d7c6608fb7db4ccfb0aaa49322534e412147c41a14ce1e3c32285982952cc9aa

Analysis

max time kernel
149s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 10:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4dd70453aa7a3d53d0b0188fb4c798fb_JaffaCakes118.exe
Size

228KB
MD5

4dd70453aa7a3d53d0b0188fb4c798fb
SHA1

e92ba1890868b76f0afcdd35c43ece3475f728ad
SHA256

d7c6608fb7db4ccfb0aaa49322534e412147c41a14ce1e3c32285982952cc9aa
SHA512

47023aad87a0ae65a7bded7d95a78ec92e658a87363515c99efb5293de5993689fc261f14c8147e3564529720443619aedba3ffcb4c4e67827d7ebf86cdb9ed4
SSDEEP

6144:qoEdkmu85Dq+3qM3W7tfQN5/inEaMadDKNa1aILk71:gkmDN6M3atfQunka1KNaTgJ

Score

10^/10

evasion

Malware Config

Signatures

Modifies security service 2 TTPs 22 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe

Executes dropped EXE 10 IoCs

pid	Process
3024	cPaner.com
2032	cPaner.com
1656	cPaner.com
4284	cPaner.com
3504	cPaner.com
2172	cPaner.com
416	cPaner.com
3476	cPaner.com
3508	cPaner.com
3528	cPaner.com

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\cPaner.com	cPaner.com
File created	C:\Windows\SysWOW64\cPaner.com	cPaner.com
File created	C:\Windows\SysWOW64\cPaner.com	cPaner.com
File opened for modification	C:\Windows\SysWOW64\cPaner.com	cPaner.com
File created	C:\Windows\SysWOW64\cPaner.com	cPaner.com
File opened for modification	C:\Windows\SysWOW64\cPaner.com	cPaner.com
File opened for modification	C:\Windows\SysWOW64\cPaner.com	cPaner.com
File opened for modification	C:\Windows\SysWOW64\cPaner.com	cPaner.com
File opened for modification	C:\Windows\SysWOW64\aspr_keys.ini	cPaner.com
File created	C:\Windows\SysWOW64\cPaner.com	cPaner.com
File opened for modification	C:\Windows\SysWOW64\cPaner.com	4dd70453aa7a3d53d0b0188fb4c798fb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\cPaner.com	cPaner.com
File created	C:\Windows\SysWOW64\cPaner.com	cPaner.com
File opened for modification	C:\Windows\SysWOW64\aspr_keys.ini	cPaner.com
File opened for modification	C:\Windows\SysWOW64\cPaner.com	cPaner.com
File opened for modification	C:\Windows\SysWOW64\cPaner.com	cPaner.com
File opened for modification	C:\Windows\SysWOW64\cPaner.com	cPaner.com
File opened for modification	C:\Windows\SysWOW64\aspr_keys.ini	cPaner.com
File opened for modification	C:\Windows\SysWOW64\aspr_keys.ini	cPaner.com
File opened for modification	C:\Windows\SysWOW64\cPaner.com	cPaner.com
File created	C:\Windows\SysWOW64\cPaner.com	cPaner.com
File opened for modification	C:\Windows\SysWOW64\aspr_keys.ini	cPaner.com
File opened for modification	C:\Windows\SysWOW64\cPaner.com	cPaner.com
File created	C:\Windows\SysWOW64\cPaner.com	4dd70453aa7a3d53d0b0188fb4c798fb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\cPaner.com	cPaner.com
File created	C:\Windows\SysWOW64\cPaner.com	cPaner.com
File created	C:\Windows\SysWOW64\cPaner.com	cPaner.com
File opened for modification	C:\Windows\SysWOW64\aspr_keys.ini	cPaner.com
File opened for modification	C:\Windows\SysWOW64\aspr_keys.ini	cPaner.com
File opened for modification	C:\Windows\SysWOW64\aspr_keys.ini	cPaner.com
File opened for modification	C:\Windows\SysWOW64\aspr_keys.ini	cPaner.com
File opened for modification	C:\Windows\SysWOW64\aspr_keys.ini	cPaner.com

Runs .reg file with regedit 11 IoCs

pid	Process
592	regedit.exe
4848	regedit.exe
3312	regedit.exe
3624	regedit.exe
4832	regedit.exe
1764	regedit.exe
4016	regedit.exe
2124	regedit.exe
1616	regedit.exe
1224	regedit.exe
1376	regedit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 920	2376	4dd70453aa7a3d53d0b0188fb4c798fb_JaffaCakes118.exe	83
PID 2376 wrote to memory of 920	2376	4dd70453aa7a3d53d0b0188fb4c798fb_JaffaCakes118.exe	83
PID 2376 wrote to memory of 920	2376	4dd70453aa7a3d53d0b0188fb4c798fb_JaffaCakes118.exe	83
PID 920 wrote to memory of 592	920	cmd.exe	84
PID 920 wrote to memory of 592	920	cmd.exe	84
PID 920 wrote to memory of 592	920	cmd.exe	84
PID 2376 wrote to memory of 3024	2376	4dd70453aa7a3d53d0b0188fb4c798fb_JaffaCakes118.exe	86
PID 2376 wrote to memory of 3024	2376	4dd70453aa7a3d53d0b0188fb4c798fb_JaffaCakes118.exe	86
PID 2376 wrote to memory of 3024	2376	4dd70453aa7a3d53d0b0188fb4c798fb_JaffaCakes118.exe	86
PID 3024 wrote to memory of 1960	3024	cPaner.com	88
PID 3024 wrote to memory of 1960	3024	cPaner.com	88
PID 3024 wrote to memory of 1960	3024	cPaner.com	88
PID 1960 wrote to memory of 1616	1960	cmd.exe	89
PID 1960 wrote to memory of 1616	1960	cmd.exe	89
PID 1960 wrote to memory of 1616	1960	cmd.exe	89
PID 3024 wrote to memory of 2032	3024	cPaner.com	91
PID 3024 wrote to memory of 2032	3024	cPaner.com	91
PID 3024 wrote to memory of 2032	3024	cPaner.com	91
PID 2032 wrote to memory of 4208	2032	cPaner.com	92
PID 2032 wrote to memory of 4208	2032	cPaner.com	92
PID 2032 wrote to memory of 4208	2032	cPaner.com	92
PID 4208 wrote to memory of 1224	4208	cmd.exe	93
PID 4208 wrote to memory of 1224	4208	cmd.exe	93
PID 4208 wrote to memory of 1224	4208	cmd.exe	93
PID 2032 wrote to memory of 1656	2032	cPaner.com	96
PID 2032 wrote to memory of 1656	2032	cPaner.com	96
PID 2032 wrote to memory of 1656	2032	cPaner.com	96
PID 1656 wrote to memory of 184	1656	cPaner.com	97
PID 1656 wrote to memory of 184	1656	cPaner.com	97
PID 1656 wrote to memory of 184	1656	cPaner.com	97
PID 184 wrote to memory of 1376	184	cmd.exe	98
PID 184 wrote to memory of 1376	184	cmd.exe	98
PID 184 wrote to memory of 1376	184	cmd.exe	98
PID 1656 wrote to memory of 4284	1656	cPaner.com	100
PID 1656 wrote to memory of 4284	1656	cPaner.com	100
PID 1656 wrote to memory of 4284	1656	cPaner.com	100
PID 4284 wrote to memory of 3384	4284	cPaner.com	101
PID 4284 wrote to memory of 3384	4284	cPaner.com	101
PID 4284 wrote to memory of 3384	4284	cPaner.com	101
PID 3384 wrote to memory of 3624	3384	cmd.exe	102
PID 3384 wrote to memory of 3624	3384	cmd.exe	102
PID 3384 wrote to memory of 3624	3384	cmd.exe	102
PID 4284 wrote to memory of 3504	4284	cPaner.com	103
PID 4284 wrote to memory of 3504	4284	cPaner.com	103
PID 4284 wrote to memory of 3504	4284	cPaner.com	103
PID 3504 wrote to memory of 1356	3504	cPaner.com	104
PID 3504 wrote to memory of 1356	3504	cPaner.com	104
PID 3504 wrote to memory of 1356	3504	cPaner.com	104
PID 1356 wrote to memory of 4832	1356	cmd.exe	105
PID 1356 wrote to memory of 4832	1356	cmd.exe	105
PID 1356 wrote to memory of 4832	1356	cmd.exe	105
PID 3504 wrote to memory of 2172	3504	cPaner.com	106
PID 3504 wrote to memory of 2172	3504	cPaner.com	106
PID 3504 wrote to memory of 2172	3504	cPaner.com	106
PID 2172 wrote to memory of 1528	2172	cPaner.com	107
PID 2172 wrote to memory of 1528	2172	cPaner.com	107
PID 2172 wrote to memory of 1528	2172	cPaner.com	107
PID 1528 wrote to memory of 1764	1528	cmd.exe	108
PID 1528 wrote to memory of 1764	1528	cmd.exe	108
PID 1528 wrote to memory of 1764	1528	cmd.exe	108
PID 2172 wrote to memory of 416	2172	cPaner.com	109
PID 2172 wrote to memory of 416	2172	cPaner.com	109
PID 2172 wrote to memory of 416	2172	cPaner.com	109
PID 416 wrote to memory of 5096	416	cPaner.com	110

C:\Users\Admin\AppData\Local\Temp\4dd70453aa7a3d53d0b0188fb4c798fb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4dd70453aa7a3d53d0b0188fb4c798fb_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\acx.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:920
- - C:\Windows\SysWOW64\regedit.exe
    REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
    3⤵
    - Modifies security service
    - Runs .reg file with regedit
    PID:592
- C:\Windows\SysWOW64\cPaner.com
  C:\Windows\system32\cPaner.com 1100 "C:\Users\Admin\AppData\Local\Temp\4dd70453aa7a3d53d0b0188fb4c798fb_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\acx.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Windows\SysWOW64\regedit.exe
      REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
      4⤵
      Modifies security service
      Runs .reg file with regedit
      PID:1616
- - C:\Windows\SysWOW64\cPaner.com
    C:\Windows\system32\cPaner.com 1212 "C:\Windows\SysWOW64\cPaner.com"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\acx.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4208
    - - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        5⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1224
  - - C:\Windows\SysWOW64\cPaner.com
      C:\Windows\system32\cPaner.com 1180 "C:\Windows\SysWOW64\cPaner.com"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1656
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\acx.bat
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:184
      - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        6⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1376
    - - C:\Windows\SysWOW64\cPaner.com
        
        C:\Windows\system32\cPaner.com 1188 "C:\Windows\SysWOW64\cPaner.com"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4284
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\acx.bat
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3384
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        7⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:3624
      - C:\Windows\SysWOW64\cPaner.com
        
        C:\Windows\system32\cPaner.com 1192 "C:\Windows\SysWOW64\cPaner.com"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\acx.bat
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1356
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        8⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:4832
        
        C:\Windows\SysWOW64\cPaner.com
        
        C:\Windows\system32\cPaner.com 1196 "C:\Windows\SysWOW64\cPaner.com"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2172
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\acx.bat
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1528
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        9⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1764
        
        C:\Windows\SysWOW64\cPaner.com
        
        C:\Windows\system32\cPaner.com 1200 "C:\Windows\SysWOW64\cPaner.com"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\acx.bat
        9⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        10⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:4848
        
        C:\Windows\SysWOW64\cPaner.com
        
        C:\Windows\system32\cPaner.com 1204 "C:\Windows\SysWOW64\cPaner.com"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\acx.bat
        10⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        11⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:4016
        
        C:\Windows\SysWOW64\cPaner.com
        
        C:\Windows\system32\cPaner.com 1208 "C:\Windows\SysWOW64\cPaner.com"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3508
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\acx.bat
        11⤵
        
        PID:228
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        12⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2124
        
        C:\Windows\SysWOW64\cPaner.com
        
        C:\Windows\system32\cPaner.com 1184 "C:\Windows\SysWOW64\cPaner.com"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\acx.bat
        12⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        13⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:3312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
2KB

MD5
63ff40a70037650fd0acfd68314ffc94

SHA1
1ab29adec6714edf286485ac5889fddb1d092e93

SHA256
1e607f10a90fdbaffe26e81c9a5f320fb9c954391d2adcc55fdfdfca1601714b

SHA512
2b41ce69cd1541897fbae5497f06779ac8182ff84fbf29ac29b7c2b234753fe44e7dfc6e4c257af222d466536fa4e50e247dcb68a9e1ad7766245dedfcfb6fdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
2KB

MD5
bef09dc596b7b91eec4f38765e0965b7

SHA1
b8bb8d2eb918e0979b08fd1967dac127874b9de5

SHA256
8dab724d5941eb7becff35ce1a76e8525dcdca024900e70758300dcdddf8e265

SHA512
0bbce4150b47bafb674f2074fdfc20df86edadb85037f93c541d1d53f721ed52e37a49d14522dac56e9d2e9ce801bcdb701509fa02285778a086d547f1be966a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
d085cde42c14e8ee2a5e8870d08aee42

SHA1
c8e967f1d301f97dbcf252d7e1677e590126f994

SHA256
a15d5dfd655de1214e0aae2292ead17eef1f1b211d39fac03276bbd6325b0d9f

SHA512
de2cebd45d3cf053df17ae43466db6a8b2d816bf4b9a8deb5b577cfedf765b5dcdc5904145809ad3ca03ccff308f8893ec1faa309dd34afcab7cc1836d698d7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
476B

MD5
a5d4cddfecf34e5391a7a3df62312327

SHA1
04a3c708bab0c15b6746cf9dbf41a71c917a98b9

SHA256
8961a4310b2413753851ba8afe2feb4c522c20e856c6a98537d8ab440f48853a

SHA512
48024549d0fcb88e3bd46f7fb42715181142cae764a3daeb64cad07f10cf3bf14153731aeafba9a191557e29ddf1c5b62a460588823df215e2246eddaeff6643

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
8a84d46ef81c793a90a80bc806cffdcf

SHA1
02fac9db9330040ffc613a325686ddca2678a7c5

SHA256
201891985252489d470c08e66c42a4cf5f9220be3051b9a167936c8f80a606c4

SHA512
b198b32fd9be872968644641248d4e3794aa095f446bab4e1c5a54b2c109df166bbdfb54d4fd8912d202f92ac69b1685ed0c30256e40f30d72e433ee987cc374

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
a920eceddece6cf7f3487fd8e919af34

SHA1
a6dee2d31d4cbd1b18f5d3bc971521411a699889

SHA256
ec2d3952154412db3202f5c95e4d1b02c40a7f71f4458898ddc36e827a7b32d6

SHA512
a4700af2ce477c7ce33f434cdddd4031e88c3926d05475f522a753063269fe8b6e50b649c3e939272240194951cb70ac05df533978c19839e381141535275ecc

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
5aa228bc61037ddaf7a22dab4a04e9a1

SHA1
b50fcd8f643ea748f989a06e38c778884b3c19f2

SHA256
65c7c12f00303ec69556e7e108d2fb3881b761b5e68d12e8ae94d80ab1fd7d8b

SHA512
2ac1a9465083463a116b33039b4c4014433bda78a61e6312dde0e8f74f0a6a6881017041985871badee442a693d66385fe87cbfc60f1309f7a3c9fb59ec6f2aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
2KB

MD5
f8a9a1aa9bab7821d25ae628e6d04f68

SHA1
c3e7a9ccc9805ae94aabfd16e2cb461fde3fae5a

SHA256
76ee7c489d11427af94d0334368ef2ed44df4a74984ffd4022c9ea9fae9c41fb

SHA512
0fb3a29367fa3c3eb36c6a7e9ff217ccdd7cce18309964aa7068a00f500ea4ea49588344ebbc52ae77d83e5042c3fdb84f56fa1dae07b8bb774aed6fffd18c0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
701B

MD5
e427a32326a6a806e7b7b4fdbbe0ed4c

SHA1
b10626953332aeb7c524f2a29f47ca8b0bee38b1

SHA256
b5cfd1100679c495202229aede417b8a385405cb9d467d2d89b936fc99245839

SHA512
6bd679341bec6b224962f3d0d229cff2d400e568e10b7764eb4e0903c66819a8fa99927249ab9b4c447b2d09ea0d98eb9823fb2c5f7462112036049795a5d8bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
703B

MD5
e2564fc59a86ea85b7485ab7288c68c4

SHA1
bc1544d9a03d1adafe399067ac32bf8d1cedbdb0

SHA256
68e8d8ef14bfbe96ebad3fb391fd4c1e57068a7f950dd31840884f6d58b078a8

SHA512
e09c6741d99ec41763e939aa39adb4e0f8508d37556c52251eec268849e85960da42ace7e9b82f1927de5bcf29ebec205189b113d2bb123025f3e6615b28ff0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
2KB

MD5
f82bc8865c1f6bf7125563479421f95c

SHA1
65c25d7af3ab1f29ef2ef1fdc67378ac9c82098d

SHA256
f9799dc2afb8128d1925b69fdef1d641f312ed41254dd5f4ac543cf50648a2f6

SHA512
00a9b7798a630779dc30296c3d0fed2589e7e86d6941f4502ea301c5bce2e80a5d8a4916e36183c7064f968b539ae6dac49094b1de3643a1a2fedc83cf558825

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
558e454bc2d99d7949719cf24f540dd2

SHA1
e9c772bcee4ae780cdc28b0b4876385639e59b39

SHA256
677ec2cfe2ae99352aa12ac658d01a7bb0b51cf3cd2c568e94a78754326ca43a

SHA512
5bb10dcf81ccab0b7e2274d3ccdbda5a38014576096fef71725cfa6e16a4bfd29f481f3bc5ad15426fb9918eeca67fff11291a88caf10974433214674c1c1b64

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
784B

MD5
5a466127fedf6dbcd99adc917bd74581

SHA1
a2e60b101c8789b59360d95a64ec07d0723c4d38

SHA256
8cd3b8dd28ac014cf973d9ab4b03af1c274bbc9b5ee0ee4ab8af0bdb01573b84

SHA512
695cafc932bc8f0a514bc515860cb275297665de63ca3394b55f42c457761ebf654d29d504674681a77b34e3356a469e8c5b97ff7efc24de330d5375f025cba5

Download Submit
C:\Windows\SysWOW64\cPaner.com

Filesize
228KB

MD5
4dd70453aa7a3d53d0b0188fb4c798fb

SHA1
e92ba1890868b76f0afcdd35c43ece3475f728ad

SHA256
d7c6608fb7db4ccfb0aaa49322534e412147c41a14ce1e3c32285982952cc9aa

SHA512
47023aad87a0ae65a7bded7d95a78ec92e658a87363515c99efb5293de5993689fc261f14c8147e3564529720443619aedba3ffcb4c4e67827d7ebf86cdb9ed4

Download Submit
\??\c:\acx.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
memory/416-982-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/416-1095-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1656-640-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1656-527-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2032-413-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2032-299-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2032-526-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2172-869-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2172-981-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2376-158-0x0000000003340000-0x0000000003341000-memory.dmp

Filesize
4KB

Download
memory/2376-171-0x00000000033B0000-0x00000000033B1000-memory.dmp

Filesize
4KB

Download
memory/2376-24-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/2376-23-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/2376-22-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/2376-21-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/2376-20-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/2376-19-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/2376-18-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/2376-16-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/2376-15-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/2376-14-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/2376-13-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/2376-12-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/2376-11-0x00000000021D0000-0x00000000021D1000-memory.dmp

Filesize
4KB

Download
memory/2376-10-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/2376-9-0x0000000002200000-0x0000000002201000-memory.dmp

Filesize
4KB

Download
memory/2376-8-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/2376-7-0x00000000021F0000-0x00000000021F4000-memory.dmp

Filesize
16KB

Download
memory/2376-6-0x00000000021B0000-0x00000000021B1000-memory.dmp

Filesize
4KB

Download
memory/2376-5-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/2376-4-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/2376-152-0x00000000032E0000-0x00000000032E1000-memory.dmp

Filesize
4KB

Download
memory/2376-154-0x0000000003300000-0x0000000003301000-memory.dmp

Filesize
4KB

Download
memory/2376-161-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/2376-160-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/2376-159-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/2376-33-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/2376-157-0x0000000003310000-0x0000000003311000-memory.dmp

Filesize
4KB

Download
memory/2376-156-0x0000000003320000-0x0000000003321000-memory.dmp

Filesize
4KB

Download
memory/2376-155-0x00000000032F0000-0x00000000032F1000-memory.dmp

Filesize
4KB

Download
memory/2376-153-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/2376-169-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/2376-35-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/2376-177-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2376-166-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/2376-176-0x0000000003420000-0x0000000003421000-memory.dmp

Filesize
4KB

Download
memory/2376-175-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/2376-174-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/2376-173-0x00000000033D0000-0x00000000033D1000-memory.dmp

Filesize
4KB

Download
memory/2376-172-0x00000000033E0000-0x00000000033E1000-memory.dmp

Filesize
4KB

Download
memory/2376-25-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/2376-0-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2376-1-0x0000000000630000-0x0000000000674000-memory.dmp

Filesize
272KB

Download
memory/2376-170-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/2376-168-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/2376-167-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/2376-3-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download
memory/2376-17-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/2376-36-0x00000000025E0000-0x00000000025E1000-memory.dmp

Filesize
4KB

Download
memory/2376-37-0x00000000025D0000-0x00000000025D1000-memory.dmp

Filesize
4KB

Download
memory/2376-38-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/2376-295-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2376-296-0x0000000000630000-0x0000000000674000-memory.dmp

Filesize
272KB

Download
memory/2376-32-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/2376-39-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download
memory/2376-40-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/2376-31-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/2376-30-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/2376-41-0x0000000002610000-0x0000000002611000-memory.dmp

Filesize
4KB

Download
memory/2376-42-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/2376-43-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download
memory/2376-26-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/2376-27-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/2376-28-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/2376-29-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/3024-184-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/3024-180-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3024-181-0x0000000000950000-0x0000000000994000-memory.dmp

Filesize
272KB

Download
memory/3024-412-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3024-411-0x0000000000950000-0x0000000000994000-memory.dmp

Filesize
272KB

Download
memory/3024-183-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/3024-297-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3476-1096-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3476-1209-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3504-868-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3504-755-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3508-1210-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3508-1323-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3528-1324-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4284-753-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4284-641-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads