42b0825156a224597ef9cab4fb09dcbf194cee29379118b5016eed6f9a8f4162

Analysis

max time kernel
148s
max time network
156s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 21:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1c8554957dbc1a306abb3761d4919673_JaffaCakes118.exe
Size

45KB
MD5

1c8554957dbc1a306abb3761d4919673
SHA1

c4ec35261f35a44d4a0ffc3e31c8b492710d86a0
SHA256

42b0825156a224597ef9cab4fb09dcbf194cee29379118b5016eed6f9a8f4162
SHA512

94f73ddb06b6f0d4b29088138973c6f345d42f74175bc9f4a3ee05bdbe86009a33faae67a1fb970d5163ef634ff38e9a71fd5511e651f49116c36f28404d4077
SSDEEP

768:5RVZwlepBH12mX3uN3aO74s9dcKDI0GZTg70Wq1qtewJJgzY4Dy2:5RAepBAmnuhN74k6GIhfWa8izY47

Score

8^/10

evasion persistence

Malware Config

Signatures

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1980	attrib.exe
1908	attrib.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hsdfasd = "\"C:\\Users\\Admin\\AppData\\Roaming\\lua\\tmp.\\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}\" hh.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	cmd.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe
File opened for modification	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.app.log	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0FF156F1-37F3-11EF-8C89-6200E4292AD7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.82133.com/?S"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.82133.com/?S"	reg.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\IsShortCut	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command\ = "wscript -e:vbs \"C:\\Users\\Admin\\AppData\\Roaming\\lua\\3.bat\""	reg.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeRestorePrivilege	2296	rundll32.exe
Token: SeRestorePrivilege	2296	rundll32.exe
Token: SeRestorePrivilege	2296	rundll32.exe
Token: SeRestorePrivilege	2296	rundll32.exe
Token: SeRestorePrivilege	2296	rundll32.exe
Token: SeRestorePrivilege	2296	rundll32.exe
Token: SeRestorePrivilege	2296	rundll32.exe
Token: SeRestorePrivilege	1956	rundll32.exe
Token: SeRestorePrivilege	1956	rundll32.exe
Token: SeRestorePrivilege	1956	rundll32.exe
Token: SeRestorePrivilege	1956	rundll32.exe
Token: SeRestorePrivilege	1956	rundll32.exe
Token: SeRestorePrivilege	1956	rundll32.exe
Token: SeRestorePrivilege	1956	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2120	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2120	iexplore.exe
2120	iexplore.exe
892	IEXPLORE.EXE
892	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 856	2232	1c8554957dbc1a306abb3761d4919673_JaffaCakes118.exe	31
PID 2232 wrote to memory of 856	2232	1c8554957dbc1a306abb3761d4919673_JaffaCakes118.exe	31
PID 2232 wrote to memory of 856	2232	1c8554957dbc1a306abb3761d4919673_JaffaCakes118.exe	31
PID 2232 wrote to memory of 856	2232	1c8554957dbc1a306abb3761d4919673_JaffaCakes118.exe	31
PID 856 wrote to memory of 1704	856	cmd.exe	33
PID 856 wrote to memory of 1704	856	cmd.exe	33
PID 856 wrote to memory of 1704	856	cmd.exe	33
PID 856 wrote to memory of 1704	856	cmd.exe	33
PID 1704 wrote to memory of 2120	1704	cmd.exe	35
PID 1704 wrote to memory of 2120	1704	cmd.exe	35
PID 1704 wrote to memory of 2120	1704	cmd.exe	35
PID 1704 wrote to memory of 2120	1704	cmd.exe	35
PID 1704 wrote to memory of 2296	1704	cmd.exe	36
PID 1704 wrote to memory of 2296	1704	cmd.exe	36
PID 1704 wrote to memory of 2296	1704	cmd.exe	36
PID 1704 wrote to memory of 2296	1704	cmd.exe	36
PID 1704 wrote to memory of 2296	1704	cmd.exe	36
PID 1704 wrote to memory of 2296	1704	cmd.exe	36
PID 1704 wrote to memory of 2296	1704	cmd.exe	36
PID 1704 wrote to memory of 524	1704	cmd.exe	37
PID 1704 wrote to memory of 524	1704	cmd.exe	37
PID 1704 wrote to memory of 524	1704	cmd.exe	37
PID 1704 wrote to memory of 524	1704	cmd.exe	37
PID 2120 wrote to memory of 892	2120	iexplore.exe	39
PID 2120 wrote to memory of 892	2120	iexplore.exe	39
PID 2120 wrote to memory of 892	2120	iexplore.exe	39
PID 2120 wrote to memory of 892	2120	iexplore.exe	39
PID 524 wrote to memory of 2068	524	cmd.exe	40
PID 524 wrote to memory of 2068	524	cmd.exe	40
PID 524 wrote to memory of 2068	524	cmd.exe	40
PID 524 wrote to memory of 2068	524	cmd.exe	40
PID 524 wrote to memory of 2300	524	cmd.exe	41
PID 524 wrote to memory of 2300	524	cmd.exe	41
PID 524 wrote to memory of 2300	524	cmd.exe	41
PID 524 wrote to memory of 2300	524	cmd.exe	41
PID 524 wrote to memory of 2304	524	cmd.exe	42
PID 524 wrote to memory of 2304	524	cmd.exe	42
PID 524 wrote to memory of 2304	524	cmd.exe	42
PID 524 wrote to memory of 2304	524	cmd.exe	42
PID 524 wrote to memory of 1372	524	cmd.exe	43
PID 524 wrote to memory of 1372	524	cmd.exe	43
PID 524 wrote to memory of 1372	524	cmd.exe	43
PID 524 wrote to memory of 1372	524	cmd.exe	43
PID 524 wrote to memory of 760	524	cmd.exe	44
PID 524 wrote to memory of 760	524	cmd.exe	44
PID 524 wrote to memory of 760	524	cmd.exe	44
PID 524 wrote to memory of 760	524	cmd.exe	44
PID 524 wrote to memory of 1908	524	cmd.exe	45
PID 524 wrote to memory of 1908	524	cmd.exe	45
PID 524 wrote to memory of 1908	524	cmd.exe	45
PID 524 wrote to memory of 1908	524	cmd.exe	45
PID 524 wrote to memory of 1980	524	cmd.exe	46
PID 524 wrote to memory of 1980	524	cmd.exe	46
PID 524 wrote to memory of 1980	524	cmd.exe	46
PID 524 wrote to memory of 1980	524	cmd.exe	46
PID 524 wrote to memory of 1956	524	cmd.exe	47
PID 524 wrote to memory of 1956	524	cmd.exe	47
PID 524 wrote to memory of 1956	524	cmd.exe	47
PID 524 wrote to memory of 1956	524	cmd.exe	47
PID 524 wrote to memory of 1956	524	cmd.exe	47
PID 524 wrote to memory of 1956	524	cmd.exe	47
PID 524 wrote to memory of 1956	524	cmd.exe	47
PID 524 wrote to memory of 896	524	cmd.exe	48
PID 524 wrote to memory of 896	524	cmd.exe	48

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1908	attrib.exe
1980	attrib.exe

C:\Users\Admin\AppData\Local\Temp\1c8554957dbc1a306abb3761d4919673_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1c8554957dbc1a306abb3761d4919673_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp_ext.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\lua\1.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1704
  - - C:\PROGRA~1\INTERN~1\iexplore.exe
      C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://www.cnkankan.com/?82133
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2120
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:892
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\lua\1.inf
      4⤵
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      PID:2296
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\lua\2.bat
      4⤵
      Enumerates connected drives
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:524
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?S"" /f
        5⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:2068
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?S"" /f
        5⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:2300
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\tmp" /v "key" /d ""http://www.82133.com/?S"" /f
        5⤵
        
        PID:2304
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f
        5⤵
        Modifies registry class
        
        PID:1372
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\lua\3.bat""" /f
        5⤵
        Modifies registry class
        
        PID:760
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\lua\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1908
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\lua\tmp
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1980
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\lua\2.inf
        5⤵
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1956
      - C:\Windows\SysWOW64\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        6⤵
        Checks processor information in registry
        
        PID:1784
        
        C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        7⤵
        
        PID:1912
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 D:\VolumeDH\inj.dat,MainLoad
        5⤵
        
        PID:896
- C:\Users\Admin\AppData\Local\Temp\inl6C6B.tmp
  C:\Users\Admin\AppData\Local\Temp\inl6C6B.tmp
  2⤵
  PID:2016
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1C8554~1.EXE > nul
  2⤵
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

Filesize
906B

MD5
f2572338cb20db1d928b2c61282e6e87

SHA1
8b2b79ef1c914b0b00ec10a06caa8638b2163d45

SHA256
e9bc7df9f665d307b049d0d8bf74ed3c2ac1564094d3c4eff2568742bb5ebbbd

SHA512
240c9e2b2de396ef9dbe6b823723c61ba12c50e9a3b11f5f8f826aa55984d6c18a83361bf5b8f5d2602dbf8152e9feb35ceadce11d098aed246c52dc02771763

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp_ext.bat

Filesize
50B

MD5
e08ad52d3d132292f9c51e7cfec5fe08

SHA1
269f7eb185a9ff02664297bfb6f5df9f86ec10f0

SHA256
bd2a3003fb1f771283b30a044c49aecb72bfdff4322330337dba4992ecd198f4

SHA512
3dc0331f3ee9a57de7bda71a94953239bc7033a130f2b783b35d17ce3ed7b7928c154323d10ba81bd81d3bfd2d7c123cec55f5178d2b44286c2f857ccd6a1722

Download Submit
C:\Users\Admin\AppData\Roaming\lua\1.bat

Filesize
2KB

MD5
68a30985a8b4a1dae5b24721ca5b8269

SHA1
78481107bbddcf18ffc4d25a184ec74274241a6b

SHA256
fe94352a25ade782ea77db82f1ec849479ebfe4605156142fc3fdfabc507a0cf

SHA512
d452182a296a9e202bce81ad0c752b34d4d779cac94bb54a07517936b79a4007127585673c524c75055f15e33c56eef0d26d1c448723a97fe70c15457bae5a24

Download Submit
C:\Users\Admin\AppData\Roaming\lua\1.inf

Filesize
362B

MD5
20b164889086c50e2be7e83799886b88

SHA1
e813f0d19584247fb44151ea97a212197c9b7828

SHA256
76b4794f3b5e9efa322ee0683977f1646501b441f286b89239fddf2c0c2d2fc3

SHA512
9ec551ba8254597ab09c733715a26b39c475503a40f020636e8ad727e5ef6cd3bf880d937a8970c36fdd9ed9c2dd3dccb127deef0991fad50eb5b83b38417d79

Download Submit
C:\Users\Admin\AppData\Roaming\lua\1.inf

Filesize
410B

MD5
66a1f0147fed7ddd19e9bb7ff93705c5

SHA1
9d803c81ea2195617379b880b227892ba30b0bf6

SHA256
4f45ce85e221352f7fe26e04968c7f7267dc24b55cf2b72b929b4c90e48cb764

SHA512
cfe51756ddec75d240249980a4d27870d15983add25058e4d0da4d8a3ea11384d4d228d6cbc95091f91e516e1ab4dfb1e315941dbd95bf717d4b31936311d597

Download Submit
C:\Users\Admin\AppData\Roaming\lua\2.bat

Filesize
3KB

MD5
c106ffc420b54a4f0fd331f10657dc66

SHA1
8930d5b56358f518bdf5ccca2b4d24f98ce7a03f

SHA256
fb8218f8c607ec3a4c4cb6e59ee81a94cf8ff513d0b09565ad456c88a9e7250b

SHA512
ee82fb57af0dddf8f1acab855cda151d3eacb8e11b0adc3a81852c1e2d77a566aa630ff5dabd8c7bc92ebe78b6187cc823c8a4a645ca78ee88e2c27483080fbd

Download Submit
C:\Users\Admin\AppData\Roaming\lua\2.inf

Filesize
244B

MD5
524023ba7f18bfc502d22dbaade4571e

SHA1
fc118e1284db4e36da41d5cc4496ffa9a8b7cd2e

SHA256
5d170c83ca9a16ed7f62145099b3b8b0c0a1d4187e60bb0719754cb6ed40fc4c

SHA512
22384a0854a9949209444d9e7af3016327ad698e56797af246e02604b880949f40c7f4627303c11d73581c681b93bcee285b3937d4088c61107b9ec73901bdbc

Download Submit
C:\Users\Admin\AppData\Roaming\lua\4.bat

Filesize
44KB

MD5
8639815b7bda81055eaba69766f4c83c

SHA1
fcd1aacf535d0e948a8ff8104126040d1efb5bb3

SHA256
cf1b5e5145057f947af3ab59060e7b184975c66a68d4076732774a572f8376c8

SHA512
02268150ae0042dc1b8fda8d2d31b8d94058ade4fff8244a60ba8580f464e1bb5cec4a77448ba730389f9680b27742a697174c5efe2c1ddccb342ab01a5b0954

Download Submit
memory/2120-62-0x0000000002310000-0x0000000002320000-memory.dmp

Filesize
64KB

Download
memory/2232-7-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/2232-35-0x00000000004F0000-0x00000000004FC000-memory.dmp

Filesize
48KB

Download
memory/2232-1-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/2232-5-0x0000000000E30000-0x0000000000E4F000-memory.dmp

Filesize
124KB

Download
memory/2232-0-0x0000000000E30000-0x0000000000E4F000-memory.dmp

Filesize
124KB

Download
memory/2232-118-0x0000000000E30000-0x0000000000E4F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads