22ec2cb81f79aedaf443f39c5464844d15e2f0bcf91e5593e626780292c9ef6e

Analysis

max time kernel
137s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 12:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3913662273f772a4ce03418e7181d9b8_JaffaCakes118.exe
Size

97KB
MD5

3913662273f772a4ce03418e7181d9b8
SHA1

1979ec4910157e5fead80c69921310656bff26e9
SHA256

22ec2cb81f79aedaf443f39c5464844d15e2f0bcf91e5593e626780292c9ef6e
SHA512

92651e0ec4af6db07ed34436a1332d3a6baf128cf2835ab93e254d5e9c16ba85d685e5179dd373cae6ddd9984d91034854c6bbcb686a9ce9525038482b7d7a6a
SSDEEP

3072:+BsloY2bHpGfZSd0BWjrryobXCwuwuwuwuwuwuwuwuwuwD:AsloY2bJGf4d0GvbXf

Score

10^/10

evasion

Malware Config

Signatures

Modifies security service 2 TTPs 20 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe

Executes dropped EXE 10 IoCs

pid	Process
2008	Tilecom32.com
1072	Tilecom32.com
680	Tilecom32.com
2732	Tilecom32.com
1492	Tilecom32.com
2520	Tilecom32.com
2752	Tilecom32.com
972	Tilecom32.com
2820	Tilecom32.com
2028	Tilecom32.com

Loads dropped DLL 20 IoCs

pid	Process
1512	3913662273f772a4ce03418e7181d9b8_JaffaCakes118.exe
1512	3913662273f772a4ce03418e7181d9b8_JaffaCakes118.exe
2008	Tilecom32.com
2008	Tilecom32.com
1072	Tilecom32.com
1072	Tilecom32.com
680	Tilecom32.com
680	Tilecom32.com
2732	Tilecom32.com
2732	Tilecom32.com
1492	Tilecom32.com
1492	Tilecom32.com
2520	Tilecom32.com
2520	Tilecom32.com
2752	Tilecom32.com
2752	Tilecom32.com
972	Tilecom32.com
972	Tilecom32.com
2820	Tilecom32.com
2820	Tilecom32.com

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Tilecom32.com	Tilecom32.com
File created	C:\Windows\SysWOW64\Tilecom32.com	Tilecom32.com
File opened for modification	C:\Windows\SysWOW64\Tilecom32.com	Tilecom32.com
File created	C:\Windows\SysWOW64\Tilecom32.com	Tilecom32.com
File opened for modification	C:\Windows\SysWOW64\Tilecom32.com	Tilecom32.com
File opened for modification	C:\Windows\SysWOW64\Tilecom32.com	Tilecom32.com
File created	C:\Windows\SysWOW64\Tilecom32.com	Tilecom32.com
File opened for modification	C:\Windows\SysWOW64\Tilecom32.com	Tilecom32.com
File opened for modification	C:\Windows\SysWOW64\Tilecom32.com	Tilecom32.com
File created	C:\Windows\SysWOW64\Tilecom32.com	Tilecom32.com
File created	C:\Windows\SysWOW64\Tilecom32.com	Tilecom32.com
File opened for modification	C:\Windows\SysWOW64\Tilecom32.com	Tilecom32.com
File created	C:\Windows\SysWOW64\Tilecom32.com	Tilecom32.com
File opened for modification	C:\Windows\SysWOW64\Tilecom32.com	Tilecom32.com
File opened for modification	C:\Windows\SysWOW64\Tilecom32.com	3913662273f772a4ce03418e7181d9b8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Tilecom32.com	Tilecom32.com
File opened for modification	C:\Windows\SysWOW64\Tilecom32.com	Tilecom32.com
File created	C:\Windows\SysWOW64\Tilecom32.com	Tilecom32.com
File created	C:\Windows\SysWOW64\Tilecom32.com	Tilecom32.com
File created	C:\Windows\SysWOW64\Tilecom32.com	Tilecom32.com
File opened for modification	C:\Windows\SysWOW64\Tilecom32.com	Tilecom32.com
File created	C:\Windows\SysWOW64\Tilecom32.com	3913662273f772a4ce03418e7181d9b8_JaffaCakes118.exe

Runs .reg file with regedit 10 IoCs

pid	Process
2120	regedit.exe
2412	regedit.exe
2212	regedit.exe
2388	regedit.exe
1936	regedit.exe
444	regedit.exe
1968	regedit.exe
1456	regedit.exe
3060	regedit.exe
800	regedit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 2940	1512	3913662273f772a4ce03418e7181d9b8_JaffaCakes118.exe	30
PID 1512 wrote to memory of 2940	1512	3913662273f772a4ce03418e7181d9b8_JaffaCakes118.exe	30
PID 1512 wrote to memory of 2940	1512	3913662273f772a4ce03418e7181d9b8_JaffaCakes118.exe	30
PID 1512 wrote to memory of 2940	1512	3913662273f772a4ce03418e7181d9b8_JaffaCakes118.exe	30
PID 2940 wrote to memory of 800	2940	cmd.exe	31
PID 2940 wrote to memory of 800	2940	cmd.exe	31
PID 2940 wrote to memory of 800	2940	cmd.exe	31
PID 2940 wrote to memory of 800	2940	cmd.exe	31
PID 1512 wrote to memory of 2008	1512	3913662273f772a4ce03418e7181d9b8_JaffaCakes118.exe	32
PID 1512 wrote to memory of 2008	1512	3913662273f772a4ce03418e7181d9b8_JaffaCakes118.exe	32
PID 1512 wrote to memory of 2008	1512	3913662273f772a4ce03418e7181d9b8_JaffaCakes118.exe	32
PID 1512 wrote to memory of 2008	1512	3913662273f772a4ce03418e7181d9b8_JaffaCakes118.exe	32
PID 2008 wrote to memory of 1072	2008	Tilecom32.com	34
PID 2008 wrote to memory of 1072	2008	Tilecom32.com	34
PID 2008 wrote to memory of 1072	2008	Tilecom32.com	34
PID 2008 wrote to memory of 1072	2008	Tilecom32.com	34
PID 1072 wrote to memory of 1916	1072	Tilecom32.com	35
PID 1072 wrote to memory of 1916	1072	Tilecom32.com	35
PID 1072 wrote to memory of 1916	1072	Tilecom32.com	35
PID 1072 wrote to memory of 1916	1072	Tilecom32.com	35
PID 1916 wrote to memory of 1968	1916	cmd.exe	36
PID 1916 wrote to memory of 1968	1916	cmd.exe	36
PID 1916 wrote to memory of 1968	1916	cmd.exe	36
PID 1916 wrote to memory of 1968	1916	cmd.exe	36
PID 1072 wrote to memory of 680	1072	Tilecom32.com	37
PID 1072 wrote to memory of 680	1072	Tilecom32.com	37
PID 1072 wrote to memory of 680	1072	Tilecom32.com	37
PID 1072 wrote to memory of 680	1072	Tilecom32.com	37
PID 680 wrote to memory of 2736	680	Tilecom32.com	38
PID 680 wrote to memory of 2736	680	Tilecom32.com	38
PID 680 wrote to memory of 2736	680	Tilecom32.com	38
PID 680 wrote to memory of 2736	680	Tilecom32.com	38
PID 2736 wrote to memory of 2120	2736	cmd.exe	39
PID 2736 wrote to memory of 2120	2736	cmd.exe	39
PID 2736 wrote to memory of 2120	2736	cmd.exe	39
PID 2736 wrote to memory of 2120	2736	cmd.exe	39
PID 680 wrote to memory of 2732	680	Tilecom32.com	40
PID 680 wrote to memory of 2732	680	Tilecom32.com	40
PID 680 wrote to memory of 2732	680	Tilecom32.com	40
PID 680 wrote to memory of 2732	680	Tilecom32.com	40
PID 2732 wrote to memory of 2604	2732	Tilecom32.com	41
PID 2732 wrote to memory of 2604	2732	Tilecom32.com	41
PID 2732 wrote to memory of 2604	2732	Tilecom32.com	41
PID 2732 wrote to memory of 2604	2732	Tilecom32.com	41
PID 2604 wrote to memory of 2412	2604	cmd.exe	42
PID 2604 wrote to memory of 2412	2604	cmd.exe	42
PID 2604 wrote to memory of 2412	2604	cmd.exe	42
PID 2604 wrote to memory of 2412	2604	cmd.exe	42
PID 2732 wrote to memory of 1492	2732	Tilecom32.com	43
PID 2732 wrote to memory of 1492	2732	Tilecom32.com	43
PID 2732 wrote to memory of 1492	2732	Tilecom32.com	43
PID 2732 wrote to memory of 1492	2732	Tilecom32.com	43
PID 1492 wrote to memory of 1864	1492	Tilecom32.com	44
PID 1492 wrote to memory of 1864	1492	Tilecom32.com	44
PID 1492 wrote to memory of 1864	1492	Tilecom32.com	44
PID 1492 wrote to memory of 1864	1492	Tilecom32.com	44
PID 1864 wrote to memory of 2212	1864	cmd.exe	45
PID 1864 wrote to memory of 2212	1864	cmd.exe	45
PID 1864 wrote to memory of 2212	1864	cmd.exe	45
PID 1864 wrote to memory of 2212	1864	cmd.exe	45
PID 1492 wrote to memory of 2520	1492	Tilecom32.com	46
PID 1492 wrote to memory of 2520	1492	Tilecom32.com	46
PID 1492 wrote to memory of 2520	1492	Tilecom32.com	46
PID 1492 wrote to memory of 2520	1492	Tilecom32.com	46

C:\Users\Admin\AppData\Local\Temp\3913662273f772a4ce03418e7181d9b8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3913662273f772a4ce03418e7181d9b8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\a.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\SysWOW64\regedit.exe
    REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
    3⤵
    - Modifies security service
    - Runs .reg file with regedit
    PID:800
- C:\Windows\SysWOW64\Tilecom32.com
  C:\Windows\system32\Tilecom32.com 492 "C:\Users\Admin\AppData\Local\Temp\3913662273f772a4ce03418e7181d9b8_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\SysWOW64\Tilecom32.com
    C:\Windows\system32\Tilecom32.com 520 "C:\Windows\SysWOW64\Tilecom32.com"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:1072
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c c:\a.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1916
    - - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        5⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1968
  - - C:\Windows\SysWOW64\Tilecom32.com
      C:\Windows\system32\Tilecom32.com 540 "C:\Windows\SysWOW64\Tilecom32.com"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:680
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2736
      - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        6⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2120
    - - C:\Windows\SysWOW64\Tilecom32.com
        
        C:\Windows\system32\Tilecom32.com 544 "C:\Windows\SysWOW64\Tilecom32.com"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2732
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2604
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        7⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2412
      - C:\Windows\SysWOW64\Tilecom32.com
        
        C:\Windows\system32\Tilecom32.com 548 "C:\Windows\SysWOW64\Tilecom32.com"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1492
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1864
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        8⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2212
        
        C:\Windows\SysWOW64\Tilecom32.com
        
        C:\Windows\system32\Tilecom32.com 552 "C:\Windows\SysWOW64\Tilecom32.com"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2520
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        8⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        9⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1456
        
        C:\Windows\SysWOW64\Tilecom32.com
        
        C:\Windows\system32\Tilecom32.com 556 "C:\Windows\SysWOW64\Tilecom32.com"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2752
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        9⤵
        
        PID:976
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        10⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2388
        
        C:\Windows\SysWOW64\Tilecom32.com
        
        C:\Windows\system32\Tilecom32.com 560 "C:\Windows\SysWOW64\Tilecom32.com"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:972
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        10⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        11⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1936
        
        C:\Windows\SysWOW64\Tilecom32.com
        
        C:\Windows\system32\Tilecom32.com 564 "C:\Windows\SysWOW64\Tilecom32.com"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2820
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        11⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        12⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:444
        
        C:\Windows\SysWOW64\Tilecom32.com
        
        C:\Windows\system32\Tilecom32.com 568 "C:\Windows\SysWOW64\Tilecom32.com"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2028
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        12⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        13⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
942B

MD5
4cee92ad10b11dbf325a40c64ff7d745

SHA1
b395313d0e979fede2261f8cc558fcebfefcae33

SHA256
eaeac48f16abac608c9bb5b8d0d363b2ca27708b262c1de41ab0f163c39a2fb1

SHA512
3f11992b0c8f7c6f0180f984392f86ea8eb1859be236e2bbfbc863226d3cac67b06700561f27fb673e2955c6ebc5b168dd28ca704de57c4f6c07bdbf14f75ec9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
574B

MD5
5020988c301a6bf0c54a293ddf64837c

SHA1
5b65e689a2988b9a739d53565b2a847f20d70f09

SHA256
a123ebc1fac86713cdd7c4a511e022783a581ea02ba65ea18360555706ae5f2d

SHA512
921a07597f8c82c65c675f5b09a2552c7e2e8c65c8df59eebbe9aff0bfe439ad93f5efc97ba521be31299323051d61ead6a3f0be27302dc0f728b7a844fb2fcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
925B

MD5
0d1e5715cf04d212bcd7c9dea5f7ab72

SHA1
a8add44bf542e4d22260a13de6a35704fb7f3bfb

SHA256
5d1fc763bce7a43e9e47a75ddb116b7e5d077cc5541c55bc06f2951105b88473

SHA512
89da5156b2021e4279d7fb8e3bf0196495f84d9aa04c921533d609f02b1b3edd29de80d5930483b914fe82f5fc319993f7fcd925ca22351fccd56c82652f2117

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
b99b0dc7cab4e69d365783a5c4273a83

SHA1
5fcc44aa2631c923e9961266a2e0dbeaaabe84da

SHA256
1fc967a5c8f7859ba0c410978d165085f241195fe4a31d61a127e38c30d435e4

SHA512
495474416f5eccd40829d42f050464903273d564cb862b1bd0657262485e634b5d466363cac085406c6d830f42a2f7b5648818b2efe6db1a90833a4b90a6a14d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
206B

MD5
2d9f1ff716273d19e3f0d10a3cd8736f

SHA1
b4ca02834dd3f3489c5088d2157279d2be90f5ff

SHA256
9acf0b6f653d189bcf02fa9941a2a1a6b6f60c6fa1f62ad38f314014ec188623

SHA512
1d08e079d12a58115ced67c002d383a4ff5aca81fde9ac81bb14d8c5dcdfe07839c7b895130b746d4691cd38dc74fbfc0bdc8605b520ac85bc137fd5fa922025

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
683B

MD5
6fe56f6715b4c328bc5b2b35cb51c7e1

SHA1
8f4c2a2e2704c52fd6f01d9c58e4c7d843d69cc3

SHA256
0686dfa785bc9687be1a2bb42ef6c2e805a03f62b4af6c83bac7031e515189be

SHA512
8a19ba3f6e5678e92a6fd92a84f077e851a53a71a02622d87d5213a79f40540c7bbda17219f9349387e94edc75eb12fd2cb93e3b0abbcf9a85fc7d5e8bf3be0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
2KB

MD5
5855edf3afa67e11de78af0389880d18

SHA1
c43fcd36d70a6ffcd41fbb48c1d0c406fd00286f

SHA256
c7798759a159989611cdf47f702c8813ad0f029b52f18af573f383859a8bfaaa

SHA512
5be99a55f86486c04bda0a089571c296d041dae337321578c0f8d19d7bd2e51802aafbc8716753b6191b8e5ced782a5bc7d44bdd4995ab8e6ac1f7cd4b0f91ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
748bce4dacebbbd388af154a1df22078

SHA1
0eeeb108678f819cd437d53b927feedf36aabc64

SHA256
1585c9ef77c37c064003bd746cd0a8da2523c99a10c3fb6eabd546e2a343646a

SHA512
d9756851b4aa1108416b7a77f0c6b84b599d695850d704a094a1f83b322d892ab6706001d5322e876b93935b830bcb52a951b4c69004ea2be338f64b85be2ea1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
2KB

MD5
294976e85ad11a45853f99c1b208723f

SHA1
8d83101d69420b5af97ec517165d849d3ab498fc

SHA256
04fe02d621f3d9853840b27476da4a191fc91592a77632f9cf85d4ef0370acff

SHA512
e8193036e0e411afe75c1e23f9ce1a7f32d1297706cdd0d99c20375dd7a2bdfb23cc550015852f36816668f0d085042afe74fcfff294f90854ea70f3b929a9d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
110B

MD5
b6b8b04c60361e2df1d3e29fc4fc3138

SHA1
bd732238f8d5894ca6020081adef617dabadf94e

SHA256
f255a5447d3a3eda8715938993357971faeabf92eecf172e2fc0dfbdaa239c1b

SHA512
16e7247fdc0c1191229ea44b4f6584dce588255e775642c343cffb2030c05bd77f4eb716d87d21defb0fe7edcc62a7a2e12ecbebbd72bc9a5247934fdd02fe40

Download Submit
C:\Windows\SysWOW64\Tilecom32.com

Filesize
97KB

MD5
3913662273f772a4ce03418e7181d9b8

SHA1
1979ec4910157e5fead80c69921310656bff26e9

SHA256
22ec2cb81f79aedaf443f39c5464844d15e2f0bcf91e5593e626780292c9ef6e

SHA512
92651e0ec4af6db07ed34436a1332d3a6baf128cf2835ab93e254d5e9c16ba85d685e5179dd373cae6ddd9984d91034854c6bbcb686a9ce9525038482b7d7a6a

Download Submit
C:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
memory/680-503-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/680-385-0x0000000000710000-0x0000000000793000-memory.dmp

Filesize
524KB

Download
memory/680-271-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/680-384-0x0000000000710000-0x0000000000793000-memory.dmp

Filesize
524KB

Download
memory/972-876-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/972-998-0x00000000027F0000-0x0000000002873000-memory.dmp

Filesize
524KB

Download
memory/972-997-0x00000000027F0000-0x0000000002873000-memory.dmp

Filesize
524KB

Download
memory/972-1116-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1072-139-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1072-141-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1072-380-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1072-269-0x0000000002790000-0x0000000002813000-memory.dmp

Filesize
524KB

Download
memory/1072-270-0x0000000002790000-0x0000000002813000-memory.dmp

Filesize
524KB

Download
memory/1492-631-0x00000000027C0000-0x0000000002843000-memory.dmp

Filesize
524KB

Download
memory/1492-630-0x00000000027C0000-0x0000000002843000-memory.dmp

Filesize
524KB

Download
memory/1492-517-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1492-749-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1512-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1512-8-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1512-134-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1512-9-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1512-128-0x0000000000580000-0x0000000000603000-memory.dmp

Filesize
524KB

Download
memory/1512-129-0x0000000000580000-0x0000000000603000-memory.dmp

Filesize
524KB

Download
memory/2008-130-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2008-257-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2008-138-0x0000000002810000-0x0000000002893000-memory.dmp

Filesize
524KB

Download
memory/2008-132-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2028-1129-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2028-1120-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2520-871-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2520-753-0x00000000024A0000-0x0000000002523000-memory.dmp

Filesize
524KB

Download
memory/2520-632-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2732-516-0x0000000002460000-0x00000000024E3000-memory.dmp

Filesize
524KB

Download
memory/2732-386-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2732-626-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2732-515-0x0000000002460000-0x00000000024E3000-memory.dmp

Filesize
524KB

Download
memory/2752-761-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2752-993-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2752-875-0x00000000005C0000-0x0000000000643000-memory.dmp

Filesize
524KB

Download
memory/2820-999-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2820-1127-0x0000000002440000-0x00000000024C3000-memory.dmp

Filesize
524KB

Download
memory/2820-1238-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads