cybergate | 0efff409a1f2aa1f2ccd1927fe5a5ea8edd0e7ea2a9491291e10d71420c7ef26

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 13:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
Size 301KB
Sample240715-p8n9essdml
SHA256 0efff409a1f2aa1f2ccd1927fe5a5ea8edd0e7ea2a9491291e10d71420c7ef26
MD5 49e28584a5f6010690c7cf255aed27b2
SHA1 c6cc62927c055b08c76e470df6cb25509aa30d60
SHA512 503236770609d41fbc6040c96fd6e7d7c2a7d45b3a0c5e7fd06f17f8d26d7caeeee041fd12bca5bd9fd5a5169a9db2312aa87651d6c9c820035b90f9d0ffb25b
SSDEEP 6144:MmcD6tRRj15JGmrpQsK3RD2u270jupCJsCxC3:9cD6t3QZ2zkPaCxi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cybergate vítima persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

Botnet

vítima

your_dns_here:81
promagic.zapto.org:81
magicpro.zapto.org:81
magic09.no-ip.org:82

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
spynet
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 644 created 2148	644	WerFault.exe	89

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\spynet\\server.exe"	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\spynet\\server.exe"	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\Windows\\system32\\spynet\\server.exe Restart"	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\Windows\\system32\\spynet\\server.exe"	explorer.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2148	server.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1096-4-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/2708-67-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/2708-68-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/1096-63-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/4356-138-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/2708-1460-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/4356-1915-0x0000000024160000-0x00000000241C2000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\spynet\\server.exe"	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\spynet\\server.exe"	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\spynet\server.exe	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\spynet\	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\spynet\server.exe	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\spynet\server.exe	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4724	2148	WerFault.exe	89
536	4724	WerFault.exe	93

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
536	WerFault.exe
536	WerFault.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
Token: SeDebugPrivilege	4356	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56
PID 1096 wrote to memory of 3476	1096	49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe	56

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:780
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:332

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:796
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:3008
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3776
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3864
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3924
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:4016
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4172
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:432
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3980
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:4648
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:2320
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:1348
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:2224
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4288
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3664
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
  2⤵
  PID:1528
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4528
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  2⤵
  PID:3052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:656

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:64

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1124
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1208

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1380
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1412

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1432

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1852

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1864

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1964

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2084

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2160

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2528

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3392

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3476
- C:\Users\Admin\AppData\Local\Temp\49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe"
  2⤵
  - Adds policy Run key to start application
  - Boot or Logon Autostart Execution: Active Setup
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    PID:2708
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:3880
- - C:\Users\Admin\AppData\Local\Temp\49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\49e28584a5f6010690c7cf255aed27b2_JaffaCakes118.exe"
    3⤵
    - Checks computer location settings
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:4356
  - - C:\Windows\SysWOW64\spynet\server.exe
      "C:\Windows\system32\spynet\server.exe"
      4⤵
      Executes dropped EXE
      PID:2148
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 528
        5⤵
        Program crash
        
        PID:4724
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 660
        6⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        
        PID:536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4956

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:1972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:5076

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:1732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2116

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:2676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2148 -ip 2148
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 644 -ip 644
  2⤵
  PID:2792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4724 -ip 4724
  2⤵
  PID:2540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 536 -ip 536
  2⤵
  PID:3848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 536 -ip 536
  2⤵
  PID:2044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XX--XX--XX.txt

Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Size 240KB
SHA256 0997a8ad07f2f2bab0e404ebec6e47d042606ba12ff9035dd509a563f028d6de
MD5 2382763f3929ae4f3443a5af09cbc197
SHA1 b24577672f1ac5c39fdcd6ac19d4446f0a3248d6
SHA512 52acf27f1c8c5125a0b42952197a9c7139ef5b9487822c42ecef4a0a974d37c46431557c71f3718aac035a382c8bc93d6d3e3a27c508615e6e3173960727c4e7
SSDEEP 3072:oBtMP5JuXLFG3Oa95BrKUqEQ94jhc3PQuPe2D2ue3NXR0jW/UCFnp7HBIJJyCwFN:z5JGmrpQsK3RD2u270jupCJsCxCT
MD5 SHA1 SHA512 SSDEEP

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 91d6c9c6297b8ac571644769b0d0902a86d1f3cc5b0e86fec6d0d78e2826a16a
MD5 57d2861356b603b48b7121ff765f30c5
SHA1 ba7f62ee92d165f217cd6274d17978b6a0f7ba05
SHA512 90bb886e0165cf63c50c59ea0db79f46fbf2a65e4390f7fa918f620466a08767273dfa619f0895759e5078d8f0e1fc57bbdd37d9551b59f5fd912852188a7909
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 a154077bfebb14ca6619a2ffef668fe47a7d1392925117a9c7802d94d66097a9
MD5 4e77c87eda848f65bcd037c88e65ef4d
SHA1 aaf7c3cc1e00d86502f212e6aa35f1cce21e5420
SHA512 1df30ccbb44cc4255ee6b57cfd69dc3bb40fbc36362b0ff533ef422b8ca0f2a4fbf55ac1d3a107d368326e132c803a6b19d65a6e6116320beb68ba6e275d0bdf
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 60914c1d5e8bd657960e881db0d2dd419604a09d2c539553429abe32416d6173
MD5 ae5b1eb9778810b0000eaaeb2e02865e
SHA1 240c93cec7d84bb1fc0a7a1eb7f03f736192ed79
SHA512 9629f14037d4adf8d8e9e077806f0e0e341c7a3f18bf179839c6b40231e8d87598c1cd688fedbcc20bc6bf0ebea41a31da70427a4d646e4718e1046798bce2e9
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 a7f1fa4a09f087f969dcfbe5f21cceda1c48da0e0ca8b7191de0091d5b8a6d66
MD5 6db297abf4ac697fb8ba2ff8d7293b55
SHA1 a9c46c6409315df2363ef9904624a0d77a27d185
SHA512 fd9bcd011e0cbb9a1c2a32321dbf970fef041e73617b5f5440cee89382659067bf182066cab0be51ef2cc422a7956741632e61224171deaeb3b9488cbd920855
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 2b5c0e575e6fa62850fde015d2735cfc913fbf2ea141676b79d97f922e771187
MD5 3628cd945770d77ee303a0f09b7246d6
SHA1 42298db64212068ba54a19b95a5d9b8d2cfa42e8
SHA512 d47719cc9d1c2c296d1da293e7ff2d762e61fc1d7335cee9d6b87cb74abc99e35d6e2e6202ffc0f30a73c52db7bda426e671e322ecb5775adbd500b65ff1fdab
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 a1ad28e8da6bb6ce11f0f1b385f587c57c54b4d354a735da328adf84fe69e4dc
MD5 8c6e7a8f1003c3c65fee31248be0a711
SHA1 ec991d8bc7a2c884364428266b118a325566584b
SHA512 35aca6f1607a207bc7fc4da723d12315a82d9c9ef733f706f1d73983c13f1918053bcdffe7253f85c8019bbdc5a19af348e369aecec2b616b85c1aefb704493d
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 3b7d36851091d12a7dff5d50c597d8e6bdcc7f4b6e8c9b1c71d3b7e2a54c5386
MD5 9f2aa10c3eefd426d9677928691487cc
SHA1 0cc035b39454c32ba105c782e6acdbf55ea2142d
SHA512 2a9c4442551513f016bcd6285e7552b8c16aa72bf3166284f2e7d038f5da9c996b53523daa9727c403bedb2349d103d7a78fba85de9ad1dd59e052d0dd8a4a07
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 8bccccfbafcfa38d5bbc54d314bcac475d12925ccc6fd7576a7a0a77030c2b13
MD5 6dad29345d494d3852916be08456338c
SHA1 c5ce9bcac8a71d4d7b28120d7b20a5b50ef1bb29
SHA512 d294a005e45ed313850844f130ad1b8e1db293a24738dd906ac2f0bd86a62e002c921481d78d33df89a1533329c0e530ade9f95c07609914c65c8587ec8e6fd6
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 7c5ac168c6e0fed4a5fe32ca9fd883948953e211f4379c3d7901413594834df7
MD5 3194cb6e6e3c4c9892b3cea3bec58ca6
SHA1 c22275c1099f010d827e16e08524847bbebd2ea7
SHA512 4cab99c951b9bf501292ae9d1088f36dd6dfa3f22eda8a652134c76ddc752c365825e3ed356ab5ac9422c865fc7f18f84615fa04235491b0e7d6e7cd2a24a544
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 072692c22f5c8990574a217f88e89ef2bc0d20818afb2757deb20dfc6fa814ce
MD5 61a97b40d15a699652590ee46403e7cd
SHA1 e951d3484007c548c42ab0b185e4a727445788a0
SHA512 ceb410a180f127ffe0979d5084a7f9aef0cebccd68c9911172327758f21ac7b78cfb8ae0a9d448157a17a3ea34f7a1d0bc27a84db5b0a66d22fc03b4312624a4
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 0206f8b6a9380b3ba424a1fa9bf04134e3a68d58c004ece970407a2a4f6f918c
MD5 2066cb19e1c5b7cc1ae1636ff79f4a9e
SHA1 60e4fe34ff74e62aa2d8e04c58c4abe81fe6669d
SHA512 f723826535c851228b2f21e313511a507e353385ea6a2f923ad4201caa2c791743f83b354305d81da78b9d261509a3027d72d09c482b36457ada403e44fa94c8
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 e845388ed86835b8401449bbdc860a3ac09c8453950b8b3a82f7ce65cb089841
MD5 e2f31b436655e28f635fd937f5811026
SHA1 c283bb87cf13f650a293c3f26dcfc8f260e023b4
SHA512 081f1a6c0c9657c31d15b22c99279b4bc6212743172f8f4d623e4a974d4ed2e1fc3f80d56a4ffb131ffcc3b5b94de4e41dc2b7ad2bf63afb9f0e497883ddbabf
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 fdc4545a470015e43462a565c8bf8a6300f07de768372ac15e4ed4f888d78729
MD5 839f2df1d220e7fc2d4f7a85ec6f564c
SHA1 8c96e6abc096adde8b71e217142dce6e0199d445
SHA512 d3732e670044a47602fc2fff92d40da78bcceea5e132a74fb07a8d3e75e09ad4fdb5e26a0da5a0b78a05dcecd2fe6f9056fbd86864ef45bdcfba545cd6ea64c6
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 107e1111c7cc5a974e8efad85def7c5bd96c2363a58ac58488a037d752aa308f
MD5 6e16111851555d7b54fe3a80897f3cbc
SHA1 e34ea3af6090398075355e318dc2cf11e1cc8908
SHA512 bbfaaea6c1851136cfd4e52ccdcbcd61f39ac564bd12c6d2ab8f48540fcd051c4294e2ce247d75b0cb1ab059a3dbcd97e718649d5bf7af613223f4031c065d37
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 f02063148aeb4ad77b7b47226d79bbfa46a8491b95ca5e15b48248676c1386dc
MD5 1c1d32f732b09daaebdcfe3b7d927a7b
SHA1 c797732b3490ee66841172e194c2d27ee7325084
SHA512 341c13b334ffd9fa7df8c1cbd27eaa6580f3b43443b89b95be674395663008319f4410246f07e4d0db3b9e858b9277f2a9ec99e3d6cd32b14589929455120bdd
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 b931cceb6d12d292f2effa8d27e8b39433b1ebc0d3f5c8aad94ebc4b91019123
MD5 91b471f5b21e8d6e788808fb29df0cff
SHA1 4ffd4fe698666bc33ec0d3e5c1622d2a9d5883ff
SHA512 c81b1e754ee4a7c7b376bb380cfc7fb14f029a3f5fe73793a69fad03fc0eeb62eb14d6a6894690e11ab5915b7650cf3f1336fd2065e965b7a76c1bf9d1d50557
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 4031a754e18607a6f1f354b21b206b70a40974a909e3f89d18de8096949df28c
MD5 ed4e1fa2fc7df0b0e7bc3d270098e4b2
SHA1 02d5eaeca0eee84386491d9b93bd4f2154cff0a1
SHA512 863473ebef5dedaaa884e403e8baca3c08785ec8b31cb370f18dca90a17d6d364988c728f08109e5aefad4251daffc25e383fc83276c27e3ddac3cafebbdb3f5
MD5 SHA1 SHA512

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\logs.dat
Size 15B
SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
MD5 e21bd9604efe8ee9b59dc7605b927a2a
SHA1 3240ecc5ee459214344a1baac5c2a74046491104
SHA512 42052ad5744ad76494bfa71d78578e545a3b39bfed4c4232592987bd28064b6366a423084f1193d137493c9b13d9ae1faac4cf9cc75eb715542fa56e13ca1493
MD5 SHA1 SHA512

Submit Download

server.exe

Path C:\Windows\SysWOW64\spynet\server.exe
Size 301KB
SHA256 0efff409a1f2aa1f2ccd1927fe5a5ea8edd0e7ea2a9491291e10d71420c7ef26
MD5 49e28584a5f6010690c7cf255aed27b2
SHA1 c6cc62927c055b08c76e470df6cb25509aa30d60
SHA512 503236770609d41fbc6040c96fd6e7d7c2a7d45b3a0c5e7fd06f17f8d26d7caeeee041fd12bca5bd9fd5a5169a9db2312aa87651d6c9c820035b90f9d0ffb25b
SSDEEP 6144:MmcD6tRRj15JGmrpQsK3RD2u270jupCJsCxC3:9cD6t3QZ2zkPaCxi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1096-63-0x0000000024080000-0x00000000240E2000-memory.dmp

Download

memory/1096-4-0x0000000024010000-0x0000000024072000-memory.dmp

Download

memory/2708-66-0x0000000004200000-0x0000000004201000-memory.dmp

Download

memory/2708-1460-0x0000000024080000-0x00000000240E2000-memory.dmp

Download

memory/2708-68-0x0000000024080000-0x00000000240E2000-memory.dmp

Download

memory/2708-8-0x0000000001710000-0x0000000001711000-memory.dmp

Download

memory/2708-7-0x0000000001650000-0x0000000001651000-memory.dmp

Download

memory/2708-67-0x0000000024080000-0x00000000240E2000-memory.dmp

Download

memory/4356-1915-0x0000000024160000-0x00000000241C2000-memory.dmp

Download

memory/4356-138-0x0000000024160000-0x00000000241C2000-memory.dmp

Download