Analysis
- max time kernel
149s - max time network
48s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
24/06/2024, 09:48
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
27 signatures
150 seconds
General
- Target 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe
- Size 535KB
- Sample240624-ls36vswdla
- SHA256 9ce6d854a063a7cf8c1b3da3ed1a105c918a80f2bbcfba837d18e31e0140cecf
- MD5 07caf98f433f73a1041c03dedf85ad1f
- SHA1 c03ba93b61c0f7b361ac140503b50e706b81ae7d
- SHA512 97cd4699843b197bfe402a162a5cdc869a74954185376e908f857d093b84daa1f47bb8711f66a363eb48721e29d60d909d10ee2f6dc72e806d98e334e5b4c4ad
- SSDEEP 12288:XvFxeIeI2H7nie9c8T/gEDH69PRnwF/sL:fFEIL2bnie9d/gO6PiF/sL
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe - Disables Task Manager via registry modification
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation GLB5563.tmp - Executes dropped EXE 3 IoCs
pid Process 5004 msgr8us.2007.07.24.01.exe 4228 GLB5563.tmp 1468 ymdc.exe - Loads dropped DLL 10 IoCs
pid Process 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 4228 GLB5563.tmp 4228 GLB5563.tmp 4228 GLB5563.tmp 1468 ymdc.exe 1468 ymdc.exe 1468 ymdc.exe 1468 ymdc.exe 4228 GLB5563.tmp 4228 GLB5563.tmp - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/2196-1-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-3-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-4-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-6-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-5-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-22-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-11-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-9-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-23-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-35-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-36-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-37-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-46-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-47-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-115-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-116-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-117-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-119-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-120-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-128-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-130-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-133-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-135-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-136-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-138-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-139-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-140-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-141-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-143-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-145-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-147-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-150-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-151-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-152-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-153-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-154-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-160-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-161-0x0000000002300000-0x000000000338E000-memory.dmp upx behavioral2/memory/2196-166-0x0000000002300000-0x000000000338E000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened (read-only) \??\I: 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened (read-only) \??\M: 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened (read-only) \??\P: 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened (read-only) \??\T: 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened (read-only) \??\Y: 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened (read-only) \??\E: 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened (read-only) \??\V: 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened (read-only) \??\H: 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened (read-only) \??\K: 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened (read-only) \??\R: 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened (read-only) \??\U: 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened (read-only) \??\X: 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened (read-only) \??\Z: 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened (read-only) \??\J: 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened (read-only) \??\L: 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened (read-only) \??\N: 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened (read-only) \??\O: 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened (read-only) \??\Q: 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened (read-only) \??\S: 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened (read-only) \??\W: 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened for modification F:\autorun.inf 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\GLBSINST.%$D GLB5563.tmp - Drops file in Program Files directory 12 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- NSIS installer 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023433-77.dat nsis_installer_1 - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\hardware\description\system\CentralProcessor\0 GLB5563.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHZ GLB5563.tmp - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe Token: SeDebugPrivilege 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4228 GLB5563.tmp 4228 GLB5563.tmp 1468 ymdc.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2196 wrote to memory of 784 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 8 PID 2196 wrote to memory of 780 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 9 PID 2196 wrote to memory of 1020 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 13 PID 2196 wrote to memory of 2512 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 45 PID 2196 wrote to memory of 2560 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 46 PID 2196 wrote to memory of 2824 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 51 PID 2196 wrote to memory of 3404 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 56 PID 2196 wrote to memory of 3536 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 57 PID 2196 wrote to memory of 3728 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 58 PID 2196 wrote to memory of 3844 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 59 PID 2196 wrote to memory of 3908 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 60 PID 2196 wrote to memory of 3988 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 61 PID 2196 wrote to memory of 3820 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 62 PID 2196 wrote to memory of 2064 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 64 PID 2196 wrote to memory of 964 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 75 PID 2196 wrote to memory of 5004 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 82 PID 2196 wrote to memory of 5004 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 82 PID 2196 wrote to memory of 5004 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 82 PID 5004 wrote to memory of 4228 5004 msgr8us.2007.07.24.01.exe 83 PID 5004 wrote to memory of 4228 5004 msgr8us.2007.07.24.01.exe 83 PID 5004 wrote to memory of 4228 5004 msgr8us.2007.07.24.01.exe 83 PID 4228 wrote to memory of 1468 4228 GLB5563.tmp 84 PID 4228 wrote to memory of 1468 4228 GLB5563.tmp 84 PID 4228 wrote to memory of 1468 4228 GLB5563.tmp 84 PID 2196 wrote to memory of 784 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 8 PID 2196 wrote to memory of 780 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 9 PID 2196 wrote to memory of 1020 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 13 PID 2196 wrote to memory of 2512 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 45 PID 2196 wrote to memory of 2560 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 46 PID 2196 wrote to memory of 2824 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 51 PID 2196 wrote to memory of 3404 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 56 PID 2196 wrote to memory of 3536 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 57 PID 2196 wrote to memory of 3728 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 58 PID 2196 wrote to memory of 3844 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 59 PID 2196 wrote to memory of 3908 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 60 PID 2196 wrote to memory of 3988 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 61 PID 2196 wrote to memory of 3820 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 62 PID 2196 wrote to memory of 2064 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 64 PID 2196 wrote to memory of 964 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 75 PID 2196 wrote to memory of 5004 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 82 PID 2196 wrote to memory of 5004 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 82 PID 2196 wrote to memory of 4228 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 83 PID 2196 wrote to memory of 4228 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 83 PID 2196 wrote to memory of 784 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 8 PID 2196 wrote to memory of 780 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 9 PID 2196 wrote to memory of 1020 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 13 PID 2196 wrote to memory of 2512 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 45 PID 2196 wrote to memory of 2560 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 46 PID 2196 wrote to memory of 2824 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 51 PID 2196 wrote to memory of 3404 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 56 PID 2196 wrote to memory of 3536 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 57 PID 2196 wrote to memory of 3728 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 58 PID 2196 wrote to memory of 3844 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 59 PID 2196 wrote to memory of 3908 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 60 PID 2196 wrote to memory of 3988 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 61 PID 2196 wrote to memory of 3820 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 62 PID 2196 wrote to memory of 2064 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 64 PID 2196 wrote to memory of 964 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 75 PID 2196 wrote to memory of 784 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 8 PID 2196 wrote to memory of 780 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 9 PID 2196 wrote to memory of 1020 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 13 PID 2196 wrote to memory of 2512 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 45 PID 2196 wrote to memory of 2560 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 46 PID 2196 wrote to memory of 2824 2196 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe 51 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1020
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2512
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2560
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2824
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\07caf98f433f73a1041c03dedf85ad1f_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\nsq54F7.tmp\msgr8us.2007.07.24.01.exe"C:\Users\Admin\AppData\Local\Temp\nsq54F7.tmp\msgr8us.2007.07.24.01.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\GLB5563.tmpC:\Users\Admin\AppData\Local\Temp\GLB5563.tmp 4736 C:\Users\Admin\AppData\Local\Temp\nsq54F7.tmp\MSGR8U~1.EXE4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\7186154\ymdc.exe"C:\Users\Admin\AppData\Local\Temp\7186154\ymdc.exe" /guid5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1468
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3536
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3728
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3844
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3908
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3988
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3820
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2064
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:964
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\7186154\bill_1.html
- Size 935B
- SHA256 51a4e9d1b838351f9b3717cd76404f791099977203e259012ccb4273015982a2
- MD5 5142d00e7fab7fe5507e6ff494e38c05
- SHA1 e940551243ef10d145de809c967eedc3467e6247
- SHA512 d7e5756825826792b5144cd35317419fc0b9d974ed4f88b88dc4675391dd618ec0cd05000abdf753ca266a91bf08dc1b7ea3570f909edcd6b62cf61c09e71b49
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7186154\ymdc.exe
- Size 45KB
- SHA256 cad3d5a42b0c9c8566388b55e711579bcc8f08af87ac26b5503f0137ab78c2fb
- MD5 85bfbe59e8e4ad588f298ba69e6cfae8
- SHA1 cafb4095659405c9fe3e6b25f2420accf8ddfe5a
- SHA512 1fb2e5ee669e50c58f65f4f8a456974bd073ca5435aa0a331f6a0c6e82aca63124da3e051ec43db2578e8ade0e142161763540fa966367daee012ee7a575b1a4
- SSDEEP 768:Ar9PAmQk+vuJlRYnQ5+lG0eIFodAQ3rFS6sWkJe2zo/FFTKYbGL3I1bP:iVPH+sliQMJHSbkJeZ/jTPbGcdP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\GLB5563.tmp
- Size 70KB
- SHA256 1e632d64b1a0086d0e207502727da243ade5f94d540d9ea7e82547a03430244b
- MD5 f0c4a3a96f67504d072725eb1f7b3749
- SHA1 f43043fbc4809d8ec4ca9dc7e364698f28531d39
- SHA512 e41fef241ede7a9b16124d9b4ab51e4c4d0958d52d18fb1892607dfa8c22acb11c1bc6a5c990ab7203f0baccf1315e8fdab3f9f361d6f184c53d653404ca8eef
- SSDEEP 1536:bgiiJZEE8+z/H9hBkIoMspbUtnm08D9T4j1t/8CKZwzU6dyLFxZ:bsJ6E5HnWbMaYmL4TjAxZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\GLC567C.tmp
- Size 161KB
- SHA256 a87f19f9fee475d2b2e82acfb4589be6d816b613064cd06826e1d4c147beb50a
- MD5 8c97d8bb1470c6498e47b12c5a03ce39
- SHA1 15d233b22f1c3d756dca29bcc0021e6fb0b8cdf7
- SHA512 7ad0b2b0319da52152c2595ee45045d0c06b157cdaaa56ad57dde9736be3e45fd7357949126f80d3e72b21510f9bf69d010d51b3967a7644662808beed067c3f
- SSDEEP 3072:5kgzCh4age/BKZ5akmUbe2Rm9+ORsUIlyR6J7ooLGA5:9zCuagOcZ5ak36pTRTvRKGA5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\GLK58A1.tmp
- Size 88KB
- SHA256 b6c0533ad7e02a490822a1cb43055ff9d052134828e5e2e75ba100b16902d74a
- MD5 92122fd4b5517708b91b0c73508cbb4a
- SHA1 95a63f2297b76f5d0d5c58f1a5c08c6da723151b
- SHA512 abc9642d470e993c1b97d5132b665f9a4c4cf9cebdc6537249acaa7566e60ce5a211954e621601b5344b24fe498b89cc0bbb73f29f5f3ee33a78db94b1500027
- SSDEEP 1536:zuRBy1BLLCHa+h/v4OwkwSu57hLTF+nOLETHZ/UowKMh1:KABabCOwkwSu57hAZbNUoLs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\GLM5F0B.tmp
- Size 12KB
- SHA256 15bb390af019d92e1d02771b02335fa360db1bb34bcf4f0c72705027428f4ff1
- MD5 484cb68472473a1a84ff07996bb8c1f6
- SHA1 bce9d810f2558e73854e7c8e05f122b002558e9a
- SHA512 5f756d11290e0240fabeab6cb638f7e42024b95b5a44eea6b44dba610919a9d9d5654a87af29ef249fb22bfb9eae7dadd3abb42faa594a465efa1ff358a2fd47
- SSDEEP 192:1vruYw2MS0KCfjlfTgq9siiyrp7Ne3b7vRb+2VVLoQgwAeCA9t0D:d6kCfR8q9Cyr2fL/L3gwAuE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsh6514.tmp\Base64.dll
- Size 3KB
- SHA256 c71e2949e7e4acd0504768d273f11f326d9eb8c69cfdfd432f49e22226bad0d9
- MD5 9aab2d503fb623cbd7be6eca61176ff9
- SHA1 126f2ce61b2945005a1ddb034d44325b7b13fbaa
- SHA512 a3b46c3be55f8a1e9cbbdae059688b17c7d6ae4a5f5750b95e62a23e1513214e42d2bca8583f723f58e1295f2a98e84f075113eccb62f6d625a00a7c10d6ca0c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsq54F7.tmp\System.dll
- Size 9KB
- SHA256 d8d38c8983c4e29b13c93295876bf3726023fafd05985f354e09b806993f78c5
- MD5 6621d1f4e191c018a0d8abb5c610d1aa
- SHA1 c3af35a5df9361e2805bd84d3e3144e0b9c44d5b
- SHA512 6029146fc1f193214aa0fd81d7ca724e741fd79c55e42976cb69d37464e55d1258fa866fcfadc0182f3726de018381c660622d78617cd726472163e847a3f3a5
- SSDEEP 192:XZh4PSVvw5XXHvRwd7ybS45DxZU8a0fF:4znvK8rDHTxf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsq54F7.tmp\msgr8us.2007.07.24.01.exe
- Size 426KB
- SHA256 4c976ea6f7526eee60dafffb35aad10c487f89b656dc40481f2c285fa1e7d982
- MD5 ae892e0cf81f5dafeaeb63b29685e4dd
- SHA1 cc75fe90ee6426d5f5ad66cac5efb0a6c7266142
- SHA512 144a59b46a4a015798fa85fdb4ac9f54147b64b65ad87a7693b89a34803d2e9b8d4575c62029a4c1def75ec3eca767a24164c43a3e5cd31dea89ff03b7a162d5
- SSDEEP 12288:2MRlmhLR6lNyq7okwg+byl9hJ9V+H4Z2wX:2ekOyy4byxDNX
- MD5 SHA1 SHA512 SSDEEP
- Path F:\bpfhxe.exe
- Size 100KB
- SHA256 6e82a7af3f963b29537523235b5cc8349558bb044fd5b2cc66af100147a6fe5c
- MD5 cddff31ce4828ada3e5ee2d00fbbffa6
- SHA1 3ffafc84bd60f1619fafbd6576264037cb504c16
- SHA512 81e0e6722c6da3efac25a505ca47ea98c0f65279b50bafa3ad256e11463a4918cff089b8c99b93cda060493ab456b5d61e0ea76432b201774910984ad787b80f
- SSDEEP 3072:va4tQtLoYygYPm2L8YXj3FFs5Z9HPFyeA:/tI5gPZbo9vFyeA
- MD5 SHA1 SHA512 SSDEEP