Overview
overview
10Static
static
327330ccbfa...18.exe
windows7-x64
1027330ccbfa...18.exe
windows10-2004-x64
10$PLUGINSDI...st.dll
windows7-x64
1$PLUGINSDI...st.dll
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$PLUGINSDI...ry.dll
windows7-x64
3$PLUGINSDI...ry.dll
windows10-2004-x64
3$_1_/emperor.exe
windows7-x64
10$_1_/emperor.exe
windows10-2004-x64
10$_1_/libeay32.dll
windows7-x64
1$_1_/libeay32.dll
windows10-2004-x64
1$_1_/ssleay32.dll
windows7-x64
1$_1_/ssleay32.dll
windows10-2004-x64
1Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
05-07-2024 23:21
Static task
static1
Behavioral task
behavioral1
Sample
27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral2
Sample
27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISList.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISList.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/registry.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/registry.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$_1_/emperor.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral14
Sample
$_1_/emperor.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
$_1_/libeay32.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral16
Sample
$_1_/libeay32.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
$_1_/ssleay32.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral18
Sample
$_1_/ssleay32.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
General
-
Target
27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe
-
Size
4.1MB
-
MD5
27330ccbfadf5f57b8a6f5bcdbbb1e20
-
SHA1
1117014392eb828a23d5f10506718852fc223639
-
SHA256
8f4d63fea00eca6d91147de6a10b7aae6069f164ef00d5986eff571249552dae
-
SHA512
adfbb5240ca376dc93e9bf5bca21d95b81145248ca083d8c693873079a535ec56a56567e65f68037195f0f6fb3d1e3dcad60f82aa4f9fc2c5bc10ed4e2198c59
-
SSDEEP
98304:6IaFJCkLoC4oarYbdu9x6MXDWVJziOSPedWbBziWr:6IaFJBM+bIv6cipkZl1
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Control Panel\International\Geo\Nation emperor.exe Key value queried \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Control Panel\International\Geo\Nation emperor.exe -
Executes dropped EXE 3 IoCs
pid Process 2712 emperor.exe 3828 emperor.exe 3852 emperor.exe -
Loads dropped DLL 64 IoCs
pid Process 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Melancholically\emperor.exe 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe File created C:\Program Files\Melancholically\ssleay32.dll 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe File created C:\Program Files\Melancholically\libeay32.dll 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3740 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2712 emperor.exe Token: SeTakeOwnershipPrivilege 3828 emperor.exe Token: SeTcbPrivilege 3828 emperor.exe Token: SeTcbPrivilege 3828 emperor.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2712 emperor.exe 2712 emperor.exe 2712 emperor.exe 2712 emperor.exe 3828 emperor.exe 3828 emperor.exe 3828 emperor.exe 3828 emperor.exe 3852 emperor.exe 3852 emperor.exe 3852 emperor.exe 3852 emperor.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2712 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 31 PID 2372 wrote to memory of 2712 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 31 PID 2372 wrote to memory of 2712 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 31 PID 2372 wrote to memory of 2712 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 31 PID 2372 wrote to memory of 3716 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 33 PID 2372 wrote to memory of 3716 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 33 PID 2372 wrote to memory of 3716 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 33 PID 2372 wrote to memory of 3716 2372 27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe 33 PID 3716 wrote to memory of 3740 3716 cmd.exe 35 PID 3716 wrote to memory of 3740 3716 cmd.exe 35 PID 3716 wrote to memory of 3740 3716 cmd.exe 35 PID 3716 wrote to memory of 3740 3716 cmd.exe 35 PID 3716 wrote to memory of 3752 3716 cmd.exe 36 PID 3716 wrote to memory of 3752 3716 cmd.exe 36 PID 3716 wrote to memory of 3752 3716 cmd.exe 36 PID 3716 wrote to memory of 3752 3716 cmd.exe 36 PID 3716 wrote to memory of 3764 3716 cmd.exe 37 PID 3716 wrote to memory of 3764 3716 cmd.exe 37 PID 3716 wrote to memory of 3764 3716 cmd.exe 37 PID 3716 wrote to memory of 3764 3716 cmd.exe 37 PID 3776 wrote to memory of 3852 3776 taskeng.exe 39 PID 3776 wrote to memory of 3852 3776 taskeng.exe 39 PID 3776 wrote to memory of 3852 3776 taskeng.exe 39 PID 3776 wrote to memory of 3852 3776 taskeng.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\27330ccbfadf5f57b8a6f5bcdbbb1e20_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Program Files\Melancholically\emperor.exe"C:\Program Files\Melancholically\emperor.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2712 -
C:\Program Files\Melancholically\emperor.exe"C:\Program Files\Melancholically\emperor.exe" -second3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3828
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c SchTasks /create /f /XML %temp%\Log379.xml /TN \microsoft\windows\defrag\scheduleddefrag && schtasks /Change /TN \microsoft\windows\defrag\scheduleddefrag /ENABLE && schtasks /run /TN \microsoft\windows\defrag\scheduleddefrag2⤵
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SysWOW64\schtasks.exeSchTasks /create /f /XML C:\Users\Admin\AppData\Local\Temp\Log379.xml /TN \microsoft\windows\defrag\scheduleddefrag3⤵
- Scheduled Task/Job: Scheduled Task
PID:3740
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN \microsoft\windows\defrag\scheduleddefrag /ENABLE3⤵PID:3752
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /TN \microsoft\windows\defrag\scheduleddefrag3⤵PID:3764
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {3C560D68-0063-4BA3-A159-3B4FCE7842E3} S-1-5-21-3502430532-24693940-2469786940-1000:PSBQWFYT\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Program Files\Melancholically\emperor.exe"C:\Program Files\Melancholically\emperor.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3852
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5f27689c513e7d12c7c974d5f8ef710d6
SHA1e305f2a2898d765a64c82c449dfb528665b4a892
SHA2561f18f4126124b0551f3dbcd0fec7f34026f930ca509f04435657cedc32ae8c47
SHA512734e9f3989ee47a86bee16838df7a09353c7fe085a09d77e70d281b21c5477b0b061616e72e8ac8fcb3dda1df0d5152f54dcc4c5a77f90fbf0f857557bf02fbc
-
Filesize
4KB
MD5f0438a894f3a7e01a4aae8d1b5dd0289
SHA1b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA25630c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
-
Filesize
11.2MB
MD54912f4062c8f32f2bc19a9866b11b4b6
SHA17162ef0c1286f358a755d481cc08ffe720ae0b5e
SHA25638c164ea976d3e5da89243559a1b28aed2afc6e4a29a60e8bd6e4c1cfbbf3511
SHA51298301542f398f99fd6ab6539d42cb41aca0b5c3f00357ce7dcdfce67a2a1dbf664886bdf97503201391e23ac127e1541654f4bb4ed6b833edfdc42a3038887ed
-
Filesize
105KB
MD54b0617493f32b2b5fe5e838eeb885819
SHA1336e84380420a9caaa9c12af7c8e530135e63c57
SHA256df3621f83e9d11be45e0e617b899c4ab0241f60ed56494e892dc449482058402
SHA5125c50cf97cd9a6c699ec7928a08f77f4eaa68105e87a974432e39b637f926f0df8a95ec19bd63465fc438a4ef6349398938bc8d7651de125d13ccab89d1d49143
-
Filesize
12KB
MD58cf2ac271d7679b1d68eefc1ae0c5618
SHA17cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA2566950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
SHA512ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
-
Filesize
24KB
MD52b7007ed0262ca02ef69d8990815cbeb
SHA12eabe4f755213666dbbbde024a5235ddde02b47f
SHA2560b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
SHA512aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca