59c995dd4d2e86e4fb4f34f353fd0b8a23f44a2774599a1e864514d0f74e6ae7

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Size 1.5MB
Sample240620-pczehs1bpr
SHA256 59c995dd4d2e86e4fb4f34f353fd0b8a23f44a2774599a1e864514d0f74e6ae7
MD5 05df8d890eb18614a7d206b41453d306
SHA1 cc82be272582f757e9322035310921a9cb92a71e
SHA512 5718ece11b633617a3ea351c56e8519340802ced96501e16b1eff6e57a64f94d657f3ab1e493fe9384818619f4a86997db64f20dc3840ab72f07dd44aed365b2
SSDEEP 24576:3Tf2xjlqWR966T2xttTo2RigiBMyWGLETufJLckEY/fudN9GQcCeIRLhlAB2lf:jurqC6u3+yW8EChcC/fkGQwIRLhlKQ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
2628	urld.exe
2916	nnlogon.exe
1852	nnlogon.exe
1672	UrlUpdate.exe
1856	urlupdate1.exe
1408	ntmurl.exe
376	iewindow.exe

Loads dropped DLL 37 IoCs

pid	Process
2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
2628	urld.exe
2628	urld.exe
2628	urld.exe
2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
2916	nnlogon.exe
2916	nnlogon.exe
2916	nnlogon.exe
2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
1852	nnlogon.exe
1672	UrlUpdate.exe
1856	urlupdate1.exe
1856	urlupdate1.exe
1856	urlupdate1.exe
776	regsvr32.exe
1544	regsvr32.exe
1408	ntmurl.exe
1408	ntmurl.exe
1408	ntmurl.exe
376	iewindow.exe
376	iewindow.exe
376	iewindow.exe
376	iewindow.exe
376	iewindow.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 5 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D815AB8A-E840-4054-B37D-943893116452}	ntmurl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{D815AB8A-E840-4054-B37D-943893116452}\NoExplorer	ntmurl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D815AB8A-E840-4054-B37D-943893116452}	REG.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72CEEE43-C350-4932-B3DC-B6201F01EFCB}	ntmurl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72CEEE43-C350-4932-B3DC-B6201F01EFCB}\NoExplorer	ntmurl.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\VB6KO.DLL	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DWSHK80.OCX	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	urlupdate1.exe
File created	C:\Windows\SysWOW64\NSearcher.exe	ntmurl.exe
File opened for modification	C:\Windows\SysWOW64\NSearcher.exe	ntmurl.exe
File created	C:\Windows\SysWOW64\MSVBVM60.DLL	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\dwsbc80.OCX	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	ntmurl.exe
File created	C:\Windows\SysWOW64\dwshengine80.dll	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe

Drops file in Program Files directory 40 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\nnlogon.log	nnlogon.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\nautoup.log	urlupdate1.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\system.mdb	ntmurl.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\system.mdb	iewindow.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\nnlogon.exe	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\nnlogon.log	nnlogon.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\nautoup.log	UrlUpdate.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\tags.ldb	iewindow.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\uninst.exe	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\bhoexe.log	ntmurl.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\tmp.mdb	ntmurl.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\autoup.ini	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\iewindow.exe	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\tagstemp.mdb	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\efbbar.dll	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\appext.reg	ntmurl.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\tags.mdb	iewindow.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\ntmEnd.exe	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\autoup.ini	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\bhocode.ini	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\bhocfg.ini	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\urlupdate1.exe	UrlUpdate.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\tags.mdb	ntmurl.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\sbinstall.reg	ntmurl.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\sslaunch.dll	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\nnlogon.ini	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\urlupdate1.exe	UrlUpdate.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\ntmurl.exe	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\urld.exe	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\ntmurl.dll	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\nnlogon.ini	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\autoup.ini	urlupdate1.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\efsbar.dll	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\navigator.ico	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\tags.mdb	ntmurl.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\tags.ldb	ntmurl.exe
File created	C:\Program Files\Netimo\NSearcher\NSearcher.exe	ntmurl.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\sslaunch.log	ntmurl.exe
File opened for modification	C:\Program Files (x86)\netimo\Common Shared\URLHelper\bbuninstall.reg	ntmurl.exe
File created	C:\Program Files (x86)\netimo\Common Shared\URLHelper\UrlUpdate.exe	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1752	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	ntmurl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Explorer Bars	REG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Explorer Bars\{6A294C45-07CC-426C-9512-6742053E462C}\BarSize = dc00000000000000	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Explorer Bars	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	ntmurl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\{72CEEE43-C350-4932-B3DC-B6201F01EFCB}\DisplayName = "¾ßÈÄ"	ntmurl.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{6A294C45-07CC-426C-9512-6742053E462C} = 51667a6c4c1d3b1b55503a76f3510b0a8d1c2c02017c0739	REG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{D815AB8A-E840-4054-B37D-943893116452} = 51667a6c4c1d3b1b9ab706c47fbe3308ab73df7897532547	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	ntmurl.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\ÀÌ ´Ü¾î °Ë»ö(&S)	ntmurl.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\ÀÌ ´Ü¾î °Ë»ö(&S)\contexts = "48"	ntmurl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{72CEEE43-C350-4932-B3DC-B6201F01EFCB}"	ntmurl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\{72CEEE43-C350-4932-B3DC-B6201F01EFCB}\URL = "http://search.netimo.net/ntmsearch.html?where=all&cp=ezsearch&adv=yahoo&type=forward&ssupply=1&q={searchTerms}"	ntmurl.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\{72CEEE43-C350-4932-B3DC-B6201F01EFCB}\Codepage = "949"	ntmurl.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{67C41E9E-2EBF-4F2B-AF74-314F0D793172} = 51667a6c4c1d3b1b8e02d77b80784c07b77a7a0f093b7067	REG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{72CEEE43-C350-4932-B3DC-B6201F01EFCB} = 51667a6c4c1d3b1b53f2dd6e6f955501abd2fd601b43aede	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt	ntmurl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\ÀÌ ´Ü¾î °Ë»ö(&S)\ = "res://C:\\Program Files (x86)\\netimo\\Common Shared\\URLHelper\\ntmurl.dll/SEARCH.HTM"	ntmurl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Explorer Bars\{6A294C45-07CC-426C-9512-6742053E462C}	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Explorer Bars\{6A294C45-07CC-426C-9512-6742053E462C}	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\{72CEEE43-C350-4932-B3DC-B6201F01EFCB}	ntmurl.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Approved Extensions	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MAO Settings	REG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MAO Settings\AddonLoadTimeThreshold = "1000"	REG.exe

Modifies data under HKEY_USERS 49 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	ntmurl.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0029000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ntmurl.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F0191ABD-5369-4EE9-81C8-FB9632B38701}\WpadDecisionTime = 10753b120bc3da01	ntmurl.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F0191ABD-5369-4EE9-81C8-FB9632B38701}\WpadNetworkName = "Network 3"	ntmurl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	urlupdate1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ntmurl.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-f6-e3-b5-01-22\WpadDecisionTime = 10753b120bc3da01	ntmurl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	urlupdate1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	ntmurl.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-f6-e3-b5-01-22\WpadDecisionTime = b093b3080bc3da01	ntmurl.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	urlupdate1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	urlupdate1.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F0191ABD-5369-4EE9-81C8-FB9632B38701}\3a-f6-e3-b5-01-22	urlupdate1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-f6-e3-b5-01-22\WpadDecision = "0"	urlupdate1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	ntmurl.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-f6-e3-b5-01-22\WpadDetectedUrl	ntmurl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	urlupdate1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F0191ABD-5369-4EE9-81C8-FB9632B38701}\WpadDecision = "0"	urlupdate1.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-f6-e3-b5-01-22	urlupdate1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	ntmurl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	urlupdate1.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F0191ABD-5369-4EE9-81C8-FB9632B38701}\WpadDecisionTime = b093b3080bc3da01	urlupdate1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	ntmurl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ntmurl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F0191ABD-5369-4EE9-81C8-FB9632B38701}\3a-f6-e3-b5-01-22	ntmurl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	urlupdate1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F0191ABD-5369-4EE9-81C8-FB9632B38701}\WpadDecisionReason = "1"	urlupdate1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F0191ABD-5369-4EE9-81C8-FB9632B38701}\WpadNetworkName = "Network 3"	urlupdate1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	ntmurl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-f6-e3-b5-01-22\WpadDecisionReason = "1"	urlupdate1.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F0191ABD-5369-4EE9-81C8-FB9632B38701}\WpadDecision = "0"	ntmurl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	urlupdate1.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0029000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	urlupdate1.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-f6-e3-b5-01-22\WpadDecisionTime = b093b3080bc3da01	urlupdate1.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-f6-e3-b5-01-22	ntmurl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F0191ABD-5369-4EE9-81C8-FB9632B38701}\WpadDecisionReason = "1"	ntmurl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F0191ABD-5369-4EE9-81C8-FB9632B38701}	urlupdate1.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0029000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ntmurl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F0191ABD-5369-4EE9-81C8-FB9632B38701}	ntmurl.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	urlupdate1.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	ntmurl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	ntmurl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	urlupdate1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ntmurl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-f6-e3-b5-01-22\WpadDecisionReason = "1"	ntmurl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-f6-e3-b5-01-22\WpadDecision = "0"	ntmurl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	urlupdate1.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	urlupdate1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	urlupdate1.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A625F501-206F-4713-9DE1-DD3AF4AC4BF9}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6A294C45-07CC-426C-9512-6742053E462C}\ = "efindersidebar.CSideBar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3F16DB30-C562-41AD-A3B3-4D405BBBEFEE}\TypeLib\Version = "415.4"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D761-6018-11CF-9016-00AA0068841E}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dwshk80.DwshkPropPage\CurVer\ = "Dwshk80.DwshkPropPage.1"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{651520F0-B9D9-46CE-987F-C8697222B4B8}\InprocServer32	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7FB96837-674C-407F-BBA0-CDC0D501512C}\ProxyStubClsid32	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E9ECAA7A-3EAC-4F41-8375-84AC9D2AC3AF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{737361EC-467F-11D1-810F-0000F87557AA}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{738A3C47-189C-4B96-8ACE-985DD34AFF17}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0E9BF828-7362-4850-9FE7-59E26521AC34}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{884DA533-61D6-43BD-AF00-BB3E961BFD29}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FA496C82-EF15-498A-9281-71C17D2E83B1}\ = "CSideBar"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{323EDAF0-DD73-47E1-9C77-76261365F2A6}\ = "ntmURL.ISubclass"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{446F2D1F-88B2-4928-ADCD-7B23714C00AD}\ToolboxBitmap32	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.RegMsg.1\CLSID	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E9ECAA7A-3EAC-4F41-8375-84AC9D2AC3AF}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D815AB8A-E840-4054-B37D-943893116452}\VERSION	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C48E43A2-A7B7-4293-A13A-F4B29158A0BB}\Programmable	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\ = "VBPropertyBag"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{446F2D1F-88B2-4928-ADCD-7B23714C00AD}\ProgID	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{651520F0-B9D9-46CE-987F-C8697222B4B8}\InprocServer32\ = "C:\\Windows\\SysWow64\\DWSHK80.OCX"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ntmURL.CSideBar	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\efindersidebar.CSideBar\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C48E43A2-A7B7-4293-A13A-F4B29158A0BB}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E9ECAA7A-3EAC-4F41-8375-84AC9D2AC3AF}\Programmable	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72CEEE43-C350-4932-B3DC-B6201F01EFCB}\ = "ntmURL.CHandler"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C1-4442-11D1-8906-00A0C9110049}	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C5-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15985491-68E2-49DD-9F73-BFC0DCAB8584}\Programmable	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C866B2C5-14CF-4908-8D11-7FA85FD63EC2}	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E9ECAA7A-3EAC-4F41-8375-84AC9D2AC3AF}\ProgID	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dwshk80.KeyPage.1\CLSID	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ntmURL.CSideBar\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C6E6B197-9348-449E-A149-384B208874B1}\415.4\0\win32	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E72183BD-2FD6-4FEC-A806-BB3DE07A5E35}\ = "_CHandler"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ntmURL.CSBCriteria	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{888A5A60-B283-11CF-8AD5-00A0C90AEA82}\TypeLib	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A625F501-206F-4713-9DE1-DD3AF4AC4BF9}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E7BFE371-AB4F-48A9-8E4B-746CDC3377F0}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B07FABA-099B-4D62-9780-D254A04E32F5}\TypeLib	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FBA8A473-BB88-4DDC-AB67-0EE6BF4788A9}\Implemented Categories	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DD708967-6D59-4C25-90CE-22C6C7B1B9CE}\ProxyStubClsid32	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A625F501-206F-4713-9DE1-DD3AF4AC4BF9}\ = "GSubclass"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ntmURL.GSubclass	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C36516DD-9577-4347-B0DC-D3641BDBEB36}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F2-7697-11D1-A1E9-00A0C90F2731}	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{37273445-885F-4C35-A953-73AC3A9F93F1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{044D0F63-C274-40B2-8F50-F09A06DCFBE1}\ProxyStubClsid32	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C36516DD-9577-4347-B0DC-D3641BDBEB36}	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5A2B988C-5F30-47F7-97DA-0888B9FA0D15}\ProgID	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBB76011-C508-11D1-A3E3-00A0C90AEA82}	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C4-4442-11D1-8906-00A0C9110049}\TypeLib\Version = "6.0"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ntmURL.IInputObjectCallback\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{884DA533-61D6-43BD-AF00-BB3E961BFD29}\Programmable	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{888A5A60-B283-11CF-8AD5-00A0C90AEA82}\ = "Hyperlink"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C3-4442-11D1-8906-00A0C9110049}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{22939DA9-C473-443F-B465-2F9F4F6A9720}\InprocServer32	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5A2B988C-5F30-47F7-97DA-0888B9FA0D15}\ = "ntmURL.GSubclass"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B07FABA-099B-4D62-9780-D254A04E32F5}\TypeLib\Version = "415.4"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{26893EEF-3781-4234-8D71-EF9C394156A3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{738A3C47-189C-4B96-8ACE-985DD34AFF17}\TypeLib	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83C49FF0-B294-11D0-9488-00A0C91110ED}\TypeLib	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D815AB8A-E840-4054-B37D-943893116452}\ProgID	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1852	nnlogon.exe
1856	urlupdate1.exe
1856	urlupdate1.exe
1856	urlupdate1.exe
1856	urlupdate1.exe
1856	urlupdate1.exe
1856	urlupdate1.exe
1856	urlupdate1.exe
1856	urlupdate1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1852	nnlogon.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2628	urld.exe
1672	UrlUpdate.exe
1856	urlupdate1.exe
1408	ntmurl.exe
376	iewindow.exe
376	iewindow.exe
376	iewindow.exe
376	iewindow.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2628	2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	28
PID 2128 wrote to memory of 2628	2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	28
PID 2128 wrote to memory of 2628	2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	28
PID 2128 wrote to memory of 2628	2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	28
PID 2128 wrote to memory of 2628	2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	28
PID 2128 wrote to memory of 2628	2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	28
PID 2128 wrote to memory of 2628	2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	28
PID 2128 wrote to memory of 2916	2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	29
PID 2128 wrote to memory of 2916	2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	29
PID 2128 wrote to memory of 2916	2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	29
PID 2128 wrote to memory of 2916	2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	29
PID 2128 wrote to memory of 2916	2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	29
PID 2128 wrote to memory of 2916	2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	29
PID 2128 wrote to memory of 2916	2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	29
PID 2128 wrote to memory of 1752	2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	31
PID 2128 wrote to memory of 1752	2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	31
PID 2128 wrote to memory of 1752	2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	31
PID 2128 wrote to memory of 1752	2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	31
PID 2128 wrote to memory of 1752	2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	31
PID 2128 wrote to memory of 1752	2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	31
PID 2128 wrote to memory of 1752	2128	05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe	31
PID 1852 wrote to memory of 1672	1852	nnlogon.exe	34
PID 1852 wrote to memory of 1672	1852	nnlogon.exe	34
PID 1852 wrote to memory of 1672	1852	nnlogon.exe	34
PID 1852 wrote to memory of 1672	1852	nnlogon.exe	34
PID 1852 wrote to memory of 1672	1852	nnlogon.exe	34
PID 1852 wrote to memory of 1672	1852	nnlogon.exe	34
PID 1852 wrote to memory of 1672	1852	nnlogon.exe	34
PID 1672 wrote to memory of 1856	1672	UrlUpdate.exe	35
PID 1672 wrote to memory of 1856	1672	UrlUpdate.exe	35
PID 1672 wrote to memory of 1856	1672	UrlUpdate.exe	35
PID 1672 wrote to memory of 1856	1672	UrlUpdate.exe	35
PID 1672 wrote to memory of 1856	1672	UrlUpdate.exe	35
PID 1672 wrote to memory of 1856	1672	UrlUpdate.exe	35
PID 1672 wrote to memory of 1856	1672	UrlUpdate.exe	35
PID 1856 wrote to memory of 1408	1856	urlupdate1.exe	37
PID 1856 wrote to memory of 1408	1856	urlupdate1.exe	37
PID 1856 wrote to memory of 1408	1856	urlupdate1.exe	37
PID 1856 wrote to memory of 1408	1856	urlupdate1.exe	37
PID 1408 wrote to memory of 776	1408	ntmurl.exe	38
PID 1408 wrote to memory of 776	1408	ntmurl.exe	38
PID 1408 wrote to memory of 776	1408	ntmurl.exe	38
PID 1408 wrote to memory of 776	1408	ntmurl.exe	38
PID 1408 wrote to memory of 776	1408	ntmurl.exe	38
PID 1408 wrote to memory of 776	1408	ntmurl.exe	38
PID 1408 wrote to memory of 776	1408	ntmurl.exe	38
PID 1408 wrote to memory of 1544	1408	ntmurl.exe	39
PID 1408 wrote to memory of 1544	1408	ntmurl.exe	39
PID 1408 wrote to memory of 1544	1408	ntmurl.exe	39
PID 1408 wrote to memory of 1544	1408	ntmurl.exe	39
PID 1408 wrote to memory of 1544	1408	ntmurl.exe	39
PID 1408 wrote to memory of 1544	1408	ntmurl.exe	39
PID 1408 wrote to memory of 1544	1408	ntmurl.exe	39
PID 1408 wrote to memory of 1792	1408	ntmurl.exe	40
PID 1408 wrote to memory of 1792	1408	ntmurl.exe	40
PID 1408 wrote to memory of 1792	1408	ntmurl.exe	40
PID 1408 wrote to memory of 1792	1408	ntmurl.exe	40
PID 1408 wrote to memory of 608	1408	ntmurl.exe	42
PID 1408 wrote to memory of 608	1408	ntmurl.exe	42
PID 1408 wrote to memory of 608	1408	ntmurl.exe	42
PID 1408 wrote to memory of 608	1408	ntmurl.exe	42
PID 1408 wrote to memory of 2884	1408	ntmurl.exe	44
PID 1408 wrote to memory of 2884	1408	ntmurl.exe	44
PID 1408 wrote to memory of 2884	1408	ntmurl.exe	44

C:\Users\Admin\AppData\Local\Temp\05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05df8d890eb18614a7d206b41453d306_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Program Files (x86)\netimo\Common Shared\URLHelper\urld.exe
  "C:\Program Files (x86)\netimo\Common Shared\URLHelper\urld.exe" http://search.netimo.net/gmtoolbar/log/m_install_counter.php?pcode=bluepds&isinstall=1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2628
- C:\Program Files (x86)\netimo\Common Shared\URLHelper\nnlogon.exe
  "C:\Program Files (x86)\netimo\Common Shared\URLHelper\nnlogon.exe" -i
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  PID:2916
- C:\Windows\SysWOW64\sc.exe
  "sc" start efinderservice
  2⤵
  - Launches sc.exe
  PID:1752

C:\Program Files (x86)\netimo\Common Shared\URLHelper\nnlogon.exe
"C:\Program Files (x86)\netimo\Common Shared\URLHelper\nnlogon.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Program Files (x86)\netimo\Common Shared\URLHelper\UrlUpdate.exe
  "C:\Program Files (x86)\netimo\Common Shared\URLHelper\UrlUpdate.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Program Files (x86)\netimo\Common Shared\URLHelper\urlupdate1.exe
    "C:\Program Files (x86)\netimo\Common Shared\URLHelper\urlupdate1.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1856
  - - C:\Program Files (x86)\netimo\Common Shared\URLHelper\ntmurl.exe
      "C:\Program Files (x86)\netimo\Common Shared\URLHelper\ntmurl.exe" install scope addressbar
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Installs/modifies Browser Helper Object
      Drops file in System32 directory
      Drops file in Program Files directory
      Modifies Internet Explorer settings
      Modifies data under HKEY_USERS
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1408
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s "C:\Program Files (x86)\netimo\Common Shared\URLHelper\ntmurl.dll"
        5⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:776
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s "C:\Program Files (x86)\netimo\Common Shared\URLHelper\efsbar.dll"
        5⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:1544
    - - C:\Windows\SysWOW64\REG.exe
        
        REG IMPORT "C:\Program Files (x86)\netimo\Common Shared\URLHelper\sbinstall.reg"
        5⤵
        Installs/modifies Browser Helper Object
        Modifies Internet Explorer settings
        
        PID:1792
    - - C:\Windows\SysWOW64\REG.exe
        
        REG IMPORT "C:\Program Files (x86)\netimo\Common Shared\URLHelper\sbinstall.reg"
        5⤵
        Modifies Internet Explorer settings
        
        PID:608
    - - C:\Windows\SysWOW64\REG.exe
        
        REG IMPORT "C:\Program Files (x86)\netimo\Common Shared\URLHelper\bbuninstall.reg"
        5⤵
        
        PID:2884
    - - C:\Windows\SysWOW64\REG.exe
        
        REG IMPORT "C:\Program Files (x86)\netimo\Common Shared\URLHelper\appext.reg"
        5⤵
        Modifies Internet Explorer settings
        
        PID:2392
    - - C:\Program Files (x86)\netimo\Common Shared\URLHelper\iewindow.exe
        
        "C:\Program Files (x86)\netimo\Common Shared\URLHelper\iewindow.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UrlUpdate.exe

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\UrlUpdate.exe
Size 152KB
SHA256 94a6a81ad5c12aec33d7274e43ed8197cd476bb9680724995631fd971e8a3d86
MD5 df4c70adfe3ee8e7d0a7d396754681ea
SHA1 86d6bc8e6961a01aa689909d678512e0e3bc202c
SHA512 94e8fa6c92cbb30320b2067158549e6079be66489c4a2c8008ec7675d9135cddd477137b3c08fe7e7a41d2da6fcc3732d9ae10e8bc47226108938249fa33fa4e
SSDEEP 3072:T6npLFsb893Sn3dkJht04WD2spOL/KGKlhcpguZh5pXK1zZcsbAM:+0nNke4WdUL/KGKlhcpguZHpXK1z0M
MD5 SHA1 SHA512 SSDEEP

Submit Download

appext.reg

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\appext.reg
Size 1KB
SHA256 c23dc16f219dc1c20150075a49484c443913e64b3b0f1dddf93a48e66af8d406
MD5 18f5649858c70154f4f36456ef43b52e
SHA1 77b105491d6e26949fb4f0a9218a5c4b684f342f
SHA512 1eec6f7f165d5daf8e58e8d20999f322889a65e5ef9947fbf61f3f4670c0172740a26d8b8eb7ad87bd3fdac292a75e42fab6c2b19a9ef08b1caffa9131ff7eee
MD5 SHA1 SHA512

Submit Download

autoup.ini

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\autoup.ini
Size 754B
SHA256 4562121b2b2b75b2159333f32b1f82788caa4b2faae7db2aeb7211b3edba0360
MD5 1e370eb66156da0e589371c58f1aa58f
SHA1 50cd78ae9503bbbd456f55884f1c412f2bc5006c
SHA512 9121a1480c33fbe9c37065ced22ed5997631ac97e5a1c8e3f4cbe4581986599b308892f857fd0f0fd68acf1630d286dea1a7e944f8ab9efbf6655942ef7be6d8
MD5 SHA1 SHA512

Submit Download

autoup.ini

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\autoup.ini
Size 754B
SHA256 45736eca90394e7089a847590492207e65c26eb7f0b8558f0f452f92c00bf251
MD5 0a14edf1da2648b49300aabea0ecaec5
SHA1 64a423977b04733deb4531a0b6261840aaed2a84
SHA512 a0b5a4fcf7bbb0e6210ffabff264472fe96229a92f89caeff026595a4e5a60aec66ba074660a8835351f7d3031e93dba98b3a1e12ec938f3de8548ef5b233b02
MD5 SHA1 SHA512

Submit Download

bbuninstall.reg

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\bbuninstall.reg
Size 442B
SHA256 3f0c9bf08a9cdcdb96c2401271dc2bf0316adc6d4b01dde12c0d9da32594690d
MD5 d1b9ce8ba9d227e61b8200e837a791da
SHA1 5ae250f8c2191376d9a07d80c356cedf976a7575
SHA512 265d60be34fa0457e7a7073ccfacf7748b8bddf003589cc53e6e9f2d055a0b442fe21521b78d2e2321faeab7f401eeca7d7f32b3ba65c8d64fdaa521b243965c
MD5 SHA1 SHA512

Submit Download

bhocfg.ini

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\bhocfg.ini
Size 10KB
SHA256 d865151fc6bd08ae20c1252b197b658fc293a5183ec1f294a05d305c714070f5
MD5 8eb1f202b12256dc732a17590d7d508e
SHA1 8b032c6f45112d2aa3e72bcdfbcbd00144418e54
SHA512 3ef8dfae492a5dd2887e7ea2e41a879322cdce86f8ee97e3438a47164c39d11349559c18e8bb27017f6ede0c4c5c69dfe05bb870657468f2faa9431de105f7bd
SSDEEP 192:mPzZqnq9B4eLwrAhqVsG3XuJ2RRccxf70CIPtX8X:mPzZqnq98Ahq2OyeDIK
MD5 SHA1 SHA512 SSDEEP

Submit Download

bhocode.ini

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\bhocode.ini
Size 26B
SHA256 7198951fb2445568ecd0d83214a5e7337ff6710b785aeaebf641f24ed409ebd7
MD5 2b4c5c5deee9d19992825eb9843c6ee8
SHA1 2bd5c9a61ada3ccf8f112477b54b789982350855
SHA512 a092d28acb8f3f8e9c23183d8c486407c2051391c8d41237ed8e840a5a301753ff7fe928c5701c0c5501e6d49120cb459ce56f6de01bb7087dd8a548b2de38ac
MD5 SHA1 SHA512

Submit Download

efsbar.dll

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\efsbar.dll
Size 150KB
SHA256 61dc360cc369d3718dba0f9abef8abdef86631f6926758935f29d0b12e6cf8cc
MD5 06ba55c2784d6be5bd400a469e2a602f
SHA1 9c0942b4941430e79bd94735a9c5b9b5ab99424c
SHA512 502c8c2c8b8294454db8bc38d6b5cc11355c33e22533951622284c3e96f3e568d08173780d84a029a090041e67c6bcd9568150ce28acc3c2aaa83a9fe5cc6c1d
SSDEEP 1536:WeBE9b4kRDjvf7fE3ojwG/Ih/3RtR8izcT2QsbIpF4srfQuRRoFvC0U0ZaRKrhC/:WeBXkjvjE3AAxLR86cL71RoF7wu2cY
MD5 SHA1 SHA512 SSDEEP

Submit Download

nautoup.log

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\nautoup.log
Size 273B
SHA256 fad94901a6d64f4255587f383e4a07d9d91287fc92c4b489245dde98fefda235
MD5 13cb5e5f724cfceef6bcc859a2ed2500
SHA1 fcbb219a0d047fe8b6aa5e6c7360a909c10d3435
SHA512 9aa8fad05fa72fd826113cccf7b5ef15082c81128bf727cdc3df8df91f95a27f4e6eb5f1321592d92106fc4fe975e13956fee1a15ec15e59ad04325717939906
MD5 SHA1 SHA512

Submit Download

nnlogon.ini

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\nnlogon.ini
Size 362B
SHA256 b5f551b88b1c76f9b54ccec5f3c19e4f91ea1705320dccbcb1f75d5a9c5cc9b9
MD5 3352808839a5d78e7ba644eee3baee26
SHA1 74e8e0558fac4fa9b4b6edb4cd965c3a48611493
SHA512 c3ac39b6b4feccb4da905cf79c40e00d332fcb420759d089eba13baa13fa6e70569e2ad24656648523557b8c5542cdef57ac71d18a5d233899b34b6c8d9bca93
MD5 SHA1 SHA512

Submit Download

nnlogon.log

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\nnlogon.log
Size 743B
SHA256 26e262c814df531f6d84b0b176092caaa222ab0eb150fb51e6b47c6549a9272d
MD5 48efd610d04ff5ef9733bb0d6781b016
SHA1 a468491c12b17bd2538d82b3b4e75f83a3d44184
SHA512 e7f30d432395c640210deff13e1dc8756f8fa34414b3dae2e9075cfaf8c5302d8bfa6be931fdb62912fa1850c135e424c0d2cad5d816e9da4d21657655741232
MD5 SHA1 SHA512

Submit Download

nnlogon.log

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\nnlogon.log
Size 353B
SHA256 329199d5e574d28d3e081aa7ae00a93d2550a4bae47fac400c0d0ffed78cb057
MD5 e799d0febad61d572c5ee01e3236f772
SHA1 0ed87bc86890fbf5c8f67b3b0f0ecda3d48712d4
SHA512 ec13cf081d1dafa4bcd41ee9332021d53c89bd7e0c4fc48aa3a1de132cd02bf8400d11a00237418cd8cd3d7af19d1b79b4009d4c17c1118294f0c7a22af0a683
MD5 SHA1 SHA512

Submit Download

sbinstall.reg

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\sbinstall.reg
Size 830B
SHA256 a89c9dcc2775d7b98f177fd55c553e5b00d1800a59322e1e1e854a79620868ae
MD5 99efeac3859992432d0973cbac6e9b30
SHA1 6f987006f2fe72031084bb86e18ed2f7ba4807e6
SHA512 42c441aade296c8acce5d424b919e14476d0da84a552dba118c7487415540020687fe290849214dc8067fdbc35a7a6002cd687faf048d7d2e495fd476b3788e3
MD5 SHA1 SHA512

Submit Download

sbinstall.reg

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\sbinstall.reg
Size 324B
SHA256 2e58e8a351d814537317d27c339272ec69e611daa63c7df80a3dc8666096fc98
MD5 058f2758bb8063271a5c5c6257ea9cd2
SHA1 6928513ee55a2a32871c08f1a3aa890c6147b074
SHA512 0bc4a847b8aaf00f596ef97a9942882a224397b5af52628417695724d4b9dec07547f48003c902493e71832c1622305736d7119e5a278822ab55cfccef1df1a7
MD5 SHA1 SHA512

Submit Download

sslaunch.DLL

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\sslaunch.DLL
Size 60KB
SHA256 572b99582027ac31ea036ddb8066bb4118e7c44ab98125a35f863cc710a4ebcf
MD5 412706c54d6ed78c5cd624dc55ef293f
SHA1 a4edb4fe218916ed2294458e7829ed608d6eb4f0
SHA512 1e8fb64759f17223f93260ce27d6e877ff8f704391703457e52925582d88b1b094f824708157aa336291cefff478041986a223ee5ffc03af1b6c9563512bc6c2
SSDEEP 768:Kb2Dit2ndfPVoTXTrYTxx7kw0wgN8OJ96/P/LQvsbA:Kb2PHKTXKmw0wgazQvsbA
MD5 SHA1 SHA512 SSDEEP

Submit Download

sslaunch.log

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\sslaunch.log
Size 247B
SHA256 f1625e80fdbca114687722b38cda19b9fd94fb73f04524efb78ff4937d9896ae
MD5 3293f017e3ce3d369b62b80d25e7fbf4
SHA1 44c5acdcc12895dd5e3199548476a278067c4b7a
SHA512 59cc8012517a83bbcd14c1128b0ab626fd9b1e8fe10d9a38c11fc97674b2583ad7558ecebcff704df0866df290cf1c88cf36c75bd97ffab700cfb288e30c8278
MD5 SHA1 SHA512

Submit Download

tags.mdb

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\tags.mdb
Size 232KB
SHA256 1365f92410df5fb16f6f24139531a7725805ad275e226df9f037e20d8ec352bf
MD5 f0ccaac6db7bd14eb3ec4b03935455ef
SHA1 ea063c4a7e2975d4b43bf8ecb7f97ac0e4972513
SHA512 7ef60d97f3d402117b1debef4b3e10d9a47aaae86f022cbe42e9cb16240d6f4024425bd5bad1fea76ed44c4018e74be70ef2b101a7869c2ca73ed8d09b360b8f
SSDEEP 384:8mHFLz627owd8VyXQR2INRPRNzpyof2urbZNXcFFDXFBE6W:5lLQR2yyDXfE6W
MD5 SHA1 SHA512 SSDEEP

Submit Download

tagstemp.mdb

Path C:\Program Files (x86)\netimo\Common Shared\URLHelper\tagstemp.mdb
Size 184KB
SHA256 504890d04367979ba23222b15892df6b75f140fde436219bb4d49ac5e949597a
MD5 499943ab2d6a704f9d7dbb8ec1aeed61
SHA1 f98e08c95e7229e3e32d587e061c8548e0e4d411
SHA512 c4c7d8ec105fc77e6e109fb1e6aed317a41b794b2c87d55d84e23e74fb4fca546f8e95b590fdedbfbd3295f0ee08bb6cca2f8979022ced29e62a6851f26b2d3d
SSDEEP 384:d+9M0+Ude3Lud8VyXQR2N0P8428riVHY1cFvBE6W:d+F+jLwQR2NEUE6W
MD5 SHA1 SHA512 SSDEEP

Submit Download

vb6ko.dll

Path C:\Windows\SysWOW64\vb6ko.dll
Size 99KB
SHA256 52b64e2bfc9ee0b807f2095726ace9e911bcd907054ac15686a4e7d2fd4dc751
MD5 84742b5754690ed667372be561cf518d
SHA1 ef97aa43f804f447498568fc33704800b91a7381
SHA512 72ac19a3665a01519dac2ad43eb6178a66ad7f4e167f2a882cbca242978f8debe3e15d0e210c3b0391590699999f33a1fd5de4ca6559ff894b4e6cb4ac1415a0
SSDEEP 768:J2rURM7RMwTQvsF51u5tyxwgyBEkLki6Ynb:J2rwWRjM0FCagQi6Yb
MD5 SHA1 SHA512 SSDEEP

Submit Download

nautoup.log

Path C:\nautoup.log
Size 160B
SHA256 849370ddf35d4ac26e0c8025c95404062c3af2353b17edf09abd5bc45ec02a87
MD5 279156c97d1b8c41514bf1b4a78d9f3b
SHA1 988bc77a422e87163c88a88899bb283a7c092784
SHA512 8818de1fb5502d47f8759d11a3244c5e53d4cb553799209a9f04517f7a5fe985e9d2750578632451675f67a1792021ac5136ba74338ba3ac4491d3e362ebc862
MD5 SHA1 SHA512

Submit Download

iewindow.exe

Path \Program Files (x86)\netimo\Common Shared\URLHelper\iewindow.exe
Size 406KB
SHA256 b697f80f2fd2a0f12e8fa9bcf02cedf1306f618d1328ace2e7954038eab6716a
MD5 a9750f0259293728bd56dc8a6509ab04
SHA1 11f79809356887f995896febf2cde9da0bbc48bb
SHA512 3a3c659183e2ca1c5a03f579fbaa9f76b731030c06571fe73b12bd8e2a4d626764e4cb7aea35803199a8da9db217985215bab48c199c7564a20bd2bd592a9a1b
SSDEEP 6144:QzIHrlVzNOKvt9mI0E3BDh/9nk85ziUpUox/vb5FH7869Hbdgt:KKQKHH0+BN/9HdiBohT5FoyHbI
MD5 SHA1 SHA512 SSDEEP

Submit Download

nnlogon.exe

Path \Program Files (x86)\netimo\Common Shared\URLHelper\nnlogon.exe
Size 68KB
SHA256 8a730e05ec59ca9c2bea7b950b7178c5174da28d0843ba1f3f10b47e352b219d
MD5 4f8ec9279ce71a9feafd811a2a0fe8fc
SHA1 8c5e103eeb3dec74297b41739a28eb0c1b4d0478
SHA512 61c0b531b0530afba51138bc8d876a715e059fa716652b9155bead099c1e6dea9a972f219bc593d6e0ef4d7bc849a9108cb6cd99eb72e61d8d0f45e3199908c9
SSDEEP 768:G1UEOcy9lHXBT/J33p47yTeXeJIYwnbVYcWB5vUL6CdLQC2fQEH:G1UMERp47yTLJGnbVYWL7dLAQEH
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntmurl.dll

Path \Program Files (x86)\netimo\Common Shared\URLHelper\ntmurl.dll
Size 174KB
SHA256 1003a84d5e1e35e0873ed0b6ed184e7348480184beeb714ee0e65107edfdbb3e
MD5 3984956c55c48b8822e908df7fe019fd
SHA1 2e68f7b39e9ba71aa673c54ebbad7233218590d9
SHA512 44180b1705b60782a5bb7ff3f371ab55de7c012006e8659a15af03f35dfe15729493083de03047d12898248f5802f2f4f4759eef0dcece4bee92f0153c40172e
SSDEEP 3072:pdNVHMZC51dzABC8e/zTqqfiZIE8+i8nyP2PaxxG9p:phsATqqiZIEHyeizGv
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntmurl.exe

Path \Program Files (x86)\netimo\Common Shared\URLHelper\ntmurl.exe
Size 226KB
SHA256 9f0e364297feda755f3b134b0db882369c3b6ca1985691c49f4b3bba02c7f316
MD5 8ad6d0d50e3b19f6b4bee7b9bcba2c73
SHA1 d1b1ce5e137f15b2d11261879139b4d078b5f734
SHA512 64ccd7f2aa385d6be9755432a48805519932cc220db7581daa3cb8123678d5433529c7f6b94eed3e319fad3781941356740eded95ee5024a788860d373b3a8fd
SSDEEP 6144:nfWUIstzkIotRfXZpMTjlhbIhPdoxVRXzJlOBOxuewBuo:+tsmi/YFoxVlJkBOxuDB1
MD5 SHA1 SHA512 SSDEEP

Submit Download

urld.exe

Path \Program Files (x86)\netimo\Common Shared\URLHelper\urld.exe
Size 24KB
SHA256 e56aa545162c1da6c7ff2b9ae7df78eb7adfa99c9648a6a6c013ff28e5246f82
MD5 2b44719cfe2006f025445f2b62bfdbaa
SHA1 8114afce7e26087e398ae1103c6012139a564242
SHA512 12297a70cab4b2d4530b666f2a6449221c476de5763c0ed56d33da94ebcc568f192332bb2a7b13a1702e84140b5232bb4feea304b7d224a241db26db01a5a97d
SSDEEP 384:2GAqrVdL9+3K9DhDu2fkSfD/DK0Sn1We9:2GAqr/LvjMSrLAb
MD5 SHA1 SHA512 SSDEEP

Submit Download

TypeLib.dll

Path \Users\Admin\AppData\Local\Temp\nsd1EB8.tmp\TypeLib.dll
Size 3KB
SHA256 75c206fba2ec5d344ca514e6451d8892f939f15e8afc1c132bbc9eca886ed1de
MD5 56abaa41368ddf53d01421760f9d72f4
SHA1 68a4e41d46366e8116bdfeba34d94b628fc6fb45
SHA512 98aaee865ee756f6193fb89f35aaf019953c597f92f0e6d3f4a8ead27d5c09f8ac9d39b547a655f2eb4ce6b8867b4e12a20f43749bce3bc2a5f7e668378649d9
MD5 SHA1 SHA512

Submit Download

nsExec.dll

Path \Users\Admin\AppData\Local\Temp\nsd1EB8.tmp\nsExec.dll
Size 6KB
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
MD5 SHA1 SHA512 SSDEEP

Submit Download

DWSHK80.OCX

Path \Windows\SysWOW64\DWSHK80.OCX
Size 200KB
SHA256 8413fe7000baca9e7a2fdef33922d17d97ef9d16799444b945b3c73fee953c6b
MD5 956041a95acf9738b712c71c55672094
SHA1 84959e2c0b07d631de4f71da32e1c3c301285e68
SHA512 c93085f6e4159e3a75e9167e036214930a3ec3960d5eb3e0812f164a841f60b1c3454bcc7a2227b7d0e80c303db11d322a1e6862d643a614c32e4d6b1798b298
SSDEEP 6144:BE0Jarr0dWt86FKhOO1ITPKFD7Mq0BTv:+0c3mWi6ElKR
MD5 SHA1 SHA512 SSDEEP

Submit Download

dwsbc80.OCX

Path \Windows\SysWOW64\dwsbc80.OCX
Size 167KB
SHA256 242934d4d92948817dd00eec4e8592f7044f5bfc7b2ad2603c826c5cea7b09e5
MD5 456b24a38b8e2d2f3303e0b4d05cc929
SHA1 3c981bbac31706cc9189605959f9eba7acbb17a7
SHA512 4476f50a9ade47c848f882b56758111d39a79e61ac62cebf09c8b8d7baaaa77767c11da6e6732caa383b372d0d8a49be116e111299f637e2ea722fa5fd978385
SSDEEP 3072:K33ebWXothdt1FFfPLyKq1YeoXijMkcI1SjX7iO1ChheO/n3hzOi:DN9LjgiiO1ChheO/n3
MD5 SHA1 SHA512 SSDEEP

Submit Download

dwshengine80.dll

Path \Windows\SysWOW64\dwshengine80.dll
Size 137KB
SHA256 a8ab488c1ffeed943a68ce7f72fa2eb1b9b21b62c01fbd405a93906a4b357621
MD5 df901a23e6da0cad1981f0a7c13fbf24
SHA1 78f8f8e857e5ce4dce9fdc6658b5780b07167df7
SHA512 1d530caccd728006b1c169a9684044b45384ff4caca02f95c26e15339c4bcfad00f70a85b9f3b6d6d84aed242536ecea454636688e33fa6c6558f67378fc8228
SSDEEP 3072:jVEYo+V9rYoQ7/pnDeZtVbbOtF4759qDD2:jVEYdHE/CbOto59
MD5 SHA1 SHA512 SSDEEP

Submit Download