32d34390feaddbb46f242da23c08ad0345d63d9ee514b80bfde28d9fbfeeafb3

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
Size

255KB
MD5

4cd2ebb5545b6ed251e43f245b80edaf
SHA1

da93e9ee70e038b678096876a5e8ffb1f470c742
SHA256

32d34390feaddbb46f242da23c08ad0345d63d9ee514b80bfde28d9fbfeeafb3
SHA512

08697f03b4956242bc899249617060aee04e8d08cac9fc5fdea4042e03b2647e0b75a4cd98a632f7f7e5c5a17aaab86d29768a579d19505393a1f84b0daf1bb2
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJE:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIb

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	agtusgzfyq.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	agtusgzfyq.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	agtusgzfyq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	agtusgzfyq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	agtusgzfyq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	agtusgzfyq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	agtusgzfyq.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	agtusgzfyq.exe

Executes dropped EXE 5 IoCs

pid	Process
2808	agtusgzfyq.exe
2256	wgylidnjpurahtl.exe
2868	qeirgkdytxxnd.exe
2736	qeoofhqg.exe
2832	qeoofhqg.exe

Loads dropped DLL 5 IoCs

pid	Process
2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
2808	agtusgzfyq.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2536-0-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x0008000000018c22-5.dat	upx
behavioral1/files/0x0009000000012279-17.dat	upx
behavioral1/files/0x00070000000190d2-28.dat	upx
behavioral1/memory/2808-27-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x0008000000018f58-37.dat	upx
behavioral1/memory/2868-36-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2256-35-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2536-45-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x0002000000003d26-67.dat	upx
behavioral1/files/0x0002000000003d27-69.dat	upx
behavioral1/memory/2808-71-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2868-74-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2808-76-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2832-75-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2736-73-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2256-72-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2868-77-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2808-78-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2256-79-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2736-83-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2832-82-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2868-81-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2808-85-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2256-87-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2868-89-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2736-90-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2832-91-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2256-93-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2868-94-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2808-92-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2808-95-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2256-96-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2868-97-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2808-99-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2256-100-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2868-101-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2808-105-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2868-107-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2256-106-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2808-108-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2868-110-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2256-109-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2256-112-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2868-113-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2808-111-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2868-116-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2256-115-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2808-114-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2808-117-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2256-118-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2868-119-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2256-121-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2868-122-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2808-120-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2808-123-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2256-124-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2868-125-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2808-126-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2256-127-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2868-128-0x0000000000400000-0x00000000004A0000-memory.dmp	upx

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	agtusgzfyq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	agtusgzfyq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	agtusgzfyq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	agtusgzfyq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	agtusgzfyq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	agtusgzfyq.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\jejzgjmh = "agtusgzfyq.exe"	wgylidnjpurahtl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yatctnkt = "wgylidnjpurahtl.exe"	wgylidnjpurahtl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "qeirgkdytxxnd.exe"	wgylidnjpurahtl.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	qeoofhqg.exe
File opened (read-only)	\??\e:	qeoofhqg.exe
File opened (read-only)	\??\z:	qeoofhqg.exe
File opened (read-only)	\??\x:	qeoofhqg.exe
File opened (read-only)	\??\r:	agtusgzfyq.exe
File opened (read-only)	\??\w:	qeoofhqg.exe
File opened (read-only)	\??\e:	agtusgzfyq.exe
File opened (read-only)	\??\w:	agtusgzfyq.exe
File opened (read-only)	\??\j:	qeoofhqg.exe
File opened (read-only)	\??\q:	qeoofhqg.exe
File opened (read-only)	\??\s:	qeoofhqg.exe
File opened (read-only)	\??\u:	qeoofhqg.exe
File opened (read-only)	\??\v:	qeoofhqg.exe
File opened (read-only)	\??\g:	agtusgzfyq.exe
File opened (read-only)	\??\n:	qeoofhqg.exe
File opened (read-only)	\??\o:	qeoofhqg.exe
File opened (read-only)	\??\a:	qeoofhqg.exe
File opened (read-only)	\??\k:	qeoofhqg.exe
File opened (read-only)	\??\p:	qeoofhqg.exe
File opened (read-only)	\??\v:	qeoofhqg.exe
File opened (read-only)	\??\m:	qeoofhqg.exe
File opened (read-only)	\??\i:	qeoofhqg.exe
File opened (read-only)	\??\l:	qeoofhqg.exe
File opened (read-only)	\??\b:	qeoofhqg.exe
File opened (read-only)	\??\g:	qeoofhqg.exe
File opened (read-only)	\??\y:	agtusgzfyq.exe
File opened (read-only)	\??\z:	agtusgzfyq.exe
File opened (read-only)	\??\k:	qeoofhqg.exe
File opened (read-only)	\??\h:	agtusgzfyq.exe
File opened (read-only)	\??\q:	agtusgzfyq.exe
File opened (read-only)	\??\w:	qeoofhqg.exe
File opened (read-only)	\??\y:	qeoofhqg.exe
File opened (read-only)	\??\r:	qeoofhqg.exe
File opened (read-only)	\??\i:	agtusgzfyq.exe
File opened (read-only)	\??\o:	agtusgzfyq.exe
File opened (read-only)	\??\x:	agtusgzfyq.exe
File opened (read-only)	\??\q:	qeoofhqg.exe
File opened (read-only)	\??\e:	qeoofhqg.exe
File opened (read-only)	\??\n:	qeoofhqg.exe
File opened (read-only)	\??\r:	qeoofhqg.exe
File opened (read-only)	\??\i:	qeoofhqg.exe
File opened (read-only)	\??\m:	qeoofhqg.exe
File opened (read-only)	\??\t:	agtusgzfyq.exe
File opened (read-only)	\??\s:	qeoofhqg.exe
File opened (read-only)	\??\x:	qeoofhqg.exe
File opened (read-only)	\??\y:	qeoofhqg.exe
File opened (read-only)	\??\h:	qeoofhqg.exe
File opened (read-only)	\??\a:	agtusgzfyq.exe
File opened (read-only)	\??\j:	agtusgzfyq.exe
File opened (read-only)	\??\s:	agtusgzfyq.exe
File opened (read-only)	\??\l:	qeoofhqg.exe
File opened (read-only)	\??\u:	qeoofhqg.exe
File opened (read-only)	\??\k:	agtusgzfyq.exe
File opened (read-only)	\??\m:	agtusgzfyq.exe
File opened (read-only)	\??\h:	qeoofhqg.exe
File opened (read-only)	\??\o:	qeoofhqg.exe
File opened (read-only)	\??\t:	qeoofhqg.exe
File opened (read-only)	\??\p:	agtusgzfyq.exe
File opened (read-only)	\??\t:	qeoofhqg.exe
File opened (read-only)	\??\j:	qeoofhqg.exe
File opened (read-only)	\??\n:	agtusgzfyq.exe
File opened (read-only)	\??\z:	qeoofhqg.exe
File opened (read-only)	\??\l:	agtusgzfyq.exe
File opened (read-only)	\??\a:	qeoofhqg.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	agtusgzfyq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	agtusgzfyq.exe

AutoIT Executable 52 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2808-27-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2536-45-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2808-71-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2868-74-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2808-76-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2832-75-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2736-73-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2256-72-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2868-77-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2808-78-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2256-79-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2736-83-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2832-82-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2868-81-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2808-85-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2256-87-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2868-89-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2736-90-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2832-91-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2256-93-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2868-94-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2808-92-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2808-95-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2256-96-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2868-97-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2808-99-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2256-100-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2868-101-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2808-105-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2868-107-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2256-106-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2808-108-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2868-110-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2256-109-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2256-112-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2868-113-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2808-111-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2868-116-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2256-115-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2808-114-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2808-117-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2256-118-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2868-119-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2256-121-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2868-122-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2808-120-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2808-123-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2256-124-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2868-125-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2808-126-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2256-127-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2868-128-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	agtusgzfyq.exe
File created	C:\Windows\SysWOW64\agtusgzfyq.exe	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wgylidnjpurahtl.exe	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\qeoofhqg.exe	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\qeirgkdytxxnd.exe	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\agtusgzfyq.exe	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wgylidnjpurahtl.exe	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\qeoofhqg.exe	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\qeirgkdytxxnd.exe	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	qeoofhqg.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	qeoofhqg.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	qeoofhqg.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	qeoofhqg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	qeoofhqg.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	qeoofhqg.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	qeoofhqg.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	qeoofhqg.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	qeoofhqg.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	qeoofhqg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	qeoofhqg.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	qeoofhqg.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	qeoofhqg.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	qeoofhqg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\mydoc.rtf	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BC9FACAFE64F19583793B4586EE39E2B38F03F142110338E1BD459D08A6"	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat	agtusgzfyq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsh	agtusgzfyq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsf	agtusgzfyq.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLV.Classes	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7806BB0FE6E22A9D20ED0A48A749162"	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1949C60914E6DAC3B9C07C93ED9537CD"	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile"	agtusgzfyq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile"	agtusgzfyq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	agtusgzfyq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	agtusgzfyq.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33422C7F9D2D82236D3F76D777552CD87C8765D8"	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2ECAB12F47E139ED53C8BAA133EDD7BE"	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile"	agtusgzfyq.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F89FF82482982139146D72C7D91BCE4E6365830664F6330D790"	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	agtusgzfyq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc	agtusgzfyq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	agtusgzfyq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg	agtusgzfyq.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2840	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
2808	agtusgzfyq.exe
2808	agtusgzfyq.exe
2808	agtusgzfyq.exe
2808	agtusgzfyq.exe
2808	agtusgzfyq.exe
2736	qeoofhqg.exe
2736	qeoofhqg.exe
2736	qeoofhqg.exe
2736	qeoofhqg.exe
2256	wgylidnjpurahtl.exe
2256	wgylidnjpurahtl.exe
2256	wgylidnjpurahtl.exe
2256	wgylidnjpurahtl.exe
2868	qeirgkdytxxnd.exe
2868	qeirgkdytxxnd.exe
2868	qeirgkdytxxnd.exe
2868	qeirgkdytxxnd.exe
2868	qeirgkdytxxnd.exe
2868	qeirgkdytxxnd.exe
2256	wgylidnjpurahtl.exe
2832	qeoofhqg.exe
2832	qeoofhqg.exe
2832	qeoofhqg.exe
2832	qeoofhqg.exe
2256	wgylidnjpurahtl.exe
2868	qeirgkdytxxnd.exe
2868	qeirgkdytxxnd.exe
2256	wgylidnjpurahtl.exe
2256	wgylidnjpurahtl.exe
2868	qeirgkdytxxnd.exe
2868	qeirgkdytxxnd.exe
2256	wgylidnjpurahtl.exe
2868	qeirgkdytxxnd.exe
2868	qeirgkdytxxnd.exe
2256	wgylidnjpurahtl.exe
2868	qeirgkdytxxnd.exe
2868	qeirgkdytxxnd.exe
2256	wgylidnjpurahtl.exe
2868	qeirgkdytxxnd.exe
2868	qeirgkdytxxnd.exe
2256	wgylidnjpurahtl.exe
2868	qeirgkdytxxnd.exe
2868	qeirgkdytxxnd.exe
2256	wgylidnjpurahtl.exe
2868	qeirgkdytxxnd.exe
2868	qeirgkdytxxnd.exe
2256	wgylidnjpurahtl.exe
2868	qeirgkdytxxnd.exe
2868	qeirgkdytxxnd.exe
2256	wgylidnjpurahtl.exe
2868	qeirgkdytxxnd.exe
2868	qeirgkdytxxnd.exe
2256	wgylidnjpurahtl.exe
2868	qeirgkdytxxnd.exe
2868	qeirgkdytxxnd.exe
2256	wgylidnjpurahtl.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1500	explorer.exe
Token: SeShutdownPrivilege	1500	explorer.exe
Token: SeShutdownPrivilege	1500	explorer.exe
Token: SeShutdownPrivilege	1500	explorer.exe
Token: SeShutdownPrivilege	1500	explorer.exe
Token: SeShutdownPrivilege	1500	explorer.exe
Token: SeShutdownPrivilege	1500	explorer.exe
Token: SeShutdownPrivilege	1500	explorer.exe
Token: SeShutdownPrivilege	1500	explorer.exe
Token: SeShutdownPrivilege	1500	explorer.exe
Token: SeShutdownPrivilege	1500	explorer.exe
Token: SeShutdownPrivilege	1500	explorer.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
2808	agtusgzfyq.exe
2808	agtusgzfyq.exe
2736	qeoofhqg.exe
2808	agtusgzfyq.exe
2736	qeoofhqg.exe
2736	qeoofhqg.exe
2256	wgylidnjpurahtl.exe
2256	wgylidnjpurahtl.exe
2868	qeirgkdytxxnd.exe
2256	wgylidnjpurahtl.exe
2868	qeirgkdytxxnd.exe
2868	qeirgkdytxxnd.exe
2832	qeoofhqg.exe
2832	qeoofhqg.exe
2832	qeoofhqg.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
2808	agtusgzfyq.exe
2808	agtusgzfyq.exe
2736	qeoofhqg.exe
2808	agtusgzfyq.exe
2736	qeoofhqg.exe
2736	qeoofhqg.exe
2256	wgylidnjpurahtl.exe
2256	wgylidnjpurahtl.exe
2868	qeirgkdytxxnd.exe
2256	wgylidnjpurahtl.exe
2868	qeirgkdytxxnd.exe
2868	qeirgkdytxxnd.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe
1500	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2840	WINWORD.EXE
2840	WINWORD.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2808	2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe	31
PID 2536 wrote to memory of 2808	2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe	31
PID 2536 wrote to memory of 2808	2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe	31
PID 2536 wrote to memory of 2808	2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe	31
PID 2536 wrote to memory of 2256	2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe	32
PID 2536 wrote to memory of 2256	2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe	32
PID 2536 wrote to memory of 2256	2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe	32
PID 2536 wrote to memory of 2256	2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe	32
PID 2536 wrote to memory of 2736	2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe	33
PID 2536 wrote to memory of 2736	2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe	33
PID 2536 wrote to memory of 2736	2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe	33
PID 2536 wrote to memory of 2736	2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe	33
PID 2536 wrote to memory of 2868	2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe	34
PID 2536 wrote to memory of 2868	2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe	34
PID 2536 wrote to memory of 2868	2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe	34
PID 2536 wrote to memory of 2868	2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe	34
PID 2536 wrote to memory of 2840	2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe	35
PID 2536 wrote to memory of 2840	2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe	35
PID 2536 wrote to memory of 2840	2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe	35
PID 2536 wrote to memory of 2840	2536	4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe	35
PID 2808 wrote to memory of 2832	2808	agtusgzfyq.exe	36
PID 2808 wrote to memory of 2832	2808	agtusgzfyq.exe	36
PID 2808 wrote to memory of 2832	2808	agtusgzfyq.exe	36
PID 2808 wrote to memory of 2832	2808	agtusgzfyq.exe	36
PID 2840 wrote to memory of 2136	2840	WINWORD.EXE	39
PID 2840 wrote to memory of 2136	2840	WINWORD.EXE	39
PID 2840 wrote to memory of 2136	2840	WINWORD.EXE	39
PID 2840 wrote to memory of 2136	2840	WINWORD.EXE	39

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4cd2ebb5545b6ed251e43f245b80edaf_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\agtusgzfyq.exe
  agtusgzfyq.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\SysWOW64\qeoofhqg.exe
    C:\Windows\system32\qeoofhqg.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:2832
- C:\Windows\SysWOW64\wgylidnjpurahtl.exe
  wgylidnjpurahtl.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2256
- C:\Windows\SysWOW64\qeoofhqg.exe
  qeoofhqg.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2736
- C:\Windows\SysWOW64\qeirgkdytxxnd.exe
  qeirgkdytxxnd.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2868
- C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:2136

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

Filesize
255KB

MD5
bbb621e9543685a1ea04b8395b0029ba

SHA1
4abd1358e7f6a3926744f4fadb09e3811a9a6eba

SHA256
848653be5524ff7f93942887d099f03d503c551a4e5b8932eca05ca0aed5263f

SHA512
1b46beda6e735e918a1070a14cbecfba0d00149b7e85d4804d4a28ed75f78f51dd8c5be6c6f8b3ae1bf0c375235b238e7af3aeff27a7ff733f46c06357c684b8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

Filesize
255KB

MD5
ec448be067095edb257fe28435df9fdf

SHA1
5465b1680299d77864438b9e02a185e68cc51af8

SHA256
02eb2cce4d1c4173ce1b9cd6fd194cbf334fa9b71c476b4c2e0224a7c026f1e8

SHA512
28a2f1e7fdf0ca76fa5259e4a531e3f2b44ed958f6e450099bbdc8142abf24b49ffc627cf6b6e0cd72aa7f49b5b4e669f69ae159cc7e341b227d85ddb0d93c16

Download Submit
C:\Windows\SysWOW64\qeoofhqg.exe

Filesize
255KB

MD5
fa8a62a443b1f9fc77ce678c63981a84

SHA1
be63e2ec62d4ae7fae6de654e66f8b26c3b2b1f2

SHA256
0891fbb5f7acc1717cb219443bea1b707cef0ed9e09656957c6a4efd29398df9

SHA512
791e599169076949e345cc4ae66ceeb4e7cb75d34697ceaa79b9a6e0e6f587f133ca62a9ca17bdcaf5fa84bc745ad0f98e0a2fe22279fdf1465c5d71acb3f0e1

Download Submit
C:\Windows\SysWOW64\wgylidnjpurahtl.exe

Filesize
255KB

MD5
d7b41aa1738292145470b76e4d50859b

SHA1
a96fc714da2c7420b777b824ca1197f84b26f791

SHA256
d9f4551471f31ebf8c2ebf57ae7e47e7c061b2b6722ee89bc7c8c0df8721ee19

SHA512
56c529395bcd1920283f00ea0174b84178e39e8f49162a87bf517bd8c8107c85dd10156ef03b50b8dfa4d60f1e5667c23a9c270cad6b66208ac69a891e408b4f

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\Windows\SysWOW64\agtusgzfyq.exe

Filesize
255KB

MD5
fcdb2c47f97a9f8334bd0c824ab09d2a

SHA1
b5946ab27b7d8cc4a05047efcb954c641bdc5e68

SHA256
abd3bc585688b4671dc5710e60e7383f9004f4378a9f4c154146888aed47632e

SHA512
33641879aaaa7c0786915722d47c2dc8e73a704ace2ceddf72e849211dfa33870def74bcd0d468448ad5943a64cfcbdbf8df8a692012d896d163e9fd71113ccc

Download Submit
\Windows\SysWOW64\qeirgkdytxxnd.exe

Filesize
255KB

MD5
569d02a2dcdd4b4d78fe438bc1e89484

SHA1
49698bb8e13a049969a36b224f21cafd55a395af

SHA256
31c08e7384b0207fdf59b6355c6779174cdae6c89003058af541b2cf5984e2fd

SHA512
5fa7e77b61292f8e733748e2d5084897d861901f391d2ddeb836d494c515b70b62fd716d1bad79b43db1c8b7d2f8a956827d5254bcb2243f4fe45171ed9dabaa

Download Submit
memory/2256-79-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2256-96-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2256-35-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2256-106-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2256-127-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2256-118-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2256-112-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2256-100-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2256-124-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2256-115-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2256-109-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2256-87-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2256-72-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2256-121-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2256-93-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2536-0-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2536-30-0x00000000036F0000-0x0000000003790000-memory.dmp

Filesize
640KB

Download
memory/2536-45-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2736-73-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2736-90-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2736-83-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2808-84-0x0000000003BD0000-0x0000000003C70000-memory.dmp

Filesize
640KB

Download
memory/2808-85-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2808-120-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2808-117-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2808-78-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2808-114-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2808-92-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2808-95-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2808-123-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2808-76-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2808-99-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2808-71-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2808-111-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2808-105-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2808-27-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2808-126-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2808-108-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2832-75-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2832-91-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2832-82-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2840-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2868-116-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2868-81-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2868-97-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2868-94-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2868-101-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2868-89-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2868-119-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2868-110-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2868-122-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2868-113-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2868-77-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2868-74-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2868-125-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2868-107-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2868-36-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2868-128-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download