06cb7880195c0bc56cc6591510909a2cb58614346ccbf00f14faa64a3ba1bf17

Analysis

max time kernel
148s
max time network
141s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 02:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe
Size

268KB
MD5

375afb23dd50b2b4775b85e5b451aad6
SHA1

78b2e3ca1d87fb64db55dcf8992bfeebaccfbfa5
SHA256

06cb7880195c0bc56cc6591510909a2cb58614346ccbf00f14faa64a3ba1bf17
SHA512

f68fa6b55486677b8d415c3fe767327a1c837808b27ef609b3b3d2d734c117727776598d6dacef304d8e6e52f2d3d059f1aec9bd1e05216cbfb0cfdcfa5eaf14
SSDEEP

6144:VwaMaNHn2vMw1OVCD03U2u9YyVsQywXJj8A3s/QKS/21hJfu:SaXNHnsMwukfOVQRp8/QKI2Zm

Score

10^/10

evasion upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 8 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\black.exe = "C:\\Users\\Admin\\AppData\\Roaming\\black.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe:*:Enabled:Windows Messanger"	reg.exe

Executes dropped EXE 1 IoCs

pid	Process
2380	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
2392	375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe
2392	375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2380-35-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2380-32-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2380-36-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2380-28-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2380-38-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2380-37-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2380-27-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2380-50-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2380-51-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2380-53-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2380-57-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2380-58-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2380-59-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2380-60-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2380-61-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2380-62-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2380-63-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2380-64-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2380-65-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2380-66-0x0000000000400000-0x000000000045C000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2392 set thread context of 2380	2392	375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe	33

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
2644	reg.exe
2628	reg.exe
2608	reg.exe
2664	reg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: 1	2380	svchost.exe
Token: SeCreateTokenPrivilege	2380	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2380	svchost.exe
Token: SeLockMemoryPrivilege	2380	svchost.exe
Token: SeIncreaseQuotaPrivilege	2380	svchost.exe
Token: SeMachineAccountPrivilege	2380	svchost.exe
Token: SeTcbPrivilege	2380	svchost.exe
Token: SeSecurityPrivilege	2380	svchost.exe
Token: SeTakeOwnershipPrivilege	2380	svchost.exe
Token: SeLoadDriverPrivilege	2380	svchost.exe
Token: SeSystemProfilePrivilege	2380	svchost.exe
Token: SeSystemtimePrivilege	2380	svchost.exe
Token: SeProfSingleProcessPrivilege	2380	svchost.exe
Token: SeIncBasePriorityPrivilege	2380	svchost.exe
Token: SeCreatePagefilePrivilege	2380	svchost.exe
Token: SeCreatePermanentPrivilege	2380	svchost.exe
Token: SeBackupPrivilege	2380	svchost.exe
Token: SeRestorePrivilege	2380	svchost.exe
Token: SeShutdownPrivilege	2380	svchost.exe
Token: SeDebugPrivilege	2380	svchost.exe
Token: SeAuditPrivilege	2380	svchost.exe
Token: SeSystemEnvironmentPrivilege	2380	svchost.exe
Token: SeChangeNotifyPrivilege	2380	svchost.exe
Token: SeRemoteShutdownPrivilege	2380	svchost.exe
Token: SeUndockPrivilege	2380	svchost.exe
Token: SeSyncAgentPrivilege	2380	svchost.exe
Token: SeEnableDelegationPrivilege	2380	svchost.exe
Token: SeManageVolumePrivilege	2380	svchost.exe
Token: SeImpersonatePrivilege	2380	svchost.exe
Token: SeCreateGlobalPrivilege	2380	svchost.exe
Token: 31	2380	svchost.exe
Token: 32	2380	svchost.exe
Token: 33	2380	svchost.exe
Token: 34	2380	svchost.exe
Token: 35	2380	svchost.exe
Token: SeDebugPrivilege	2380	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2380	svchost.exe
2380	svchost.exe
2380	svchost.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2556	2392	375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe	30
PID 2392 wrote to memory of 2556	2392	375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe	30
PID 2392 wrote to memory of 2556	2392	375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe	30
PID 2392 wrote to memory of 2556	2392	375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe	30
PID 2556 wrote to memory of 2236	2556	csc.exe	32
PID 2556 wrote to memory of 2236	2556	csc.exe	32
PID 2556 wrote to memory of 2236	2556	csc.exe	32
PID 2556 wrote to memory of 2236	2556	csc.exe	32
PID 2392 wrote to memory of 2380	2392	375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe	33
PID 2392 wrote to memory of 2380	2392	375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe	33
PID 2392 wrote to memory of 2380	2392	375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe	33
PID 2392 wrote to memory of 2380	2392	375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe	33
PID 2392 wrote to memory of 2380	2392	375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe	33
PID 2392 wrote to memory of 2380	2392	375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe	33
PID 2392 wrote to memory of 2380	2392	375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe	33
PID 2392 wrote to memory of 2380	2392	375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe	33
PID 2380 wrote to memory of 2768	2380	svchost.exe	34
PID 2380 wrote to memory of 2768	2380	svchost.exe	34
PID 2380 wrote to memory of 2768	2380	svchost.exe	34
PID 2380 wrote to memory of 2768	2380	svchost.exe	34
PID 2380 wrote to memory of 2740	2380	svchost.exe	35
PID 2380 wrote to memory of 2740	2380	svchost.exe	35
PID 2380 wrote to memory of 2740	2380	svchost.exe	35
PID 2380 wrote to memory of 2740	2380	svchost.exe	35
PID 2380 wrote to memory of 2980	2380	svchost.exe	36
PID 2380 wrote to memory of 2980	2380	svchost.exe	36
PID 2380 wrote to memory of 2980	2380	svchost.exe	36
PID 2380 wrote to memory of 2980	2380	svchost.exe	36
PID 2380 wrote to memory of 2748	2380	svchost.exe	37
PID 2380 wrote to memory of 2748	2380	svchost.exe	37
PID 2380 wrote to memory of 2748	2380	svchost.exe	37
PID 2380 wrote to memory of 2748	2380	svchost.exe	37
PID 2748 wrote to memory of 2608	2748	cmd.exe	42
PID 2748 wrote to memory of 2608	2748	cmd.exe	42
PID 2748 wrote to memory of 2608	2748	cmd.exe	42
PID 2748 wrote to memory of 2608	2748	cmd.exe	42
PID 2740 wrote to memory of 2628	2740	cmd.exe	43
PID 2740 wrote to memory of 2628	2740	cmd.exe	43
PID 2740 wrote to memory of 2628	2740	cmd.exe	43
PID 2740 wrote to memory of 2628	2740	cmd.exe	43
PID 2980 wrote to memory of 2644	2980	cmd.exe	44
PID 2980 wrote to memory of 2644	2980	cmd.exe	44
PID 2980 wrote to memory of 2644	2980	cmd.exe	44
PID 2980 wrote to memory of 2644	2980	cmd.exe	44
PID 2768 wrote to memory of 2664	2768	cmd.exe	45
PID 2768 wrote to memory of 2664	2768	cmd.exe	45
PID 2768 wrote to memory of 2664	2768	cmd.exe	45
PID 2768 wrote to memory of 2664	2768	cmd.exe	45

C:\Users\Admin\AppData\Local\Temp\375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\375afb23dd50b2b4775b85e5b451aad6_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xhyaf5va.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD653.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD652.tmp"
    3⤵
    PID:2236
- C:\Users\Admin\AppData\Roaming\svchost.exe
  C:\Users\Admin\AppData\Roaming\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:2664
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:2628
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2980
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:2644
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\black.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\black.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\black.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\black.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESD653.tmp

Filesize
1KB

MD5
7f084f886adac32856c8748df543a731

SHA1
3a6d279f4bc9fcf02e1d60bb18bb476981d929cc

SHA256
0324b953bb3f0b4465ea71cbfaddefbe139f67b2b27378eeddc8cede88ae9ecc

SHA512
55998bb4aaaa16f400e885ee2a25a376f4dbed65c0c7fa6320b3014ff677012d6791500d414d015ecc5e44e749389d2b43907b1bd290bf4f5c181d3f4761fedf

Download Submit
C:\Users\Admin\AppData\Local\Temp\xhyaf5va.dll

Filesize
5KB

MD5
3f493d58e2b9ade552f5b9c11874b835

SHA1
bbd2d99f258c85785013119da29c600d13004926

SHA256
f4b4159aa5e4320ea23ea9185e93ae81da365d103be7380c3cadcd9573672ada

SHA512
1b9727908c17670c8e15673103e4baf2bb97ade27e9e4d78369553398731b540ba614344be85b00d03ffe578d1612cf7c1f85fed800f7ec2b8a922b02161abe7

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
12KB

MD5
bb5b2961567e68995464801d3bb2a964

SHA1
5d82ae2b8d24208418bfb09cbb3074c056e790dc

SHA256
a2d3d892c68a84208a9887cb34ecae820e59c4aa25c22db5c23379df344df004

SHA512
050550640a7bf2b65b3cd537f252b64465ec451555ff1831a9d799922e8c3382e83a52bc46015c5ed1ac79ebb233616f72aa8ed72f01e8be578ca383a304ff7a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCD652.tmp

Filesize
652B

MD5
c9223a5bbb8f48ed7501e269c8f6611c

SHA1
60fda5954a3e41aeb466ef98edba2b9debe5dc77

SHA256
2b3eae3fd87dd5e630db2029fdb7338d25b171f7a6f131e7c589ada337d66af3

SHA512
84e265fa73bd70d884a6ac7f2ae199edba9cfed0372d270fd73502056365388cf07ed02faeb8b8981be8a94253df895c33386876185f8d968248d7de97414dbf

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\xhyaf5va.0.cs

Filesize
4KB

MD5
2216d197bc442e875016eba15c07a937

SHA1
37528e21ea3271b85d276c6bd003e6c60c81545d

SHA256
2e9e3da7bfa1334706550bb4d6269bf3e64cbbc09fa349af52eb22f32aebb4af

SHA512
7d7bdc3bf83ac0a29e917ead899dcaa1b47ee2660f405fe4883ca2a2546f7924265e1d75a2ea02c0e34fac4d2bb82bbaaa88d06c240afad4e9fd49337cd04d3f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\xhyaf5va.cmdline

Filesize
206B

MD5
2a92582e22d2c43aa066c8ca25fd49f6

SHA1
f5dc81e37504d1543889c9368f6d270a6552cffc

SHA256
60136e8cf011b4e79040d79dbfcb03e6846dddfda9ae91b3394c849946cfa320

SHA512
432626650cf2f542eb8a3abb175776e38832b125fbcff17206a650047daef1ad7703dd6ec6bd1265472ce1cc36bfd38da926a8694eb4d283541d6d5c7c57d3e9

Download Submit
memory/2380-55-0x0000000077220000-0x0000000077330000-memory.dmp

Filesize
1.1MB

Download
memory/2380-47-0x0000000077220000-0x0000000077330000-memory.dmp

Filesize
1.1MB

Download
memory/2380-66-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2380-65-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2380-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2380-64-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2380-35-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2380-32-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2380-36-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2380-28-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2380-38-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2380-37-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2380-27-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2380-25-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2380-63-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2380-44-0x0000000077238000-0x0000000077239000-memory.dmp

Filesize
4KB

Download
memory/2380-45-0x0000000077220000-0x0000000077330000-memory.dmp

Filesize
1.1MB

Download
memory/2380-62-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2380-46-0x0000000077220000-0x0000000077330000-memory.dmp

Filesize
1.1MB

Download
memory/2380-50-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2380-51-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2380-52-0x0000000077220000-0x0000000077330000-memory.dmp

Filesize
1.1MB

Download
memory/2380-53-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2380-54-0x0000000077220000-0x0000000077330000-memory.dmp

Filesize
1.1MB

Download
memory/2380-61-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2380-57-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2380-58-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2380-59-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2380-60-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2392-0-0x00000000745F1000-0x00000000745F2000-memory.dmp

Filesize
4KB

Download
memory/2392-42-0x00000000745F0000-0x0000000074B9B000-memory.dmp

Filesize
5.7MB

Download
memory/2392-1-0x00000000745F0000-0x0000000074B9B000-memory.dmp

Filesize
5.7MB

Download
memory/2392-2-0x00000000745F0000-0x0000000074B9B000-memory.dmp

Filesize
5.7MB

Download
memory/2556-11-0x00000000745F0000-0x0000000074B9B000-memory.dmp

Filesize
5.7MB

Download
memory/2556-16-0x00000000745F0000-0x0000000074B9B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads