7a6ff237d89319963b9f4b15017b8e4cb07cd7bc8c48abe4b19da5f25abba01f

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41bcfb1f463384d10ec7ceab45ff5b05_JaffaCakes118.exe
Size

1.9MB
MD5

41bcfb1f463384d10ec7ceab45ff5b05
SHA1

e5c9c3f6c8da784039044a30c1a9c328d01c5439
SHA256

7a6ff237d89319963b9f4b15017b8e4cb07cd7bc8c48abe4b19da5f25abba01f
SHA512

6b8bda525edabe0a735bcee7310ca87691ac66922ea618e4408f2d001bcdfd16ee09165ae64f37c97a0b8f9d8355a8537446ab1f1e000412e8a74f6d5dabdc19
SSDEEP

49152:xSjTZfp15enfjNxZiZzlvDhmCBWUhBNXClEKy:xSB81iZJFZBWyNpKy

Score

8^/10

persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A1F3725-4DA4-496E-8212-89543BD72301}	winlogo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A1F3725-4DA4-496E-8212-89543BD72301}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\winlogo.exe"	winlogo.exe

Executes dropped EXE 12 IoCs

pid	Process
2688	10522.exe
2180	22189.exe
2748	44169.exe
2824	76164.exe
2612	56133.exe
2364	70562.exe
2868	32965.exe
2772	32668.exe
2604	64663.exe
2656	69373.exe
3000	99499.exe
668	winlogo.exe

Loads dropped DLL 1 IoCs

pid	Process
3000	99499.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogo = "C:\\Users\\Admin\\AppData\\Local\\winlogo.exe"	winlogo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 8 IoCs

evasion

pid	Process
2508	taskkill.exe
1872	taskkill.exe
2148	taskkill.exe
1700	taskkill.exe
1748	taskkill.exe
2392	taskkill.exe
2428	taskkill.exe
1376	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2688	1932	41bcfb1f463384d10ec7ceab45ff5b05_JaffaCakes118.exe	30
PID 1932 wrote to memory of 2688	1932	41bcfb1f463384d10ec7ceab45ff5b05_JaffaCakes118.exe	30
PID 1932 wrote to memory of 2688	1932	41bcfb1f463384d10ec7ceab45ff5b05_JaffaCakes118.exe	30
PID 2688 wrote to memory of 2180	2688	10522.exe	31
PID 2688 wrote to memory of 2180	2688	10522.exe	31
PID 2688 wrote to memory of 2180	2688	10522.exe	31
PID 2180 wrote to memory of 2748	2180	22189.exe	32
PID 2180 wrote to memory of 2748	2180	22189.exe	32
PID 2180 wrote to memory of 2748	2180	22189.exe	32
PID 2748 wrote to memory of 2824	2748	44169.exe	33
PID 2748 wrote to memory of 2824	2748	44169.exe	33
PID 2748 wrote to memory of 2824	2748	44169.exe	33
PID 2824 wrote to memory of 2612	2824	76164.exe	34
PID 2824 wrote to memory of 2612	2824	76164.exe	34
PID 2824 wrote to memory of 2612	2824	76164.exe	34
PID 2612 wrote to memory of 2364	2612	56133.exe	35
PID 2612 wrote to memory of 2364	2612	56133.exe	35
PID 2612 wrote to memory of 2364	2612	56133.exe	35
PID 2364 wrote to memory of 2868	2364	70562.exe	36
PID 2364 wrote to memory of 2868	2364	70562.exe	36
PID 2364 wrote to memory of 2868	2364	70562.exe	36
PID 2868 wrote to memory of 2772	2868	32965.exe	37
PID 2868 wrote to memory of 2772	2868	32965.exe	37
PID 2868 wrote to memory of 2772	2868	32965.exe	37
PID 2772 wrote to memory of 2604	2772	32668.exe	38
PID 2772 wrote to memory of 2604	2772	32668.exe	38
PID 2772 wrote to memory of 2604	2772	32668.exe	38
PID 2604 wrote to memory of 2656	2604	64663.exe	39
PID 2604 wrote to memory of 2656	2604	64663.exe	39
PID 2604 wrote to memory of 2656	2604	64663.exe	39
PID 2656 wrote to memory of 3000	2656	69373.exe	40
PID 2656 wrote to memory of 3000	2656	69373.exe	40
PID 2656 wrote to memory of 3000	2656	69373.exe	40
PID 2656 wrote to memory of 3000	2656	69373.exe	40
PID 3000 wrote to memory of 668	3000	99499.exe	41
PID 3000 wrote to memory of 668	3000	99499.exe	41
PID 3000 wrote to memory of 668	3000	99499.exe	41
PID 3000 wrote to memory of 668	3000	99499.exe	41
PID 3000 wrote to memory of 1800	3000	99499.exe	42
PID 3000 wrote to memory of 1800	3000	99499.exe	42
PID 3000 wrote to memory of 1800	3000	99499.exe	42
PID 3000 wrote to memory of 1800	3000	99499.exe	42
PID 2656 wrote to memory of 1128	2656	69373.exe	44
PID 2656 wrote to memory of 1128	2656	69373.exe	44
PID 2656 wrote to memory of 1128	2656	69373.exe	44
PID 2604 wrote to memory of 1312	2604	64663.exe	46
PID 2604 wrote to memory of 1312	2604	64663.exe	46
PID 2604 wrote to memory of 1312	2604	64663.exe	46
PID 2772 wrote to memory of 1644	2772	32668.exe	48
PID 2772 wrote to memory of 1644	2772	32668.exe	48
PID 2772 wrote to memory of 1644	2772	32668.exe	48
PID 2868 wrote to memory of 2248	2868	32965.exe	50
PID 2868 wrote to memory of 2248	2868	32965.exe	50
PID 2868 wrote to memory of 2248	2868	32965.exe	50
PID 1644 wrote to memory of 1748	1644	cmd.exe	52
PID 1644 wrote to memory of 1748	1644	cmd.exe	52
PID 1644 wrote to memory of 1748	1644	cmd.exe	52
PID 1312 wrote to memory of 2428	1312	cmd.exe	53
PID 1312 wrote to memory of 2428	1312	cmd.exe	53
PID 1312 wrote to memory of 2428	1312	cmd.exe	53
PID 1128 wrote to memory of 2392	1128	cmd.exe	54
PID 1128 wrote to memory of 2392	1128	cmd.exe	54
PID 1128 wrote to memory of 2392	1128	cmd.exe	54
PID 2248 wrote to memory of 1376	2248	cmd.exe	55

C:\Users\Admin\AppData\Local\Temp\41bcfb1f463384d10ec7ceab45ff5b05_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\41bcfb1f463384d10ec7ceab45ff5b05_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Users\Admin\AppData\Local\Temp\10522.exe
  "C:\Users\Admin\AppData\Local\Temp\10522.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\22189.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\22189.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\44169.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\44169.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2748
    - - C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\76164.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\76164.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\56133.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\56133.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\70562.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\70562.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\32965.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\32965.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\32668.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\32668.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\64663.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\64663.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\69373.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\69373.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\99499.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\99499.exe"
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\winlogo.exe
        
        "C:\Users\Admin\AppData\Local\winlogo.exe"
        13⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        
        PID:668
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\melt.bat" "
        13⤵
        
        PID:1800
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\melt.bat""
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1128
        
        C:\Windows\system32\taskkill.exe
        
        TASKKILL /F /T /IM Hijack This
        13⤵
        Kills process with taskkill
        
        PID:2392
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\melt.bat""
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1312
        
        C:\Windows\system32\taskkill.exe
        
        TASKKILL /F /T /IM Hijack This
        12⤵
        Kills process with taskkill
        
        PID:2428
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\melt.bat""
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1644
        
        C:\Windows\system32\taskkill.exe
        
        TASKKILL /F /T /IM Hijack This
        11⤵
        Kills process with taskkill
        
        PID:1748
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\melt.bat""
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2248
        
        C:\Windows\system32\taskkill.exe
        
        TASKKILL /F /T /IM Hijack This
        10⤵
        Kills process with taskkill
        
        PID:1376
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\melt.bat""
        7⤵
        
        PID:648
        
        C:\Windows\system32\taskkill.exe
        
        TASKKILL /F /T /IM Hijack This
        8⤵
        Kills process with taskkill
        
        PID:2508
      - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\melt.bat""
        6⤵
        
        PID:2944
        
        C:\Windows\system32\taskkill.exe
        
        TASKKILL /F /T /IM Hijack This
        7⤵
        Kills process with taskkill
        
        PID:1872
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\melt.bat""
        5⤵
        
        PID:1744
      - C:\Windows\system32\taskkill.exe
        
        TASKKILL /F /T /IM Hijack This
        6⤵
        Kills process with taskkill
        
        PID:2148
  - - C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\melt.bat""
      4⤵
      PID:844
    - - C:\Windows\system32\taskkill.exe
        
        TASKKILL /F /T /IM Hijack This
        5⤵
        Kills process with taskkill
        
        PID:1700
- - C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\melt.bat
    3⤵
    PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\22189.exe

Filesize
1.6MB

MD5
e82962b93367246f445c5440ec7d8098

SHA1
7b6a8e76fcf80030b2c6d4db6df68015e29ab54e

SHA256
3673a5978eb96e03a435e82f1c84e8497960002703c9980475b097ccc7dd1e7a

SHA512
756d7cba3a2a9b4904e7cedb4273cad67d1605df9a6faad1d9112e3b252d895cb07a57f3822c0a5b60e55e30d01b8a3466e037d9148d43bdf9738ba74ce9c4f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\32668.exe

Filesize
780KB

MD5
da62ce16236b002267418bb143b4b32a

SHA1
a18a00d32f501261e14267950a791845bb1123e8

SHA256
0ba6b10b1c9f55a3886624e4214c9ace4f87d9b74fb71c1da03f1433b2a9a3bc

SHA512
e4b0e0b4f32d438e41fd381e0f769990d344b3eee3c982cdcebb38b2301cc33292a1a0855ecf4b0caf8de2d77893fc70e56f7ef389f275455ba9f05572e92783

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\32965.exe

Filesize
918KB

MD5
2f8590d6a0d3c2ec99994c612412a333

SHA1
d0529b99a805c735ea09103432396657613ff907

SHA256
ab93fbda37078f8e3a7d61b25481ba44c1816c93a996410abfcac210e26e5f94

SHA512
bbffbbe6e26b85b9f98f59eb8a88e8b7b7a03a5fbda0f9fd0b0001160a9e5304fbe50f3af9da5d00be9dba4da719a63ccb31ca7577564c70d384cd039fdfc996

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\44169.exe

Filesize
1.4MB

MD5
2affd5548bddd18325134da7b2ce38bf

SHA1
9c9b958d234f3bb222955eb7259aacc1adeab6fe

SHA256
9268ddb34500fa7a3bb391ea54184c68c71d590bd9d0d2aac7fd06a019f22337

SHA512
194d6e98d7b5b75ae543ba61d253c66e249948d2c97991181d7d9cf931eeb398a8d3eadc748e84c1a418497336de1442c62a764e7912b9f849b701bd97d109e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\56133.exe

Filesize
1.2MB

MD5
cd127fec6452d9a7a531952f6db8725d

SHA1
ccadb75dcbad4caa7027ece85d0f84a63b4e7a09

SHA256
79c082d4fcc1fba4c319b9a0e0fb155ea35914642e72c33f0a443e7816a1329b

SHA512
42106f273868228f3ac171025a63d96a9469d016c1578b3d6f54e9699c0e99666f683fd8f0376a80a3d8b87987562922827a019f0169f8df95aa482376f07893

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\64663.exe

Filesize
642KB

MD5
66299560990bc39c95492db1f3e8bfd4

SHA1
ce50424ec8c5ee3c61ad96f4ee5653ef287bc13b

SHA256
6dad6ec9cb62c574d28286837a011ba2beca322ebbc04764dd33cf4c62666aef

SHA512
d61ff4fde7eacef55276f63d691e5518c29abd6d7dfd8b8112e92eaca57b12219a7f2db4fd3240860a369e485b90234fc51a009192c30dd7cc615be7fc6e06a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\69373.exe

Filesize
504KB

MD5
facb835df5551c50366922cfbe9bbb0c

SHA1
f40136c660b6a6d02509aaf3a9e0377f14b876a3

SHA256
880bfc1dc6b8aeb5af06f504bffc7a64658831959e31454b43357d4a8d9bf226

SHA512
705988f907a9cebe52bd9b8c7421002dc8d3eca7389f5132b6038aca7f2f66441b34bd05e7661ef99d49e2632c42d1ed250916569d822ef1ba314e2588d39e55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\70562.exe

Filesize
1.0MB

MD5
dab6e12509d0a92230b29c56ca022f51

SHA1
ed1917942b49127c0772ef06fab79c591c7b6eeb

SHA256
9ef0b61e81c182fef37aa62202e6203626928a963cf5c01e83170b8a3d11ef51

SHA512
cf6e7f46c82b99bf54835c2173f5d4f52b4404bff75848ea39d7e1bf66d48303bc2183d31721a1aa1f5f01896db6500f88806d20ded2d7d1e72ae4bd4cce57b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\76164.exe

Filesize
1.3MB

MD5
919bfb766ada5ac3228946e892b029d9

SHA1
cf5c4f4dded03ebd72cb9c500ba27a60148f887b

SHA256
c36102eef67ad9a67a0027d42eabfafa55547cf51bf5f524f06d651b48a80f1c

SHA512
c0d007083739a56cd5f7971f40b3001720500d0fc1b144e752ab3f5af5cfb7470a11d94ea9fe7caff6ecb7f82c900ed6402a4c6dab63a99ceeafcfbf86177ae4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\99499.exe

Filesize
366KB

MD5
de8cac04ad45b067224cc328de528d88

SHA1
1e975981e171e1be13f623944de567c1bbd6ce37

SHA256
2e62c903ac73bd391a584f613bf4fc650bc54ee12f58671380aa9465321dc80c

SHA512
ed09f6cb2036b911c4f9f2b585715bd06b4fbb165b17a406ebb242646bff798124a2a95d918423bdd4f9f6f5f1270b82f95b5520a02ca2bb44c079769b633793

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\melt.bat

Filesize
83B

MD5
b8f190710d5abb20839d4879af156ca8

SHA1
b6a945bb6c22fc09a80d4e8e4fa9290ef58090a1

SHA256
2f0bca055fe8fd916b9f82879630eb989a85925202d870f0767ff8212db105d6

SHA512
df45b884a903311f59d0ffd5152a9928d6dfefaeba2874167e95d873ff08554caec4e7d459734d3133f3a05c320d0be8f4999988972ec7086be34b666d0b70ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\melt.bat

Filesize
83B

MD5
b7aa2f061f26dff23e925e035287a084

SHA1
e1089254e6461e12e8b0c434544e6925f556f46f

SHA256
e874be4d4366b42fb09054edd861074c65e3811ec0af9ba9019c267fa19a8720

SHA512
ba2484f90157cf5ce431c0ba90c2d0f158881388b00a38171282633b9f77602d2f2432f0cd2b16faec3d0732fcf1711d5d20c0d34a4cf78bdfaa263a331f9c0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\melt.bat

Filesize
83B

MD5
78b8ddaaa05e901ab8a08ae5661928aa

SHA1
8e221747f65a90e189e3de75f1ab8f1c5c17d5b7

SHA256
3d3d150a07cde3ce66fc0fce73e354822440634af990220fb9695d73272c76c5

SHA512
bb533ee38201a32f66fde22f296de918972f4890de9a27f9c5c97957c3206148e6398128b3b24642717b32a0495a762791cb5c9f053ce6c67f373343a3a714d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\melt.bat

Filesize
83B

MD5
5e479f7e940dce8895222a7327400854

SHA1
8c40d53a002d63f93416157f816f89ca9350fd40

SHA256
471779a62bdbb77d8682be044dd9972dbb906fd7adaebaa5e8695ac53cb5149c

SHA512
fdc349bfe7a7323e459421e7fe215ad29991218f6b858bce2cebd5807248a449d1c85d858739a4d152dcc984a32b0b9b21ec2dfabccc4976d8e5fcb1f83da2e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\melt.bat

Filesize
83B

MD5
d6cc41189fe96026456319a52df1f4d1

SHA1
95b6432403eb2b3c8b19d059eb6cd909541b4683

SHA256
de75939ddc5bb369f37acef895cd9c8086e8b1fb33976922f785a014026358b8

SHA512
43297f66f5f07e09003f6b2d3ab491a8949fac8bfd7d28973bfac44062715637f8a11a27b2c58800907e9999237286db5e957a13ed4012fc8beb32db924ce65e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\melt.bat

Filesize
83B

MD5
1f4cb145b7d3a03c8681de3ddf5972a1

SHA1
e7757af824758bdd5150885c3e78d7327e855e76

SHA256
0f4ec5b33c61ceba2151263e15abb8daff54d45eea0c82464e3193f8993eb87e

SHA512
70104f6999dab0f439da35742ac4fa89a455f57b2998585f5d41b2b1a7fba3f1ed7b6f1b10ffdeccbf50f57e7eb9e3bb39d31a652b8465bbefdf72f52e109111

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\melt.bat

Filesize
83B

MD5
86d76879251e37caf96bf6b0be141f4c

SHA1
32c0eb2167a1c56a68ba4203cfe0ed2a540273ab

SHA256
92fbaa3a644767381c55f68dec920b47e4cdaf1c9c440bc7089011f7f1f18595

SHA512
a27d88d72d4ae9f8ed858b8b86df6cda649d54606a04918cad927060b21b2cc684be8691c64a8c6705645025d8939b8a47f313bd0d80ee5d3dc44bb8ad64893a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\melt.bat

Filesize
83B

MD5
919d6b88e9419205f1b562657cb8654a

SHA1
3f4f9727871d3f57d4be89a2ec3f44529055d310

SHA256
8d328aa181bc05bee0ec78ca8d763b6b96c41ceb6d6838666b3451598c1191b1

SHA512
7e44c8555fb2e799deb2d2af3e7277c25e5e7ac9fbfd88ea0c91e2006831814e8f8c1435d320560c268e9aff706f58464085dda2e346cfc96fb2f3d8c24a468c

Download Submit
C:\Users\Admin\AppData\Local\Temp\10522.exe

Filesize
1.7MB

MD5
4e47ac14e0bfcc3732a9aa512e1a302e

SHA1
4a31a947f07ba2cd603cd558325437d02a9ec7be

SHA256
d67121173739cf2f06643c849191a4c41cd07db8c8927c92cccddd41842ecac5

SHA512
778700f2abe7d2eabbe53f5de717fb88560d74ff10390a6b2ee5fa6847d03bfb7219fd06076a22f545137d1eaa68343805f95d6b96732d986fdb2fa51c188a1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\melt.bat

Filesize
83B

MD5
39c2cb58021090fb20539d96a691e902

SHA1
fc016d3f7776dc43a2ac8a3b6a1087d0a593ab95

SHA256
638c01085905d1c887d087afd6c3c92e3bfce6d06fba6e9ea830ddcfa9197771

SHA512
5b7ec5e049abd8b808fa34f50ad5ed33ac4b3550e61ce16cb585bf9d3855491553cb533188ca4b65b73b8f78c1eb6d3e4b4d8dffda191fb98591ae3d97f6b5bd

Download Submit
C:\Users\Admin\AppData\Local\melt.bat

Filesize
134B

MD5
cec8b7c00f5cf12583bc4717199df32a

SHA1
804422600cf2468a44b0458f57d3caad8e6e6da8

SHA256
8ee1d0748cd7faee6997d254da1c6a764e70d609045cd2695e2133fc3d740a2c

SHA512
9807a823f16ccdfb3ec340cddb4afbe66496e777d7452adf4e1bea3f725c9084f6bba233411827a6694dc2e3b0aa3cae15f009bc3454128dd2f2b4da6debe945

Download Submit
memory/668-144-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1932-3-0x000007FEF5F90000-0x000007FEF692D000-memory.dmp

Filesize
9.6MB

Download
memory/1932-11-0x000007FEF5F90000-0x000007FEF692D000-memory.dmp

Filesize
9.6MB

Download
memory/1932-1-0x000007FEF5F90000-0x000007FEF692D000-memory.dmp

Filesize
9.6MB

Download
memory/1932-2-0x000007FEF5F90000-0x000007FEF692D000-memory.dmp

Filesize
9.6MB

Download
memory/1932-0-0x000007FEF624E000-0x000007FEF624F000-memory.dmp

Filesize
4KB

Download
memory/2364-107-0x0000000000600000-0x000000000060C000-memory.dmp

Filesize
48KB

Download
memory/2688-9-0x000007FEF5F90000-0x000007FEF692D000-memory.dmp

Filesize
9.6MB

Download
memory/2688-14-0x000007FEF5F90000-0x000007FEF692D000-memory.dmp

Filesize
9.6MB

Download
memory/2688-10-0x000007FEF5F90000-0x000007FEF692D000-memory.dmp

Filesize
9.6MB

Download
memory/2688-16-0x000007FEF5F90000-0x000007FEF692D000-memory.dmp

Filesize
9.6MB

Download
memory/2688-18-0x000007FEF5F90000-0x000007FEF692D000-memory.dmp

Filesize
9.6MB

Download
memory/2688-13-0x000007FEF5F90000-0x000007FEF692D000-memory.dmp

Filesize
9.6MB

Download
memory/2688-15-0x000007FEF5F90000-0x000007FEF692D000-memory.dmp

Filesize
9.6MB

Download
memory/2688-143-0x000007FEF5F90000-0x000007FEF692D000-memory.dmp

Filesize
9.6MB

Download
memory/2688-12-0x000007FEF5F90000-0x000007FEF692D000-memory.dmp

Filesize
9.6MB

Download
memory/3000-73-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads