Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
20/06/2024, 06:35
Behavioral task
behavioral1
Sample
03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe
Resource
win7-20240220-en
windows7-x64
21 signatures
150 seconds
General
- Target 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe
- Size 365KB
- Sample240620-hclebstgmb
- SHA256 95bcde80b38be95a7475e0ac5cacf6c8d999363be396a28761beff98fbbac115
- MD5 03adf12eed0eaefaa1669651f43e400f
- SHA1 9232ecf3f1ebe1e5d45645cdf44488b6ce69187f
- SHA512 1fa314af348b4b899fa96685f209f89104a973fe4e904652a87051c5c663132e3adb1c623d2c75ab0fa138ce1a212bed46c695956c84e3863bfaad056c74d8b8
- SSDEEP 6144:UPUrKuc8ssVpIv4t3+h9omAjxFiOdZmzsqMJu7cyzdFi4M8We18B:U8rKucRSpKNhLAVFzh7gWe10
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe SSVICHOSST.exe" 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe - Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe - Disables Task Manager via registry modification
-
resource yara_rule behavioral2/memory/3552-0-0x0000000000400000-0x00000000004A7000-memory.dmp upx behavioral2/memory/3552-3-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-11-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-7-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-5-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-6-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-1-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-25-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-26-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-27-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-28-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-29-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-30-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-31-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-32-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-34-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-35-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-37-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-38-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-39-0x0000000000400000-0x00000000004A7000-memory.dmp upx behavioral2/memory/3552-40-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-42-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-44-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-47-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-49-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-51-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-53-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-55-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-57-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-58-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-59-0x0000000000400000-0x00000000004A7000-memory.dmp upx behavioral2/memory/3552-60-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-61-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-67-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-69-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-73-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-75-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-78-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-79-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-81-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-84-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/files/0x0007000000023421-86.dat upx behavioral2/memory/3552-85-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-89-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/3552-90-0x0000000000400000-0x00000000004A7000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Windows\\system32\\SSVICHOSST.exe" 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe - Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\H: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\o: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\X: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\s: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\E: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\J: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\K: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\Q: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\U: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\W: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\V: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\j: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\p: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\q: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\r: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\O: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\P: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\Z: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\b: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\v: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\y: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\L: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\M: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\e: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\n: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\I: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\N: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\i: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\u: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\x: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\Y: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\a: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\g: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\l: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\t: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\w: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\R: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\S: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\T: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\h: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\k: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\m: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened (read-only) \??\z: 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened for modification F:\autorun.inf 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\SSVICHOSST.exe 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SSVICHOSST.exe 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\autorun.ini 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe - Drops file in Program Files directory 12 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File created C:\Windows\SSVICHOSST.exe 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe File opened for modification C:\Windows\SSVICHOSST.exe 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe Token: SeDebugPrivilege 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3552 wrote to memory of 784 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 8 PID 3552 wrote to memory of 792 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 9 PID 3552 wrote to memory of 60 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 13 PID 3552 wrote to memory of 2628 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 44 PID 3552 wrote to memory of 2680 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 45 PID 3552 wrote to memory of 2756 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 47 PID 3552 wrote to memory of 3396 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 56 PID 3552 wrote to memory of 3544 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 57 PID 3552 wrote to memory of 3740 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 58 PID 3552 wrote to memory of 3836 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 59 PID 3552 wrote to memory of 3896 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 60 PID 3552 wrote to memory of 4000 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 61 PID 3552 wrote to memory of 2124 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 62 PID 3552 wrote to memory of 404 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 64 PID 3552 wrote to memory of 3640 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 75 PID 3552 wrote to memory of 3632 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 79 PID 3552 wrote to memory of 4752 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 82 PID 3552 wrote to memory of 4752 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 82 PID 3552 wrote to memory of 4752 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 82 PID 4752 wrote to memory of 3236 4752 cmd.exe 84 PID 4752 wrote to memory of 3236 4752 cmd.exe 84 PID 4752 wrote to memory of 3236 4752 cmd.exe 84 PID 3552 wrote to memory of 2896 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 85 PID 3552 wrote to memory of 2896 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 85 PID 3552 wrote to memory of 2896 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 85 PID 2896 wrote to memory of 2080 2896 cmd.exe 87 PID 2896 wrote to memory of 2080 2896 cmd.exe 87 PID 2896 wrote to memory of 2080 2896 cmd.exe 87 PID 3552 wrote to memory of 784 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 8 PID 3552 wrote to memory of 792 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 9 PID 3552 wrote to memory of 60 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 13 PID 3552 wrote to memory of 2628 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 44 PID 3552 wrote to memory of 2680 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 45 PID 3552 wrote to memory of 2756 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 47 PID 3552 wrote to memory of 3396 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 56 PID 3552 wrote to memory of 3544 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 57 PID 3552 wrote to memory of 3740 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 58 PID 3552 wrote to memory of 3836 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 59 PID 3552 wrote to memory of 3896 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 60 PID 3552 wrote to memory of 4000 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 61 PID 3552 wrote to memory of 2124 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 62 PID 3552 wrote to memory of 404 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 64 PID 3552 wrote to memory of 3640 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 75 PID 3552 wrote to memory of 748 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 89 PID 3552 wrote to memory of 1580 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 90 PID 3552 wrote to memory of 784 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 8 PID 3552 wrote to memory of 792 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 9 PID 3552 wrote to memory of 60 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 13 PID 3552 wrote to memory of 2628 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 44 PID 3552 wrote to memory of 2680 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 45 PID 3552 wrote to memory of 2756 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 47 PID 3552 wrote to memory of 3396 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 56 PID 3552 wrote to memory of 3544 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 57 PID 3552 wrote to memory of 3740 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 58 PID 3552 wrote to memory of 3836 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 59 PID 3552 wrote to memory of 3896 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 60 PID 3552 wrote to memory of 4000 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 61 PID 3552 wrote to memory of 2124 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 62 PID 3552 wrote to memory of 404 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 64 PID 3552 wrote to memory of 3640 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 75 PID 3552 wrote to memory of 748 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 89 PID 3552 wrote to memory of 1580 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 90 PID 3552 wrote to memory of 784 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 8 PID 3552 wrote to memory of 792 3552 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe 9 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:60
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2628
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2680
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2756
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\03adf12eed0eaefaa1669651f43e400f_JaffaCakes118.exe"2⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes3⤵
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\at.exeAT /delete /yes4⤵PID:3236
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\SSVICHOSST.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\SSVICHOSST.exe4⤵PID:2080
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3544
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3740
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3836
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3896
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4000
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2124
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:404
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3640
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3632
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:748
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1580
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\SSVICHOSST.exe
- Size 365KB
- SHA256 95bcde80b38be95a7475e0ac5cacf6c8d999363be396a28761beff98fbbac115
- MD5 03adf12eed0eaefaa1669651f43e400f
- SHA1 9232ecf3f1ebe1e5d45645cdf44488b6ce69187f
- SHA512 1fa314af348b4b899fa96685f209f89104a973fe4e904652a87051c5c663132e3adb1c623d2c75ab0fa138ce1a212bed46c695956c84e3863bfaad056c74d8b8
- SSDEEP 6144:UPUrKuc8ssVpIv4t3+h9omAjxFiOdZmzsqMJu7cyzdFi4M8We18B:U8rKucRSpKNhLAVFzh7gWe10
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\autorun.ini
- Size 109B
- SHA256 de6a46a45c6fb7c6e3ef68bba4d706b2f398dc961fbdbd2b23a5067c5faff406
- MD5 43b9dfd6e61eba0dda808ab0f5f966aa
- SHA1 ffdca1842198d91dae7c98e862704ea80235894b
- SHA512 40f1c2597ad182c5e4c2fd6e3bf63e5683f1f9acdd3021eaee5d7c20f39dfc525736bd73ad7955a770b23ce1eb419a3c346095b31573bb9aea9558fd07494981
- MD5 SHA1 SHA512
- Path C:\jmlrg.pif
- Size 100KB
- SHA256 d3b6953d72a531a0bb9cddef2bb56fa7574f5da02195fe794aa999cc72e0627b
- MD5 684b05a70fd530da7ae2c7ddebf1b4c8
- SHA1 8c81874dbfc69ebd3a7665db3a98f1824c5bfa11
- SHA512 55c760962c6314e486489ca0927146d56b133815d7a91d501a3006e31ce984e2dd8679e38ae5264d262149f47afc81b6065103840afeacd7accbafa2376b2940
- SSDEEP 3072:qf3YFMEPTKksBlYPT1F2NadawGzCVZsD:qf3YFbrK1wJFIyaVWZsD
- MD5 SHA1 SHA512 SSDEEP