Analysis
- max time kernel
73s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
22/06/2024, 16:28
Behavioral task
behavioral1
Sample
02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe
Resource
win7-20240419-en
windows7-x64
32 signatures
150 seconds
Behavioral task
behavioral2
Sample
02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
30 signatures
150 seconds
General
- Target 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe
- Size 875KB
- Sample240622-tyrc9athqa
- SHA256 beaa8792a4c8ee6922f0f485068f0cc2d3828d71f619a4588846d9bef5ba5101
- MD5 02ef6309d24b2a0c6de181b4f36257d2
- SHA1 76c43f9218c0f580c8ae37d36e77dfb32def1148
- SHA512 71fef67e607e7a780b17183f3cdae20758472778e540a0ef1ab204019a3b2a240e852a359d35452be8b70ad784508e0dcbd154b9e2f7b1372eecfd52972ce5da
- SSDEEP 24576:B5T0kUJQddHVFQlyOW8oooiAhYJWtA7q:B53UyHVFQAp5iAOgtAG
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "3" cthost.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Ww9OoYLk.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" toxar.exe - ModiLoader Second Stage 11 IoCs
resource yara_rule behavioral2/memory/536-4-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/1528-8-0x0000000000400000-0x0000000000535000-memory.dmp modiloader_stage2 behavioral2/memory/1528-6-0x0000000000400000-0x0000000000535000-memory.dmp modiloader_stage2 behavioral2/memory/1528-7-0x0000000000400000-0x0000000000535000-memory.dmp modiloader_stage2 behavioral2/memory/1528-20-0x0000000000400000-0x0000000000535000-memory.dmp modiloader_stage2 behavioral2/files/0x000800000002324d-23.dat modiloader_stage2 behavioral2/memory/2184-33-0x0000000000400000-0x000000000041E000-memory.dmp modiloader_stage2 behavioral2/files/0x000700000002324f-60.dat modiloader_stage2 behavioral2/memory/3300-69-0x0000000000400000-0x000000000041E000-memory.dmp modiloader_stage2 behavioral2/memory/1528-339-0x0000000000400000-0x0000000000535000-memory.dmp modiloader_stage2 behavioral2/memory/1528-344-0x0000000000400000-0x0000000000535000-memory.dmp modiloader_stage2 - Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Disables taskbar notifications via registry modification
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation Ww9OoYLk.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe - Executes dropped EXE 12 IoCs
pid Process 3500 Ww9OoYLk.exe 2184 athost.exe 2316 athost.exe 3300 bthost.exe 1156 bthost.exe 1044 toxar.exe 4548 cthost.exe 456 dthost.exe 2020 ethost.exe 832 cthost.exe 4592 B159.tmp 4840 cthost.exe - Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/1528-0-0x0000000000400000-0x0000000000535000-memory.dmp upx behavioral2/memory/1528-1-0x0000000000400000-0x0000000000535000-memory.dmp upx behavioral2/memory/1528-5-0x0000000000400000-0x0000000000535000-memory.dmp upx behavioral2/memory/1528-8-0x0000000000400000-0x0000000000535000-memory.dmp upx behavioral2/memory/1528-6-0x0000000000400000-0x0000000000535000-memory.dmp upx behavioral2/memory/1528-7-0x0000000000400000-0x0000000000535000-memory.dmp upx behavioral2/memory/1528-20-0x0000000000400000-0x0000000000535000-memory.dmp upx behavioral2/memory/1156-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1156-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1156-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1156-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1156-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4548-96-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/4548-101-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/832-137-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/4548-215-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/4840-223-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/4548-264-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/1528-339-0x0000000000400000-0x0000000000535000-memory.dmp upx behavioral2/memory/1528-344-0x0000000000400000-0x0000000000535000-memory.dmp upx - Adds Run key to start application 2 TTPs 42 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /H" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /h" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /Z" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /T" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /W" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /f" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /B" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /C" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /S" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /F" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /X" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /M" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /N" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /q" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /y" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /a" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /K" toxar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5CA.exe = "C:\\Program Files (x86)\\LP\\A370\\5CA.exe" cthost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /d" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /b" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /m" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /L" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /p" Ww9OoYLk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /s" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /G" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /j" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /P" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /Y" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /o" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /I" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /k" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /V" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /e" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /U" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /D" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /J" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /x" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /n" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /g" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /i" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /u" toxar.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toxar = "C:\\Users\\Admin\\toxar.exe /w" toxar.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe - Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 athost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum bthost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 bthost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum athost.exe - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 536 set thread context of 1528 536 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe 91 PID 2184 set thread context of 2316 2184 athost.exe 94 PID 3300 set thread context of 1156 3300 bthost.exe 96 PID 456 set thread context of 4656 456 dthost.exe 105 - Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\LP\A370\5CA.exe cthost.exe File opened for modification C:\Program Files (x86)\LP\A370\B159.tmp cthost.exe File opened for modification C:\Program Files (x86)\LP\A370\5CA.exe cthost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 explorer.exe - Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 3200 tasklist.exe 5332 tasklist.exe - Modifies registry class 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3808065738-1666277613-1125846146-1000\{293DDA5C-85A5-4F32-AC8E-149966013068} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3808065738-1666277613-1125846146-1000\{6C188DBA-5125-4F2C-90A6-804A98900738} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000 explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3500 Ww9OoYLk.exe 3500 Ww9OoYLk.exe 2316 athost.exe 2316 athost.exe 2316 athost.exe 2316 athost.exe 2316 athost.exe 2316 athost.exe 3500 Ww9OoYLk.exe 3500 Ww9OoYLk.exe 1156 bthost.exe 1156 bthost.exe 4548 cthost.exe 4548 cthost.exe 4548 cthost.exe 4548 cthost.exe 4548 cthost.exe 4548 cthost.exe 4548 cthost.exe 4548 cthost.exe 4548 cthost.exe 4548 cthost.exe 4548 cthost.exe 4548 cthost.exe 1044 toxar.exe 1044 toxar.exe 1044 toxar.exe 1044 toxar.exe 1044 toxar.exe 1044 toxar.exe 1044 toxar.exe 1044 toxar.exe 1044 toxar.exe 1044 toxar.exe 2316 athost.exe 2316 athost.exe 2316 athost.exe 2316 athost.exe 1044 toxar.exe 1044 toxar.exe 1044 toxar.exe 1044 toxar.exe 1044 toxar.exe 1044 toxar.exe 1044 toxar.exe 1044 toxar.exe 1044 toxar.exe 1044 toxar.exe 1044 toxar.exe 1044 toxar.exe 1044 toxar.exe 1044 toxar.exe 2316 athost.exe 2316 athost.exe 2316 athost.exe 2316 athost.exe 1044 toxar.exe 1044 toxar.exe 1044 toxar.exe 1044 toxar.exe 1044 toxar.exe 1044 toxar.exe 1044 toxar.exe 1044 toxar.exe - Suspicious use of AdjustPrivilegeToken 56 IoCs
description pid Process Token: SeDebugPrivilege 3200 tasklist.exe Token: SeDebugPrivilege 456 dthost.exe Token: SeSecurityPrivilege 3776 msiexec.exe Token: SeShutdownPrivilege 2472 explorer.exe Token: SeCreatePagefilePrivilege 2472 explorer.exe Token: SeShutdownPrivilege 2472 explorer.exe Token: SeCreatePagefilePrivilege 2472 explorer.exe Token: SeShutdownPrivilege 2472 explorer.exe Token: SeCreatePagefilePrivilege 2472 explorer.exe Token: SeShutdownPrivilege 2472 explorer.exe Token: SeCreatePagefilePrivilege 2472 explorer.exe Token: SeShutdownPrivilege 2472 explorer.exe Token: SeCreatePagefilePrivilege 2472 explorer.exe Token: SeShutdownPrivilege 2472 explorer.exe Token: SeCreatePagefilePrivilege 2472 explorer.exe Token: SeShutdownPrivilege 2472 explorer.exe Token: SeCreatePagefilePrivilege 2472 explorer.exe Token: SeShutdownPrivilege 2472 explorer.exe Token: SeCreatePagefilePrivilege 2472 explorer.exe Token: SeShutdownPrivilege 2472 explorer.exe Token: SeCreatePagefilePrivilege 2472 explorer.exe Token: SeShutdownPrivilege 2472 explorer.exe Token: SeCreatePagefilePrivilege 2472 explorer.exe Token: SeShutdownPrivilege 2472 explorer.exe Token: SeCreatePagefilePrivilege 2472 explorer.exe Token: SeShutdownPrivilege 2472 explorer.exe Token: SeCreatePagefilePrivilege 2472 explorer.exe Token: SeShutdownPrivilege 2472 explorer.exe Token: SeCreatePagefilePrivilege 2472 explorer.exe Token: SeShutdownPrivilege 2472 explorer.exe Token: SeCreatePagefilePrivilege 2472 explorer.exe Token: SeShutdownPrivilege 2472 explorer.exe Token: SeCreatePagefilePrivilege 2472 explorer.exe Token: SeShutdownPrivilege 5196 explorer.exe Token: SeCreatePagefilePrivilege 5196 explorer.exe Token: SeShutdownPrivilege 5196 explorer.exe Token: SeCreatePagefilePrivilege 5196 explorer.exe Token: SeDebugPrivilege 5332 tasklist.exe Token: SeShutdownPrivilege 5196 explorer.exe Token: SeCreatePagefilePrivilege 5196 explorer.exe Token: SeShutdownPrivilege 5196 explorer.exe Token: SeCreatePagefilePrivilege 5196 explorer.exe Token: SeShutdownPrivilege 5196 explorer.exe Token: SeCreatePagefilePrivilege 5196 explorer.exe Token: SeShutdownPrivilege 5196 explorer.exe Token: SeCreatePagefilePrivilege 5196 explorer.exe Token: SeShutdownPrivilege 5196 explorer.exe Token: SeCreatePagefilePrivilege 5196 explorer.exe Token: SeShutdownPrivilege 5196 explorer.exe Token: SeCreatePagefilePrivilege 5196 explorer.exe Token: SeShutdownPrivilege 5196 explorer.exe Token: SeCreatePagefilePrivilege 5196 explorer.exe Token: SeShutdownPrivilege 5196 explorer.exe Token: SeCreatePagefilePrivilege 5196 explorer.exe Token: SeShutdownPrivilege 5196 explorer.exe Token: SeCreatePagefilePrivilege 5196 explorer.exe - Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 2472 explorer.exe 2472 explorer.exe 2472 explorer.exe 2472 explorer.exe 2472 explorer.exe 2472 explorer.exe 2472 explorer.exe 2472 explorer.exe 2472 explorer.exe 2472 explorer.exe 2472 explorer.exe 2472 explorer.exe 2472 explorer.exe 2472 explorer.exe 2472 explorer.exe 2472 explorer.exe 2472 explorer.exe 2472 explorer.exe 2472 explorer.exe 5196 explorer.exe 5196 explorer.exe 5196 explorer.exe 5196 explorer.exe 5196 explorer.exe 5196 explorer.exe 5196 explorer.exe 5196 explorer.exe 5196 explorer.exe 5196 explorer.exe 5196 explorer.exe 5196 explorer.exe 5196 explorer.exe 5196 explorer.exe 5196 explorer.exe 5196 explorer.exe - Suspicious use of SendNotifyMessage 22 IoCs
pid Process 2472 explorer.exe 2472 explorer.exe 2472 explorer.exe 2472 explorer.exe 2472 explorer.exe 2472 explorer.exe 2472 explorer.exe 2472 explorer.exe 2472 explorer.exe 2472 explorer.exe 2472 explorer.exe 5196 explorer.exe 5196 explorer.exe 5196 explorer.exe 5196 explorer.exe 5196 explorer.exe 5196 explorer.exe 5196 explorer.exe 5196 explorer.exe 5196 explorer.exe 5196 explorer.exe 5196 explorer.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1528 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe 3500 Ww9OoYLk.exe 1044 toxar.exe 2020 ethost.exe 2556 StartMenuExperienceHost.exe 3180 SearchApp.exe 5644 StartMenuExperienceHost.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 536 wrote to memory of 1528 536 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe 91 PID 536 wrote to memory of 1528 536 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe 91 PID 536 wrote to memory of 1528 536 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe 91 PID 536 wrote to memory of 1528 536 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe 91 PID 536 wrote to memory of 1528 536 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe 91 PID 536 wrote to memory of 1528 536 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe 91 PID 536 wrote to memory of 1528 536 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe 91 PID 536 wrote to memory of 1528 536 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe 91 PID 536 wrote to memory of 1528 536 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe 91 PID 1528 wrote to memory of 3500 1528 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe 92 PID 1528 wrote to memory of 3500 1528 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe 92 PID 1528 wrote to memory of 3500 1528 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe 92 PID 1528 wrote to memory of 2184 1528 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe 93 PID 1528 wrote to memory of 2184 1528 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe 93 PID 1528 wrote to memory of 2184 1528 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe 93 PID 2184 wrote to memory of 2316 2184 athost.exe 94 PID 2184 wrote to memory of 2316 2184 athost.exe 94 PID 2184 wrote to memory of 2316 2184 athost.exe 94 PID 2184 wrote to memory of 2316 2184 athost.exe 94 PID 2184 wrote to memory of 2316 2184 athost.exe 94 PID 2184 wrote to memory of 2316 2184 athost.exe 94 PID 2184 wrote to memory of 2316 2184 athost.exe 94 PID 2184 wrote to memory of 2316 2184 athost.exe 94 PID 2184 wrote to memory of 2316 2184 athost.exe 94 PID 2184 wrote to memory of 2316 2184 athost.exe 94 PID 1528 wrote to memory of 3300 1528 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe 95 PID 1528 wrote to memory of 3300 1528 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe 95 PID 1528 wrote to memory of 3300 1528 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe 95 PID 3300 wrote to memory of 1156 3300 bthost.exe 96 PID 3300 wrote to memory of 1156 3300 bthost.exe 96 PID 3300 wrote to memory of 1156 3300 bthost.exe 96 PID 3300 wrote to memory of 1156 3300 bthost.exe 96 PID 3300 wrote to memory of 1156 3300 bthost.exe 96 PID 3300 wrote to memory of 1156 3300 bthost.exe 96 PID 3300 wrote to memory of 1156 3300 bthost.exe 96 PID 3300 wrote to memory of 1156 3300 bthost.exe 96 PID 3300 wrote to memory of 1156 3300 bthost.exe 96 PID 3500 wrote to memory of 1044 3500 Ww9OoYLk.exe 97 PID 3500 wrote to memory of 1044 3500 Ww9OoYLk.exe 97 PID 3500 wrote to memory of 1044 3500 Ww9OoYLk.exe 97 PID 3500 wrote to memory of 3160 3500 Ww9OoYLk.exe 98 PID 3500 wrote to memory of 3160 3500 Ww9OoYLk.exe 98 PID 3500 wrote to memory of 3160 3500 Ww9OoYLk.exe 98 PID 1528 wrote to memory of 4548 1528 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe 100 PID 1528 wrote to memory of 4548 1528 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe 100 PID 1528 wrote to memory of 4548 1528 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe 100 PID 3160 wrote to memory of 3200 3160 cmd.exe 101 PID 3160 wrote to memory of 3200 3160 cmd.exe 101 PID 3160 wrote to memory of 3200 3160 cmd.exe 101 PID 1044 wrote to memory of 3200 1044 toxar.exe 101 PID 1044 wrote to memory of 3200 1044 toxar.exe 101 PID 1044 wrote to memory of 3200 1044 toxar.exe 101 PID 1044 wrote to memory of 3200 1044 toxar.exe 101 PID 1528 wrote to memory of 456 1528 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe 103 PID 1528 wrote to memory of 456 1528 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe 103 PID 1528 wrote to memory of 456 1528 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe 103 PID 1044 wrote to memory of 3200 1044 toxar.exe 101 PID 1044 wrote to memory of 3200 1044 toxar.exe 101 PID 456 wrote to memory of 4656 456 dthost.exe 105 PID 456 wrote to memory of 4656 456 dthost.exe 105 PID 456 wrote to memory of 4656 456 dthost.exe 105 PID 456 wrote to memory of 4656 456 dthost.exe 105 PID 1528 wrote to memory of 2020 1528 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe 109 PID 1528 wrote to memory of 2020 1528 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe 109 - System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer cthost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" cthost.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\Ww9OoYLk.exeC:\Users\Admin\Ww9OoYLk.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\toxar.exe"C:\Users\Admin\toxar.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del Ww9OoYLk.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3200
-
-
-
-
C:\Users\Admin\athost.exeC:\Users\Admin\athost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\athost.exeathost.exe4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:2316
-
-
-
C:\Users\Admin\bthost.exeC:\Users\Admin\bthost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\bthost.exebthost.exe4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:1156
-
-
-
C:\Users\Admin\cthost.exeC:\Users\Admin\cthost.exe3⤵
- Modifies security service
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:4548 -
C:\Users\Admin\cthost.exeC:\Users\Admin\cthost.exe startC:\Users\Admin\AppData\Roaming\02C04\8B1A3.exe%C:\Users\Admin\AppData\Roaming\02C044⤵
- Executes dropped EXE
PID:832
-
-
C:\Program Files (x86)\LP\A370\B159.tmp"C:\Program Files (x86)\LP\A370\B159.tmp"4⤵
- Executes dropped EXE
PID:4592
-
-
C:\Users\Admin\cthost.exeC:\Users\Admin\cthost.exe startC:\Program Files (x86)\049A8\lvvm.exe%C:\Program Files (x86)\049A84⤵
- Executes dropped EXE
PID:4840
-
-
-
C:\Users\Admin\dthost.exeC:\Users\Admin\dthost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:4656
-
-
-
C:\Users\Admin\ethost.exeC:\Users\Admin\ethost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2020
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 02ef6309d24b2a0c6de181b4f36257d2_JaffaCakes118.exe3⤵PID:5216
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5332
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3776
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4456 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:81⤵PID:3492
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2472
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2556
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:3180
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5196
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5644
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:6044
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4852
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3600
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:536
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5020
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3664
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5192
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3864
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:216
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5592
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3540
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5920
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2496
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3412
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2180
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5372
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:6016
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5536
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5168
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5416
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5660
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:6092
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5444
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5364
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3248
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5652
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1064
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:908
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\LP\A370\B159.tmp
- Size 95KB
- SHA256 d4d9a7028cda13828d7a6796dd12369ab1d4af80946776aa5b5c0369dd322fb3
- MD5 a1d80ed250788260ffd66258555a4876
- SHA1 10b81c2cdc4a7d645f9058c220587fac79281351
- SHA512 fee72d46425a0c1f755de2e34ad742ff579a86b2a3bff3485a15ddcbcf55d60c6297bb588650a9a673aa0a5e8f35f1ae0bc1a454154d26848c49cab700d7e5d8
- SSDEEP 1536:i6+ZGuh069VZtFMZ8qLIxQFDg7uo+GySjON7riK/ArQOASjvsiUJWOlMIvQJMA6t:i6UNG69V/uLIKC7uopBON7riK/qQsjkP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
- Size 471B
- SHA256 378cdb654afeba1c790fab544a148bd30d4317e68e1b9cf8d73a001eedae2ed5
- MD5 f40b4e4692f6a96423dafcbf5ff89e6f
- SHA1 9e5cc9c388de3212d974bf7a0106126cf38c89c1
- SHA512 de91b6397e9bd5f756fc6641ffa04c58c099db030ecc7d6990521542c8b92bc0c6fee71ba351a0ac2efd9aae1f0ee2353dcc32032fa819fd529f7e36795faa4d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
- Size 420B
- SHA256 a6f38fef69445bbed82033e7d707f727b3cd7b00ec44e5442d06e5d15d2c51d2
- MD5 7d9b0b5dff092a3e1e2b07ba18b01edc
- SHA1 9e049193a02acbc98755acbf1634aa5c1d685e02
- SHA512 d6eb0167b7da62c945f0f98a2b391ffe43d9b7c3528a3670f4bc3eef03a1b9953fb16bf344b34787d0064c7fef2507214e70f86bf8e1095509de0446f6b7e030
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
- Size 2KB
- SHA256 1463c4ddcfd2a63b550629c4369d73e6dc022ab00a9986ae19721717af54f64b
- MD5 3f2a0954daf38b3ea6742ed4ea230dfa
- SHA1 490ddcc2dea5ac05398e8bb2fbc5428cadfb463c
- SHA512 dbeab809963086bc778a4e48a6546d329ce689b7a3224ea7f4b8e25de09da849f9cd254573c4aab7f2d422937cee43591fcb9730096aeaa33c6350c74554c01f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5MIHM5LV\microsoft.windows[1].xml
- Size 96B
- SHA256 04d6050009ea3c99cc718ad1c07c5d15268b459fcfb63fcb990bc9761738907b
- MD5 84209e171da10686915fe7efcd51552d
- SHA1 6bf96e86a533a68eba4d703833de374e18ce6113
- SHA512 48d2524000911cfb68ef866dedac78ee430d79aa3f4b68399f645dc2066841e6962e11a3362cbcec46680357dcd3e58cfef9994450fed1d8af04df44f76b0dfd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\02C04\49A8.2C0
- Size 300B
- SHA256 bbe31dba972431053cc337b1f6160d2dfe661b220e97c9b66f3370610758a89e
- MD5 4232d896b14267492ffe3884dea73dc1
- SHA1 1cd5886a67e112f8f54de978df6cab9184c09491
- SHA512 0e8c593aafd48eb9b50f73ccc54b0b32e75c0bc405634d3fa2678aca2b7da2fa7ce0c05726c53699cfa3afc23b21974770a0e43eca83421cabf85051958d1ea8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\02C04\49A8.2C0
- Size 600B
- SHA256 f91dc45394a7f482eba3f3dffe5b4eac6c09fe992309fda2a9bc36a657e8cea2
- MD5 aeabed09181df07251e911a089aa24f4
- SHA1 776cf83f1c0f4356bd4128f583a71f1f6d313bf6
- SHA512 bc8d119b0d1517d4ce9a5c32af59a6cecec9fc17ac4ba11a35d308c8a7ad7ffa2e4e4ebe2aecccbe6d75f11a712a386e45e04e413cd7be9ee158e9abc9dcf2dd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\02C04\49A8.2C0
- Size 897B
- SHA256 f108b9d74d4aa49352545fc048adae9513c3f91a14df59d7e3334dca2e0306d8
- MD5 6269dc1dac496fafbbae712d2e1db660
- SHA1 d1fcc8d2012a8d13ced0227929ca55c4437cd7c5
- SHA512 3e39738924a1c8e86216482af28445b532e97cfbf356883a35eb99903de209835cfb09626cf4f637e4ea89fb63d40a48bf7b155b618ea5c185e0eb852af6d3d6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\02C04\49A8.2C0
- Size 1KB
- SHA256 face8f8b55f8e6f9902de6024b8bf8d31807ad72a41c9d5962a4eb9b167a57e4
- MD5 638918cf4a222e28aeabf5a782efd496
- SHA1 f0b2894a3643e3fa0fd2137759f0b08599523329
- SHA512 0e130ff986e5bc33500f206b3db6249276523c0cf06c03cfe9104f7c7737a4b141e9d6fcc6a1244083be37bc7767b78644b8f821370c2a75a4cd39e69a3b20b6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Ww9OoYLk.exe
- Size 256KB
- SHA256 86b35dd61f186218356ecced37723e647b612cb8c44ef904917f4c783e424809
- MD5 77e425fe955cbc4b6245cf8a3ed645b3
- SHA1 921dad95a28283f2138e8c36d4cbf295572d33ac
- SHA512 ee0a6ac25c021baf6974a23afd999bcdd519da465ee849ebd52d99ff437812165650fe8f05e5ff72f6eadf8d5a44d5c7c73853e4d5e00f8fbab45444fd56a44b
- SSDEEP 6144:+v7cvoNymi+7eeyz2P9NnnnFCpImnTZygoHlKnvmb7/D26UBnmbLBX5a:+wvoNymi+7eOP9anTZygoHlKnvmb7/Do
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\athost.exe
- Size 263KB
- SHA256 6151ab998d7821e147551b5ff24b11d3194c207c3ff8322fe2e2860a8b978bb0
- MD5 6b7d559166467ef651497836feef65e3
- SHA1 9edda6cd07a1960ba52abe17fc7402ff93d44ce6
- SHA512 d58ddfe8ce3b9f4092d554713502065c351a46251ff0ce126dd05528771cd727bf636f15a4c76224d8db22117234d39b1a2bf8030b55aadcf98087a5a1814356
- SSDEEP 3072:CYD1HrB/x1ovkmX5eebdLKRk1w3260RfW9+x3wwbRipdX3Iu2i+imVBfcGfS1OWg:CYD1HFxevkUeyQ26Ux5SdIu0VCGWHCE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\bthost.exe
- Size 153KB
- SHA256 42f40ac82f47f4eb009dbd11d7233ed2e67f80392dd4fa770faa68dd973ded2f
- MD5 f28e94ce33674d8cf13f31bb5f20f745
- SHA1 e79332b18af7b31caa195956c23303d35c2808c8
- SHA512 8bcb1311302bbf1b6cfbbb863cffa95d5934c9bfc613cd2dc2abd425fe39ad2ec9cae7dca1e5b60d2acec4c9d422a35aeb5ab7b0433f25c01202ab3b4ca96112
- SSDEEP 3072:CYD1HrB/x1ovkmX5eebdLKRk1w3260RfW9b0Url/9CqUfh:CYD1HFxevkUeyQ26qOd8T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\cthost.exe
- Size 278KB
- SHA256 3c7ee6117b9c2e39593f452e163f16334ab1b9196b5b5616c9ff7496bb4676a0
- MD5 d0bf4ea3b6fc02afd2c6ed5f4b0d142e
- SHA1 2187968df184c18f945497dd410f90f4b6ff186d
- SHA512 e0efb8672a81a8aa6c11a0f1f871033b10c6a5c6b28d30eab4f8ef7509fca8710c417b9cbbbf7844888f02858295304c23bf217e41d157e2bed594a39c2641f4
- SSDEEP 6144:6KhV5ujOll4iru6suWk80se5n/CTkFGb4MQBv9gVOfaQWuebPBVSAm:HhTujOE+/yk80siiigaNIBcA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\dthost.exe
- Size 227KB
- SHA256 590aaa3add5efffd271c2b9cfc10fc304faf6caf83f2f9dd494a40a35b1053d3
- MD5 d39d17b38909180b0c65cb4081154100
- SHA1 b7a11d389d940273b91dd9ddb11137404eedceea
- SHA512 5a0ccc785b15e92d38bf1436522dbe81645d2b16093f20f09dfd81602e9f496693a6b27a62f88e50cdf027147b89a21db1e15532d0d4e7c2fd65710ee2071fa6
- SSDEEP 3072:Tx3R7J70eySfd76PsB2QD/LpOii7meDj66wVIocYA79djeecdEjR32Uoj4K0lyht:Tqeym6kB2QD0i2DjDwVFIc04eYE87P
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\ethost.exe
- Size 24KB
- SHA256 1fee129dadbd67f7fab68c8fa285b5da0141785100b35bc7b66d55b10d24364d
- MD5 b38b2a8c25efb39b245dbfa6c1ccc29b
- SHA1 62fda766006bfbccbfaade649ceb29764c216ea4
- SHA512 8cdbb4e9404783ad4a2665a05a1e64e8ab393689c2425834e854933f58904910e248dfebc57c717313abbc62105d76875ebafd206ada15417beedd58bbd7e22d
- SSDEEP 384:WqteMrgvvuaW/dlztm1JKsiK/VOXD94aEa:WSeMd1lxqsyaE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\toxar.exe
- Size 256KB
- SHA256 b4b73e62a1207f8eee0f65020536f49c6b4312f133a570e4bd0b3851e2d4c5e8
- MD5 3b03c9022bee3e17e5c60dff0e682fc5
- SHA1 b4a8b965b411d1cc9d4996f9b9001e89d8ce1c64
- SHA512 03d6caf633544fa5f4429b47b2d039556441e1299aef4fdf77301aa4a4a9f2ade971238cfc621f350836add9b9bfcd01be624228e6d5d376e306925e2d3ccad4
- SSDEEP 6144:+v7ivoNymi+7eeyz2P9NnnnFCpImnTZygoHlKnvmb7/D26UBnmbLBX5a:+OvoNymi+7eOP9anTZygoHlKnvmb7/Do
- MD5 SHA1 SHA512 SSDEEP