ef745d9df369bc34cb9ff1ff4432b50f6c3a37540fe81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff1943a7c6ccb136842eb6296a85abec

SHA1
091f824801b315c90328d50bcb4e343c2d82532a

SHA256
c944a50d82d2fc7c05581fdbfd38edc2766c54ed1ff2008313b612ba9d49db1b

SHA512
9c74fba08bde5eaf571aa90348b06c83bca3d7c13c1970ca463586a5f25d538230f93a4263e05ca158b6503141bb0be59e1e5fd2a781bbe9097611d4fc8ab80a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5cac688dd8b87e7b1f3fe899e72dacbb

SHA1
17ca976503d95c1594efcc398f2a5c5f4a96a601

SHA256
c3cad2a0f0811757ebd961304a92d7e780fabdd6ca62fa7ac6721c0c7d4aa384

SHA512
e355406f287cab0a89264be521421f9a957f81893bff95908b36da04c0db354181969f6a1dca6c921cb5cf59eb66baf0252e70113bd66de616bacf9d92466466

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56ef18487e92d0905d1e5581aa01f5e9

SHA1
b3c767be6ee386d09aefc5fcc3d0e42137cb90f6

SHA256
ae24d20636636bb6a8256575c83a62e13fb44115b97f9bc82b917a8079e8cbc4

SHA512
f71d3886cbe226fba69995a0dedf2181ff26eea1735020368d205c8acda1b8e9eb3314dc54e50e86ba98f1bf2f5c7cea8ba45b1936a9236d1f2eea4a04a13976

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8f0ce7891dee02117289a955471a726

SHA1
30dd6d8ff7d6eef21ec92e3ab77dff6c5c955031

SHA256
9b1299c28d64a127517530078a471edc1b43b133277facd5809c2cb23a7bf5a5

SHA512
c956564cccbc6b97f8272cab42a46e00bb54af2925b9ff2912092f0abdc09b3e1930e072bc7f92526f4a79648c1775c0615f481ec7cc79e7684234d09bd1e4a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94d5c08c415c0a1dd9985fad2161ee8d

SHA1
485882dbb78516934256eedfb38c91f91aae0175

SHA256
ce798a0d83f394ef1b5cba496fc88b06016c1c09748228b2f50332f391ea2e87

SHA512
4c7e565d739d93922b2f892e2192ec344356c420e1ef6e62e9e7fd75cfe8732fb87f09e4f858bdae06b6fe1ae768c69b0ab2e6edd6f2ce05311b9ce4ab62e2f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c24afaba53a441504cb8d1bc7f200a6

SHA1
1b891840a480ea2f6893e89b293e76e566919cfd

SHA256
449b89348dedc6c2e985fac5de814d3e96973235eca9ab8061ede5e334499ef6

SHA512
3abfcb420e061808d970dc84eaa4ae8a45131062028b339fa3d85e30161c9fdd7ec4dfaa32a9701cd8f020fcbe3b6125fc3b4377ab5e66bba04371aef7a4beaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae86babb1ae6ea756a662d7cd3f73ebf

SHA1
088dc02f6ae182ec6e90305a3ef80186e2794b74

SHA256
a333e2a94feaa8c68e31db49157b1ee7fdb25a293982c6836def3d135c636d86

SHA512
81d50d868a052582e2cd90337b74bf62fb107f1957cb701c16428fc4a85dd160ca59dfa9ee25fb3c29cc45854a70067da47d18117418b135dbc12df4441ec1c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{CF63DE61-2CA7-11EF-AC6D-CE8752B95906}.dat

Filesize
5KB

MD5
f0d7226a5572fd21ff0e53bf749663aa

SHA1
ec69eac5e3612e8f91afa50d42b25c58c09e98f9

SHA256
462f2c17da14961bef88a64bd33f15d3bdcfe44c6c38a7bfdf740cbb4e4ca79c

SHA512
5935790e64130495db9d2a293970e96bcca44a23fc30e98eae5d122b75ebb707836605dfac41a009df2c1359dc35d3b86dafbc9a58f1de4e4c2ebd1e15c50085

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6E7E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6F2D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\btn-next-static.png

Filesize
4KB

MD5
ef4c7bcefc3c63dc32124160d26f2e4f

SHA1
0b08046ca6139031d60c14f46ad1dbc825519fe6

SHA256
70ea0c2f9448e55df87cbe395d1e44deb64e34a4b420f04710d5472d0f30f63d

SHA512
28261261cac6216543545436c78a62f506bda738b8b3c2b7c1b6e54ebd9dd0b216f19fcc8ed02ccca25362b589629b1b9e571d3a91e8328137d9570ede2fdd4a

Download Submit
C:\Users\Admin\AppData\Roaming\exsl.node.set.available.xml

Filesize
2KB

MD5
30d55bce2a53c5ca2e0b3a2e827f469e

SHA1
b22e091deaf30d949781b625c1175c2c83b4f6be

SHA256
096ed5d0ca98f280765e82d50c7c9159f226fbae5d315c4d0b010784d33d1bca

SHA512
536966dc18c89d7f702aee1be6ee2c111fbd3a7372659c815824e43fb987abfc870f4b146b8cfa0b5cabb692ec0ef93ffb1f6ef5359ecfb252da70106e4fc039

Download Submit
\Users\Admin\AppData\Local\Temp\nsi21E3.tmp\System.dll

Filesize
11KB

MD5
6f5257c0b8c0ef4d440f4f4fce85fb1b

SHA1
b6ac111dfb0d1fc75ad09c56bde7830232395785

SHA256
b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1

SHA512
a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8

Download Submit
\Users\Admin\AppData\Roaming\Perl.dll

Filesize
102KB

MD5
7c433e47ecfd8e776a8551eaa3566331

SHA1
03061c1f3844edeb6e0f3d86fa5b3cefdbf81357

SHA256
3696f8856be929b28f8db7902369251019168ef9d05c74e617f48a8f9d04ad01

SHA512
33162aa80cc4ce511e2fe61ca4059067b264619d825afa66b791e3e0cacd7197e35ebfd1b257ba8d05e30209ce36822e1935eff6664e1c8a96e45ce7f3fbff7d

Download Submit
memory/2016-29-0x0000000068640000-0x0000000068662000-memory.dmp

Filesize
136KB

Download
memory/2016-28-0x0000000068640000-0x0000000068662000-memory.dmp

Filesize
136KB

Download
memory/2264-51-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-366-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-387-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-390-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-393-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-396-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-399-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-402-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-405-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-408-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-414-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-381-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-426-0x0000000004040000-0x0000000004042000-memory.dmp

Filesize
8KB

Download
memory/2264-429-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-428-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-378-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-375-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-372-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-369-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-384-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-363-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-40-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-41-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-48-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-38-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-35-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-34-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-33-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-31-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-18-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-15-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-19-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-21-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-23-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2264-27-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2264-13-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download