4d83ebffa15f1977ea6f4aaef47c874d770a2a9e2ebd74b8e0298a5277f1a390

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 23:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fe0e8736beca525247d2c952a086f7f_JaffaCakes118.exe
Size

44KB
MD5

0fe0e8736beca525247d2c952a086f7f
SHA1

22ee647d8285dfbb9d031b7b259ee68129ce59b6
SHA256

4d83ebffa15f1977ea6f4aaef47c874d770a2a9e2ebd74b8e0298a5277f1a390
SHA512

eec8a7ff6c60a0ee4bfd0baff8069163a7071e79bcbdf77389f26134b138a034c4b248d949aa9541de3a55a3699ea374f63e8fb9d6413e04ca1c06c721da968e
SSDEEP

384:/wm3UqRKwBBUuRXt8eX2c9yfnH+8wdKRSJMZgJOftuOY+GHHbrg/XqRKwBBrm3:tPRd8GVQ+jJOgJOo6r

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	regedit.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	regedit.exe

Disables Task Manager via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
2640	EXPLORER.EXE

Loads dropped DLL 2 IoCs

pid	Process
820	0fe0e8736beca525247d2c952a086f7f_JaffaCakes118.exe
820	0fe0e8736beca525247d2c952a086f7f_JaffaCakes118.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	regedit.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FolderRaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0fe0e8736beca525247d2c952a086f7f_JaffaCakes118.exe"	regedit.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	\??\c:\Autorun.inf	EXPLORER.EXE
File opened for modification	\??\d:\Autorun.inf	EXPLORER.EXE
File opened for modification	\??\f:\Autorun.inf	EXPLORER.EXE

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\EXPLORER.EXE	0fe0e8736beca525247d2c952a086f7f_JaffaCakes118.exe
File opened for modification	C:\Program Files\EXPLORER.EXE	0fe0e8736beca525247d2c952a086f7f_JaffaCakes118.exe
File opened for modification	C:\Program Files\Funny!.reg	EXPLORER.EXE

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico	explorer.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\NavBar = 000000000000000000000000000000008b000000870000003153505305d5cdd59c2e1b10939708002b2cf9ae6b0000005a000000007b00360044003800420042003300440033002d0039004400380037002d0034004100390031002d0041004200350036002d003400460033003000430046004600450046004500390046007d005f0057006900640074006800000013000000f00000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 200000001a00eebbfe2300001000d09ad3fd8f23af46adb46c85480369c700000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	regedit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe

Runs .reg file with regedit 30 IoCs

pid	Process
2404	regedit.exe
2348	regedit.exe
684	regedit.exe
892	regedit.exe
2024	regedit.exe
1756	regedit.exe
2356	regedit.exe
2800	regedit.exe
1364	regedit.exe
2832	regedit.exe
576	regedit.exe
2604	regedit.exe
1328	regedit.exe
2592	regedit.exe
2196	regedit.exe
2012	regedit.exe
1092	regedit.exe
1760	regedit.exe
1636	regedit.exe
320	regedit.exe
820	regedit.exe
2768	regedit.exe
1496	regedit.exe
2856	regedit.exe
1668	regedit.exe
2708	regedit.exe
3068	regedit.exe
312	regedit.exe
1716	regedit.exe
2536	regedit.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
820	0fe0e8736beca525247d2c952a086f7f_JaffaCakes118.exe
2640	EXPLORER.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 2368	820	0fe0e8736beca525247d2c952a086f7f_JaffaCakes118.exe	28
PID 820 wrote to memory of 2368	820	0fe0e8736beca525247d2c952a086f7f_JaffaCakes118.exe	28
PID 820 wrote to memory of 2368	820	0fe0e8736beca525247d2c952a086f7f_JaffaCakes118.exe	28
PID 820 wrote to memory of 2368	820	0fe0e8736beca525247d2c952a086f7f_JaffaCakes118.exe	28
PID 820 wrote to memory of 312	820	0fe0e8736beca525247d2c952a086f7f_JaffaCakes118.exe	30
PID 820 wrote to memory of 312	820	0fe0e8736beca525247d2c952a086f7f_JaffaCakes118.exe	30
PID 820 wrote to memory of 312	820	0fe0e8736beca525247d2c952a086f7f_JaffaCakes118.exe	30
PID 820 wrote to memory of 312	820	0fe0e8736beca525247d2c952a086f7f_JaffaCakes118.exe	30
PID 820 wrote to memory of 2640	820	0fe0e8736beca525247d2c952a086f7f_JaffaCakes118.exe	31
PID 820 wrote to memory of 2640	820	0fe0e8736beca525247d2c952a086f7f_JaffaCakes118.exe	31
PID 820 wrote to memory of 2640	820	0fe0e8736beca525247d2c952a086f7f_JaffaCakes118.exe	31
PID 820 wrote to memory of 2640	820	0fe0e8736beca525247d2c952a086f7f_JaffaCakes118.exe	31
PID 2640 wrote to memory of 2708	2640	EXPLORER.EXE	32
PID 2640 wrote to memory of 2708	2640	EXPLORER.EXE	32
PID 2640 wrote to memory of 2708	2640	EXPLORER.EXE	32
PID 2640 wrote to memory of 2708	2640	EXPLORER.EXE	32
PID 2640 wrote to memory of 2832	2640	EXPLORER.EXE	33
PID 2640 wrote to memory of 2832	2640	EXPLORER.EXE	33
PID 2640 wrote to memory of 2832	2640	EXPLORER.EXE	33
PID 2640 wrote to memory of 2832	2640	EXPLORER.EXE	33
PID 2640 wrote to memory of 2768	2640	EXPLORER.EXE	34
PID 2640 wrote to memory of 2768	2640	EXPLORER.EXE	34
PID 2640 wrote to memory of 2768	2640	EXPLORER.EXE	34
PID 2640 wrote to memory of 2768	2640	EXPLORER.EXE	34
PID 2640 wrote to memory of 2012	2640	EXPLORER.EXE	35
PID 2640 wrote to memory of 2012	2640	EXPLORER.EXE	35
PID 2640 wrote to memory of 2012	2640	EXPLORER.EXE	35
PID 2640 wrote to memory of 2012	2640	EXPLORER.EXE	35
PID 2640 wrote to memory of 2024	2640	EXPLORER.EXE	36
PID 2640 wrote to memory of 2024	2640	EXPLORER.EXE	36
PID 2640 wrote to memory of 2024	2640	EXPLORER.EXE	36
PID 2640 wrote to memory of 2024	2640	EXPLORER.EXE	36
PID 2640 wrote to memory of 1756	2640	EXPLORER.EXE	37
PID 2640 wrote to memory of 1756	2640	EXPLORER.EXE	37
PID 2640 wrote to memory of 1756	2640	EXPLORER.EXE	37
PID 2640 wrote to memory of 1756	2640	EXPLORER.EXE	37
PID 2640 wrote to memory of 2196	2640	EXPLORER.EXE	38
PID 2640 wrote to memory of 2196	2640	EXPLORER.EXE	38
PID 2640 wrote to memory of 2196	2640	EXPLORER.EXE	38
PID 2640 wrote to memory of 2196	2640	EXPLORER.EXE	38
PID 2640 wrote to memory of 1496	2640	EXPLORER.EXE	39
PID 2640 wrote to memory of 1496	2640	EXPLORER.EXE	39
PID 2640 wrote to memory of 1496	2640	EXPLORER.EXE	39
PID 2640 wrote to memory of 1496	2640	EXPLORER.EXE	39
PID 2640 wrote to memory of 892	2640	EXPLORER.EXE	42
PID 2640 wrote to memory of 892	2640	EXPLORER.EXE	42
PID 2640 wrote to memory of 892	2640	EXPLORER.EXE	42
PID 2640 wrote to memory of 892	2640	EXPLORER.EXE	42
PID 2640 wrote to memory of 1092	2640	EXPLORER.EXE	43
PID 2640 wrote to memory of 1092	2640	EXPLORER.EXE	43
PID 2640 wrote to memory of 1092	2640	EXPLORER.EXE	43
PID 2640 wrote to memory of 1092	2640	EXPLORER.EXE	43
PID 2640 wrote to memory of 1328	2640	EXPLORER.EXE	44
PID 2640 wrote to memory of 1328	2640	EXPLORER.EXE	44
PID 2640 wrote to memory of 1328	2640	EXPLORER.EXE	44
PID 2640 wrote to memory of 1328	2640	EXPLORER.EXE	44
PID 2640 wrote to memory of 2356	2640	EXPLORER.EXE	45
PID 2640 wrote to memory of 2356	2640	EXPLORER.EXE	45
PID 2640 wrote to memory of 2356	2640	EXPLORER.EXE	45
PID 2640 wrote to memory of 2356	2640	EXPLORER.EXE	45
PID 2640 wrote to memory of 2404	2640	EXPLORER.EXE	46
PID 2640 wrote to memory of 2404	2640	EXPLORER.EXE	46
PID 2640 wrote to memory of 2404	2640	EXPLORER.EXE	46
PID 2640 wrote to memory of 2404	2640	EXPLORER.EXE	46

C:\Users\Admin\AppData\Local\Temp\0fe0e8736beca525247d2c952a086f7f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0fe0e8736beca525247d2c952a086f7f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:820
- C:\Windows\SysWOW64\explorer.exe
  explorer C:\Users\Admin\AppData\Local\Temp\0fe0e8736beca525247d2c952a086f7f_JaffaCakes118
  2⤵
  PID:2368
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\Users\Admin\AppData\Local\Temp\Funny!.reg
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Modifies registry class
  - Runs .reg file with regedit
  PID:312
- C:\Program Files\EXPLORER.EXE
  "C:\Program Files\EXPLORER.EXE"
  2⤵
  - Executes dropped EXE
  - Drops autorun.inf file
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:2708
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:2832
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:2768
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:2012
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:2024
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:1756
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:2196
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:1496
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:892
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:1092
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:1328
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:2356
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:2404
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:2592
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:2536
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:2856
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:2800
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:2348
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:1668
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:1760
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:684
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:576
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:1364
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:3068
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:1636
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:1716
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:2604
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:320
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Program Files\Funny!.reg
    3⤵
    - Runs .reg file with regedit
    PID:820

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Autorun.inf

Filesize
99B

MD5
9bf1e5a2afbe7da98a68e24153056e89

SHA1
a081dd05387f0a820c090d1d1d003af4f4374b63

SHA256
bca0db21212fb26b90ca976ad73636249ee40e70f59d867698a760b674ef13d2

SHA512
591855a387d8e28b89821e3d5c0c9418ebc2d644732ab9ce75e90e9db0b2bf7fecfd273fd6ef22a8d8fde87b97002e176d49e274b6c6cfa5798ef151092fcdcf

Download Submit
C:\Program Files\Funny!.reg

Filesize
572B

MD5
c2ab01b697609862244ae7365e7e03d9

SHA1
63f95bf1efc2f7fb66a51627131150a01856ab36

SHA256
3e8770c1a3b8112a25d08b47a1bc0eed22aae31389b16dc03b07f3f10093e092

SHA512
afb30a04c3b50ccd913200b012409a9a1e2411ca97f1143a8e6f879fb8bc50acb3ec0c32a76fa4aea2b5ad35450578b53c51bb6e5e982da4f63136f8734f7da2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Funny!.reg

Filesize
631B

MD5
b5fba68a94b89425c0718fb38bb32e56

SHA1
e119b9eb6761df620f35536232331700fa642b9b

SHA256
4e1256cc8fcba1cc1cf4dd83fdac3be87de2e88ccfe43ed3e62b3e6c49b1daf7

SHA512
153b1efce4b48224b3e24ec816c3e094442e3a24ed490e0e2cbb2a47936c017bfa9f77f7e4a7c754bbc729f98309c50295b9d6b60c11d2b773219957b100c4fc

Download Submit
\Program Files\EXPLORER.EXE

Filesize
44KB

MD5
0fe0e8736beca525247d2c952a086f7f

SHA1
22ee647d8285dfbb9d031b7b259ee68129ce59b6

SHA256
4d83ebffa15f1977ea6f4aaef47c874d770a2a9e2ebd74b8e0298a5277f1a390

SHA512
eec8a7ff6c60a0ee4bfd0baff8069163a7071e79bcbdf77389f26134b138a034c4b248d949aa9541de3a55a3699ea374f63e8fb9d6413e04ca1c06c721da968e

Download Submit
memory/820-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/820-14-0x00000000005A0000-0x00000000005AC000-memory.dmp

Filesize
48KB

Download
memory/820-19-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2552-20-0x0000000003B10000-0x0000000003B20000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads