cd03efa3070556922874d13dedb36918db8a78846a1a62ae14c2f98af39b4385

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 14:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1bb03f698b92494db9eb3e2b2b60be89_JaffaCakes118.exe
Size

28KB
MD5

1bb03f698b92494db9eb3e2b2b60be89
SHA1

486ff6b437034b3be6826e0ccfe06241146fee74
SHA256

cd03efa3070556922874d13dedb36918db8a78846a1a62ae14c2f98af39b4385
SHA512

ae5e619df1b72a3ad296ada67eb20502dba2d8ec9e686dd0fff583248002800a362dc4650ed2373580e633ed4401b583594613f23c7935f7621c9211c7502636
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNW4GAoW:Dv8IRRdsxq1DjJcqfLnAr

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
552	services.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3056-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/3056-4-0x0000000000220000-0x0000000000228000-memory.dmp	upx
behavioral1/files/0x003400000001471d-7.dat	upx
behavioral1/memory/552-11-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3056-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/552-18-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/552-23-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/552-29-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/552-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3056-35-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/552-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/552-41-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0008000000014baa-51.dat	upx
behavioral1/memory/3056-62-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/552-63-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3056-66-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/552-67-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3056-71-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/552-72-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/552-74-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3056-78-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/552-79-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/552-84-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3056-254-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/552-255-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3056-327-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/552-328-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	1bb03f698b92494db9eb3e2b2b60be89_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\java.exe	1bb03f698b92494db9eb3e2b2b60be89_JaffaCakes118.exe
File created	C:\Windows\java.exe	1bb03f698b92494db9eb3e2b2b60be89_JaffaCakes118.exe
File created	C:\Windows\services.exe	1bb03f698b92494db9eb3e2b2b60be89_JaffaCakes118.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	1bb03f698b92494db9eb3e2b2b60be89_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	1bb03f698b92494db9eb3e2b2b60be89_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	1bb03f698b92494db9eb3e2b2b60be89_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	1bb03f698b92494db9eb3e2b2b60be89_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 552	3056	1bb03f698b92494db9eb3e2b2b60be89_JaffaCakes118.exe	28
PID 3056 wrote to memory of 552	3056	1bb03f698b92494db9eb3e2b2b60be89_JaffaCakes118.exe	28
PID 3056 wrote to memory of 552	3056	1bb03f698b92494db9eb3e2b2b60be89_JaffaCakes118.exe	28
PID 3056 wrote to memory of 552	3056	1bb03f698b92494db9eb3e2b2b60be89_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\1bb03f698b92494db9eb3e2b2b60be89_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1bb03f698b92494db9eb3e2b2b60be89_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a17d4dc757c3430d734f20ab5d1dfd95

SHA1
1a8699d1c4fb48d55786719665b69caff10f132a

SHA256
ab47cf288ad194c8d28617066cadae91cd27927b8393c9caec90286e07d1b5a2

SHA512
a1c2c0c42cd0b9368d3ddd37efb40dafe16cb21a53f8cfade5e8f0aa750265a6cd4985f312cebe761faa87dcebc2b6615b35d73dcc8ee6cdaff999bdea3ed0c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46ec55c9b638cac88be564b0c23c64d6

SHA1
a99721b5193587126acd76515872e1dc3bd2018d

SHA256
014a136cd7d73f62507f4e7450342f464bd523fac53606d66cba195489d1fae6

SHA512
0722d4b581829462558780bb93503e019178170d9b4d0cc0695cd8f51bf0e1b89efe00b71954fc67eaed19e33e8dd6462bcb8a23cae967e18714f47e22d9c4c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OORQXHVT\4PWDO2IU.htm

Filesize
175KB

MD5
7e0d644da9467ca3a20e737749830567

SHA1
8cbbc309bb5d47d6c6367be4b049190cea4ae7ac

SHA256
0013477702484b438dd07a5b0366f63e983f4b2d85fb3d7e9a2d6a2887037884

SHA512
04fd1a31c7b94d4bd9bd3024ebebdfa526e61a58d35a7319c98b0e45af1b499f1b2f84db78e8948f7a6c24ccac253836e5ff31f875fabbe8c7502293202773d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1ABD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1AFD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B7F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1E4C.tmp

Filesize
28KB

MD5
5ac83153887d158bfb1cc75433655d5c

SHA1
222fc06406aa77c1f3dd34834247d5111a6f3a6a

SHA256
0e0316876cf2088461aa7e2cc2ab1a5e4bf037dd59314fe61b66835ea151619c

SHA512
7d9d40cf731ed3ac8b5e99828dde097ca52846ae2b300a1fa2aee11b8f78f4026a582d26014486bbb79ea19de8233029cbd683aed6377a6aa5123d381d9f6bcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp259F.tmp

Filesize
28KB

MD5
eeee430d3bdef4abaa2f936d0b99b521

SHA1
741772df2cbd848928012f97c34a2c505130cffc

SHA256
5799841fd7dcced38b29ee353cffbc14e01b584b625c091b1f76f21b62b276b0

SHA512
ad805bbfa2c36435808bfb6c7aa7312f55478e674373546b4a05b62c981ba18f3630a4098af6dc5f57d833159b66466a40c2ebc634ca01f025447fd7fb2b8ea7

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
9ea87f74e3f444f336142f59f429fb5e

SHA1
13edc461fad2199b6de703256bb830ac6cad313b

SHA256
4812f0b3f5313694ad1b2ffe4767c0a6a7844853c3e2c0c203bead2feaa57ab1

SHA512
9e079e6dfbfd3b11b0655f98497a8d7b41d290a670b0d9b44e963d233dfbb2cf48f8b6d6bedb970ef8d03208c33980cb6fb942889757c8ed461c9bace5c18649

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
d769aaf89513095a1863c90468a4c5e3

SHA1
4a68b269f7739183c8e3adfa6b7f3102e1d7b887

SHA256
6c2f81c662d7c2bbb9a45e277ef623808bce75768e17ecd3b9885689f2dda095

SHA512
e75d8e5c74ab80e56425b374a06b4a9785502f991fea6530bfd132ddc6c94ffbf8aaf2524010b00c48c805e3baa1d93d8120a3094935f057732e10d6662c8c83

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/552-63-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-41-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-328-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-255-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-29-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-67-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-18-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-72-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-23-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-79-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-84-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3056-66-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3056-24-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/3056-78-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3056-71-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3056-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3056-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3056-9-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/3056-254-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3056-62-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3056-4-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/3056-327-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3056-35-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads