fa63acdd906b53152744be86ad451edb4ce0c0ba213539591d6ddc640131a6ba

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 12:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15f3320c0e3cc1d7f68fb2afa56dd310_JaffaCakes118.exe
Size

521KB
MD5

15f3320c0e3cc1d7f68fb2afa56dd310
SHA1

639ff6b716aa48738b35b3aa82ec9f4169bcc391
SHA256

fa63acdd906b53152744be86ad451edb4ce0c0ba213539591d6ddc640131a6ba
SHA512

26d7f7b67582de4fad4ece59bc04ddc094faabd023329909a7901e32988aa37acdb1cdaf6a7307a9471226aaa1d23734fe4d9874f33e501e7ca727927e6ab10d
SSDEEP

12288:RYCdqrktyBcXfXOZBfkuCaGBEqrcIdnqnPLE5skoprCYomu0l7hG:arhBKX8fkuCaGyJIdnALE5lQrCHmlltG

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1868	15f3320c0e3cc1d7f68fb2afa56dd310_JaffaCakes118.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1868-0-0x0000000000400000-0x0000000000513000-memory.dmp	upx
behavioral1/memory/1868-1-0x0000000000400000-0x0000000000513000-memory.dmp	upx
behavioral1/memory/1868-3-0x0000000000400000-0x0000000000513000-memory.dmp	upx
behavioral1/files/0x0005000000019601-147.dat	upx
behavioral1/memory/1868-315-0x0000000000400000-0x0000000000513000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main	15f3320c0e3cc1d7f68fb2afa56dd310_JaffaCakes118.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	15f3320c0e3cc1d7f68fb2afa56dd310_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	15f3320c0e3cc1d7f68fb2afa56dd310_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d4624030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	15f3320c0e3cc1d7f68fb2afa56dd310_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e260f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	15f3320c0e3cc1d7f68fb2afa56dd310_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1868	15f3320c0e3cc1d7f68fb2afa56dd310_JaffaCakes118.exe
1868	15f3320c0e3cc1d7f68fb2afa56dd310_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\15f3320c0e3cc1d7f68fb2afa56dd310_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\15f3320c0e3cc1d7f68fb2afa56dd310_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8e7662f27abe93e0419fa62ba617825

SHA1
14e52ec8b5aa31ee74f7f04653c20b71e6ee37c1

SHA256
f78094d9102e698e5b7012af69e9743e63e7855a3425e22467a47048976b3031

SHA512
f5300f6b499aa1dabff6ae7d0eb14a321d2efa46afa12b8003f3ba7cadefb3c3d58c8e664ea6ae96b6102a25dece46c5fa09301e2f57c275e2c4a15d2e8cafd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f64e1d892175c23cde43bc6ad14bb926

SHA1
a9516d61dd04c8720f53174c01b3ce5bdd1bac68

SHA256
35fb0adddb8122a85abd20715e3e44b2a8d05c717d25ae50cce22bd5306d8e32

SHA512
e3013a1e89ed592079305322058febfa09d6b0abff2ce0929d0631dfdcdfee56384dcd8499ab1dea57c885b18d7782c7862f83c72a96bc4e2585e7da4ea6471b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6dcaa4bd9c6845d7993550a54ecaf8a6

SHA1
044a6c1ee6b418c6dec4425a31c23cd5d3646ee2

SHA256
f999eb663fc1029244816af38479cd0b32674317b2c279e906ff21d161241028

SHA512
ae63fdee6091ffa117232c93bbd9c57dad85759a8c9e611b64fc5d745b17c9762b9dc3a4f3a5e0f8d2496c49aedd27a59b414ef52d36ebb36e044e9f8e50ad93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff56c948e998025d639b8b4f74d3c218

SHA1
285dbd7a2538188162d70a0fb7947feeb90b3af3

SHA256
1687f18057e1cea897a0004e96ff5b2d5198fe25bebea8e1a4572c1120ad4841

SHA512
a96d0263c03d10af8765eded80ddbcce36b9a2331ba7bda99a4ef95d36e10f344922564aa7089d97c58dbdb4d86bf4eef97a367614c2450215a2ffa86cc9b11b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1B21.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1BC4.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396762\bootstrap_22542.html

Filesize
156B

MD5
1ea9e5b417811379e874ad4870d5c51a

SHA1
a4bd01f828454f3619a815dbe5423b181ec4051c

SHA256
f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a

SHA512
965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396762\css\main.css

Filesize
5KB

MD5
224ce27420b9adf4491edadb3bc4ccda

SHA1
91d7a7984288713e8b82b1ec5ff36a7de8e8633c

SHA256
2e6dd307b58b6eab1ff4a51c5d532e2050de590deb80e3fc62cd2daefbd55393

SHA512
e28ce17f9dc7a730e95c0d1a6e50d08c4c4704bccee4bd396ebead971e55c75b2b1f26fd38e1749a3a468b04c1b52cffe8dba6da6ae45505f7cc50d098967600

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396762\css\sdk-ui\progress-bar.css

Filesize
506B

MD5
5335f1c12201b5f7cf5f8b4f5692e3d1

SHA1
13807a10369f7ff9ab3f9aba18135bccb98bec2d

SHA256
974cd89e64bdaa85bf36ed2a50af266d245d781a8139f5b45d7c55a0b0841dda

SHA512
0d4e54d2ffe96ccf548097f7812e3608537b4dae9687816983fddfb73223c196159cc6a39fcdc000784c79b2ced878efbc7a5b5f6e057973bf25b128124510df

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396762\images\BG1.png

Filesize
6KB

MD5
d2a826cfb8e441ebdead29bb0e1d1ed7

SHA1
b75f295cdf11977e5b2d74fcfddede5a82f59c06

SHA256
aa9c26e67a11beb0fbcbd569779f421079224ac8a3ff29251c0f8eae3e562a8d

SHA512
c8144812b9a9ce124bc1dae7ece948c042369b827695ef7f0916490568d32d37b19a91f6ec3b82fdbb9106539f6eda31dc9fdc657e9dc025b8f8aaac31604b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396762\images\BG2.png

Filesize
5KB

MD5
3ddb3f3052989498efba386b8a0c21d6

SHA1
9d66abc2ff7abb3282f3303a85de97d13811eb62

SHA256
2c845e3e3c1f48c0867bd39e39f5f81b114fe0d6f51302adb0f1231a372cbcda

SHA512
ee5eca9e2ce4baa967559326e313c84ff333858e6644f0b7ac805f4c221150cb52199cbd7feb36c9db3bc64a0773be7593027b55869fde9abb7349d3f24ec2bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396762\images\Close.png

Filesize
322B

MD5
5b97212a9d8ad0865531c4941e20bde6

SHA1
61a0c546e8c2ac403ac2dc20587173c8e1418ffe

SHA256
d78b9e6c8cb83728615c7664d95dd2c3f11afd7bb4c382b0388ace743e2305af

SHA512
5ef7b48c1a543b370b9957a20821f802f5578bda83a4aa4ab6a8cb47d465da31fee9b2de709a439245d8526b337c35c0738f2f7ce6122da9e9600d25a3f84ab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396762\images\Color_Button.png

Filesize
592B

MD5
499b602442514ccf3794f01c83909eca

SHA1
e1ee94a95c6690be69cc6215b8defcdc30a19d5c

SHA256
371e00281023b79884d559b67cc2db529da70c295dde53b812aaddb6181d73fd

SHA512
3946c5262cdc535fb9a928282216c59cf1a1fe349bded69086864cde2de2465b6a7d6425f9fb988c150d2bcc9491471f4930aea9397297e2e07d42e786241e08

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396762\images\Gray_Button.png

Filesize
291B

MD5
257b6acbb516ebf9b81d982e415ffad2

SHA1
132f7b288412911f0c7313e0e9c7da8294126791

SHA256
96c2f3a633fb04207b27caa7e391372d968728e6ae9eee71908dc7c9d8218048

SHA512
624650a5437bb30c076e2f370e123f22b5e80b4b4f97357504345338031afcbf09630b84373dfedc3a47b4322e33b92e72e683f69c9a7a47afed97bc3a9a7536

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396762\images\Prod_Circle.png

Filesize
1KB

MD5
239e096a673ac6c2adfd34f78aa6234d

SHA1
dc2c5fe032a777171cdd08cd8de040503b59f642

SHA256
39ec7a68971d5536e4c4d45e91943548b4ede65a42fd7ff3d89a03ac998d5538

SHA512
5c21d549d434844798655e40e331a6b03ff7d5d0f1f8c698395fd334f58ae791fafb361eb96566e0184e52a2fb59da7d6ab3b62a59e8e6b5b4d4d8869291618a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396762\images\ProgressBar.png

Filesize
469B

MD5
48b1d53e7b743bc1dc9ed2ab24d3e8d3

SHA1
798a0b8be166adadd45f70b38bb44d2bf9baf450

SHA256
c58d4eb376e7a08421deb20d039465db89bc26814425ed68df97df873d86cff5

SHA512
380acd30ef72f786d51e63885d295b02870ac7b0bb54712f3be488e5a38107902ba0137ba02584f1d974276325638dc9342d7edfd5cbbce80c1b8133745941b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396762\images\ProgressBar_Element.png

Filesize
246B

MD5
001862156596834b18af80203241ab75

SHA1
43786b8f6a46f0b94853f5cc1d5e20202c1ac311

SHA256
e8458a7e0d987fb72034de02df8562cc0c566622eeeaf9d73899fbe7cf46d793

SHA512
5dcdf43fd3aef06bf6c959cfdbe5ff704ed7330697cf36f2b07e0538b84d4ce8d44defbdf8d7f9b0b148229e39c2a61b0290a9e8d4016072ad32ea83fba1fdfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396762\images\loader.gif

Filesize
21KB

MD5
360281e85620142c3329848262da263d

SHA1
032ae1e422af859d78d172e918573fb0f55318de

SHA256
6c7d0d5402ebcf34cb6280473b4dac5966aae2a4bdadf80c796245663e2d9b55

SHA512
48ea37754839abce73898d29c6cb1ede20ac980dcd0b8c0f1274a690ea0bb44659129aba7581bd473ab7a735b7b9d08d6d041973bced4fe3fc0b70b3a73ec2a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259396762\locale\EN.locale

Filesize
1KB

MD5
77765c009c5ab6d2f13961315751f645

SHA1
1c118a0e3557bd545fccce81a38ff29b51675dad

SHA256
ea60de0c44dbb70d9d9e6c6b1d499899f05f2132511f0a65be801de3f1294d89

SHA512
d5661b1d4f8ce8e30b396ee1077715e7d66483d6297ac813a5ac3f761dd87117166c64245edcad6e59aeb8d685ce2bd60a9216c19596c24646fc4aca23992e7a

Download Submit
\Users\Admin\AppData\Local\Temp\ICReinstall_15f3320c0e3cc1d7f68fb2afa56dd310_JaffaCakes118.exe

Filesize
521KB

MD5
15f3320c0e3cc1d7f68fb2afa56dd310

SHA1
639ff6b716aa48738b35b3aa82ec9f4169bcc391

SHA256
fa63acdd906b53152744be86ad451edb4ce0c0ba213539591d6ddc640131a6ba

SHA512
26d7f7b67582de4fad4ece59bc04ddc094faabd023329909a7901e32988aa37acdb1cdaf6a7307a9471226aaa1d23734fe4d9874f33e501e7ca727927e6ab10d

Download Submit
memory/1868-150-0x0000000005C70000-0x0000000005C80000-memory.dmp

Filesize
64KB

Download
memory/1868-0-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/1868-3-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/1868-2-0x0000000000401000-0x00000000004C6000-memory.dmp

Filesize
788KB

Download
memory/1868-1-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/1868-315-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/1868-317-0x0000000000401000-0x00000000004C6000-memory.dmp

Filesize
788KB

Download
memory/1868-318-0x0000000005C70000-0x0000000005C80000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads