cybergate | 739a0d6f8efd94a3415328dd74a29d56d0675d8e4a9b8f24e2e6a843b016b07a

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
18/07/2024, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
Size 356KB
Sample240718-pdkyhs1dpe
SHA256 739a0d6f8efd94a3415328dd74a29d56d0675d8e4a9b8f24e2e6a843b016b07a
MD5 5754af2582039d09a3086de73a19ad06
SHA1 8d9f1377ea7210acefc32c0f4442a5d74cbb856a
SHA512 1aff3f26cd51841ca3cb57b659bcf09ab44a7fa118794fd12eb3290e0cae6ffcfee66859f3bf8e18c9411534fe847e7bdd7f1a26ab880fce8b89420a31d4740c
SSDEEP 6144:2cl5tFUojgzcu8LE9uHJmHlT72acZd3A8SeTYeAwUUfyK8NDk37OnWA:hfpgB8L+uAFT7Iz3vSeTYeJR3Ck3lA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cybergate vítima persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

Botnet

vítima

yotshi.no-ip.biz:81

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
msnmsg
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3520 created 1188	3520	WerFault.exe	95

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\msnmsg\\server.exe"	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\msnmsg\\server.exe"	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\Windows\\system32\\msnmsg\\server.exe Restart"	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\Windows\\system32\\msnmsg\\server.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
3320	server.exe
4048	server.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/856-3-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/856-6-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/856-8-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/856-9-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/856-12-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/856-13-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/856-16-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/1908-78-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/856-150-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/2740-151-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/4048-521-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/4048-661-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/1908-1367-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/2740-1822-0x0000000024160000-0x00000000241C2000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\msnmsg\\server.exe"	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\msnmsg\\server.exe"	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msnmsg\server.exe	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msnmsg\server.exe	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msnmsg\server.exe	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msnmsg\	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msnmsg\server.exe	server.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 652 set thread context of 856	652	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	84
PID 3320 set thread context of 4048	3320	server.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1188	4048	WerFault.exe	92
1520	1188	WerFault.exe	95

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
1520	WerFault.exe
1520	WerFault.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
Token: SeDebugPrivilege	2740	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
652	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
3320	server.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 856	652	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	84
PID 652 wrote to memory of 856	652	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	84
PID 652 wrote to memory of 856	652	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	84
PID 652 wrote to memory of 856	652	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	84
PID 652 wrote to memory of 856	652	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	84
PID 652 wrote to memory of 856	652	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	84
PID 652 wrote to memory of 856	652	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	84
PID 652 wrote to memory of 856	652	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	84
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56
PID 856 wrote to memory of 3448	856	5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe	56

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:588
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:808
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:60

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:788
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:2944
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3780
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3864
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3928
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:4016
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3600
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:3552
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4808
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:3564
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:2716
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:760
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4176
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:764
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4852
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
  2⤵
  PID:3788
- C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
  C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
  2⤵
  PID:396
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  2⤵
  PID:3968
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:2560
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:2384
- C:\Windows\system32\BackgroundTransferHost.exe
  "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
  2⤵
  PID:2552
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:2752
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  2⤵
  PID:4712
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:3136
- C:\Windows\system32\BackgroundTaskHost.exe
  "C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
  2⤵
  PID:3504
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:2732

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1136
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3140

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1436
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:1044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1756

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:2032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1472

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2088

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2152

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2432

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2576

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3388

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3448
- C:\Users\Admin\AppData\Local\Temp\5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:652
- - C:\Users\Admin\AppData\Local\Temp\5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
    3⤵
    - Adds policy Run key to start application
    - Boot or Logon Autostart Execution: Active Setup
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:856
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      PID:1908
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:1372
  - - C:\Users\Admin\AppData\Local\Temp\5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\5754af2582039d09a3086de73a19ad06_JaffaCakes118.exe"
      4⤵
      Checks computer location settings
      Drops file in System32 directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:2740
    - - C:\Windows\SysWOW64\msnmsg\server.exe
        
        "C:\Windows\system32\msnmsg\server.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3320
      - C:\Windows\SysWOW64\msnmsg\server.exe
        
        C:\Windows\SysWOW64\msnmsg\server.exe
        6⤵
        Executes dropped EXE
        
        PID:4048
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 564
        7⤵
        Program crash
        
        PID:1188
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 664
        8⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        
        PID:1520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2340

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2144

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:2916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4048 -ip 4048
  2⤵
  PID:624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1188 -ip 1188
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:3520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1520 -ip 1520
  2⤵
  PID:3648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1520 -ip 1520
  2⤵
  PID:3952

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 79f04437f5f0ff2799b1b95ac66e8f43 PzpDXDvfNkqxeaNb3hhXlQ.0.1.0.0.0
1⤵
PID:2516
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:2348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:2792

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:2428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:4528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XX--XX--XX.txt

Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Size 240KB
SHA256 545ace069325cff308e60716ea567c929874fa95bd51196bcf80ebf61a822ce3
MD5 deacbcd8712f7aebf5188571598a646b
SHA1 2630cc5e999c6751db85d6d5fb2ea57dd2a9227c
SHA512 a3255778907ae652d21260fa945ab8bc3c0492d9b3388440112ed1f70c892aed4b8b38a6142d6271feae2ce660ad2b9f610e7f2b797740e1885f525ed3068524
SSDEEP 3072:ofMP5JuXLFG3Oa95BrKUqEQ94jhc3PQuPe2D2ue3NXR0jW/UCFnp7HBIJJyCwFiQ:R5JGmrpQsK3RD2u270jupCJsCxCT
MD5 SHA1 SHA512 SSDEEP

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 98a6270608777132af4d809f9c9ef3aed06ee5fba4c4f2cdc461507a94c46f1a
MD5 5d75ae6eed6bfe26e9ea91a70d47e07f
SHA1 c46de46e7361fd7204bdf054c94549eea8a34b74
SHA512 af52f670749fe4d8c40575273f4d78330c0bdf8e7367a3a7f3d4a5b554077becf6ef04a39ba20ed7d8d4a71ef03d47f97ed3300d23275ce06df51ecb49e9fef4
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 19a30fd2ec37846e3e8ee2135d271d4e15a5453163436877cdcd078daab1740a
MD5 448f31dde1bc3fb3a2c430cb76708c1d
SHA1 5b4d113330bb4aed88fe587b044eb1c5613ee0aa
SHA512 7a5e52b744a9fad77058813f0b68cc069b110a6323c058bb7b20e7075e09266dfa6713ac2d30b3671b29387ca850d4570dfe046e7914df56c48c11ea9cdf507c
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 eef71143ec57d3848eeaa0eccca5a372465ae52f926105861bcafc669e52422a
MD5 6606b8f4328d0416c89908713b163148
SHA1 ec7d4273adad08f87d41a44fa38fb1972eb43eaa
SHA512 da91a9ee72d296997dcd55736a8d8d83b3b5039552e3343ca31fe77d84a9bd68ba054601776d8efe88dad5725f9c249d5db7dbacab5ec62f208f8faa31121c58
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 8676c5486da729bc7d65875c10c5648588fecaf199240f7613e4a2ccfc0af031
MD5 504f3e96b09e78534dca2597e9bcf8f3
SHA1 06233c46ff5ba37b05a8a4d4e8c4da4bf22a0513
SHA512 39763cbdab1b47bb5d71637b029898a1dd16d230b3cce4ed8cde289ae733b6d201f135c53ab092bcd2c5a5ca8c66f64cc1cfbf47cacf91a3eb162ac9d6f51b4a
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 d97d6a5d86a752a1a5a6baef6319e292ec3bea2199ba69a9a929aa8aee31121a
MD5 9bb7ac51fa3614b0ee9d54544716b50d
SHA1 7586fc2faf3d4209c1f4eab9bdb210b5517e571f
SHA512 a7a90776f99108981902c1a3d10417b590079a8c05e3b2c0d2b83f356ec6a162cf0b5f01c203eb6ddb13cc3bac3f31ed381e7e61b5b141986c7eb0b6990765f5
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 e4c82afcbf8dd9fa2711dc238ebfa3e9695e872542ee3a971c178ad70591ab70
MD5 67c54bd243d1c0446e0dfd9f72c32091
SHA1 81a74a708d748178647986c6131fa06dbe7bbe61
SHA512 5043375d732181281be0fcef92f62f3f029f963f70240fb3f5525449b662a5b7201b89b852132fcb08736b9c68896ad1702bfb2eff63740c53b21335cfe38f6f
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 c5990c2b13e3c5977d7c71a5831d9074e7b174f84463ea864c1ddbb70b61f229
MD5 eda5c5d1dd42481f1a7201369e438b5b
SHA1 d5a2b28eef17a0efc27ffd41ab468f6ec924a0ab
SHA512 4a29878d4931784d008b6897fe7be6e1ba46512a6eb56e48b46502d423216d4da436ec88da3ca199fc9d9c8305dd46e591d5283c37a4eab670e749e6c67bf207
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 c49a2015d82764444c06506f330e0d8195b3344cd5bb4917fa1c68194fce775a
MD5 7b7a772f40ed69900ca1e64e68b171cf
SHA1 8925f54a271385a947307057bab8359b3928f700
SHA512 059bc22dae4a52b021680d08882f76aeb8cd1103eab6b5f0072080b77fa2946600fd9911159db6cf42bfcdb4e6dffe2f68b0245791ae4eb3fa64d8fcba0e074e
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 bd813514cd4b2281f205970cd8981cecd8bfd88d256d66160e238ae80f4b750b
MD5 473b7cc5ae8f1e98bdd2fa940ee42e22
SHA1 5e1f4a88c6d0e8e253e5489419a16278d8ca2a43
SHA512 d232f5c14884d87bebd975a8be72fd30d39c22cec927992c793b14990ed3b74eb2e5775f90e30092c2d711ba2263b1c3fe07b55da9cc8dadf2910c16593df3d6
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 f5a44d157214c89199d90bff6cc534cf6ef945915012cd95932e30fde727381d
MD5 7f14289e49a551d5adb668f87cd6c5e8
SHA1 841a2c441cad5d95233f11d8b8d87e8662fe82a1
SHA512 7989e8ea7e7370ba0ad23677f69155adf9b7b7cb2c353743832a950735a20574e146d4528f2ca8fed0a94178c73bfa722806c404059c6bc9b4a173fdb1ca6e8c
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 cfa934ce122f8c180ed322d0a226ce350357d4974629db84b7213810609ebf28
MD5 e5f4ade4ba175ac21642bcd3fdbdd288
SHA1 8f86c4cfa95c5b6724634e81379abc554a8534f4
SHA512 69ed0edf232882a0c10a080435d48564dc5bba462e554672b0806d518b6604f9e06c85c853649d83df93c1d7a5e16c4477781ec6904adc5c06f1c4e53fb2b8ea
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 3b17cf794307604e8d5f2e377f52df3111ec9be35fe20c2a36b2b77f783b8ba7
MD5 d97ae60464a2106907753d2574433abb
SHA1 3b844b7e20390d6a3b5d3763d667f6732f650bae
SHA512 dfc919223b14a7aaf6d19e7b407a87100221f2125682f362df567dbabfcdfb203610108252bda738c08a5c796364e6a2b54ff5052df2ebb8610167690f2f3a12
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 b4b5c062bdf33dccbea1dda4c269cb676547aaa81f176cc553f4861013c63820
MD5 6cd658f886abf15fb8340ca53d49ccf6
SHA1 e27af115dd88ea18d2b2bdf31d24d1459971e936
SHA512 f00db00b1e3afa6a1fee26bd472c9b5a86c2e441a3667dcf858d7461e2c18a1f084bd0bbd0bd14621c94482c709011130e6c9440b7934b2cb1de2f019c13ba76
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 972db9841c8d0c50c25a3a0d47d7f7e47ffcd03d5712814bd78d26a5a60024f3
MD5 9a94cdd2acd76807e5b3b91e47265fec
SHA1 050be91dd0d4b2b780a29891881ebbffd2f69921
SHA512 d1a51c7c5eb8f21cdecdd843e297130f816561a15c229650ce94c78f50f2be55bdccfe947f269078ed0b8a3a64c35fad5521fe721ac21f7d3f1e56d3b07a6271
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 ddc3d9c0da0e25054c25736cad5fca60930002667051139114ccc6de410718a6
MD5 ddae955f82e752728cbc2b4a49f193be
SHA1 e4712abf03c94df622f221891cc2a17692d7f21e
SHA512 df376824bf24ab92e05288d9005106fdd8c852f6cc23fae3b28d6dc45d1ffc2d51868ef36525bc7b95e3a25e6b9b37806c63ecde437a34fc0cf95006d3319c9c
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 bad3bd27806862334e9d99f5b0506a9abe21c2fd486eacfd9d806c04c8dba079
MD5 bbc3bb59fff159021615ebf34bd94fb1
SHA1 0479b106b084e5484f1ed77aeab17557137374b0
SHA512 28637d1312a874939953d7925cc03602c6579fd583c8fbef483c4b3e2d70030ad1e13689c4d74a2c21afee125be96c0f9c8a153909ee6cd6d236644e0629aab0
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 15c0290bf5241391a58fd0b2cda5b662107a460fa92590c94885d6a6cc993a75
MD5 161c6532040e13d957d3a8312592933f
SHA1 5aa8f3dff7e7e368cc64ca92ad7744151680c355
SHA512 3804388d0aa34815e8c68262ce39f67ca50ccf602e3917cfcfce56551d990490eb775b58f1e7a715cc53105aa4f202f0ec0cd6b0a76081dbf6ad43e6fe48cdbd
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 45ba72c3822a37cd4d734a8539fc857a827ab5461ae7531042f3e97c82a2417d
MD5 f8b4d6bcd554d8aa7564d3ccf45a6657
SHA1 67ff14492ba851e13ecfca0f8622a22a90b48423
SHA512 858a361edd29e03f11fcbd7c8375db6ee53c12c5c7a540c74b52faad67224be64c2e354d017243518de2a631b98464e370611700a2babbbfe6bea9297c59231d
MD5 SHA1 SHA512

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\logs.dat
Size 15B
SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
MD5 e21bd9604efe8ee9b59dc7605b927a2a
SHA1 3240ecc5ee459214344a1baac5c2a74046491104
SHA512 42052ad5744ad76494bfa71d78578e545a3b39bfed4c4232592987bd28064b6366a423084f1193d137493c9b13d9ae1faac4cf9cc75eb715542fa56e13ca1493
MD5 SHA1 SHA512

Submit Download

server.exe

Path C:\Windows\SysWOW64\msnmsg\server.exe
Size 356KB
SHA256 739a0d6f8efd94a3415328dd74a29d56d0675d8e4a9b8f24e2e6a843b016b07a
MD5 5754af2582039d09a3086de73a19ad06
SHA1 8d9f1377ea7210acefc32c0f4442a5d74cbb856a
SHA512 1aff3f26cd51841ca3cb57b659bcf09ab44a7fa118794fd12eb3290e0cae6ffcfee66859f3bf8e18c9411534fe847e7bdd7f1a26ab880fce8b89420a31d4740c
SSDEEP 6144:2cl5tFUojgzcu8LE9uHJmHlT72acZd3A8SeTYeAwUUfyK8NDk37OnWA:hfpgB8L+uAFT7Iz3vSeTYeJR3Ck3lA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/652-0-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/652-7-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/856-13-0x0000000024010000-0x0000000024072000-memory.dmp

Download

memory/856-150-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/856-16-0x0000000024080000-0x00000000240E2000-memory.dmp

Download

memory/856-12-0x0000000024010000-0x0000000024072000-memory.dmp

Download

memory/856-9-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/856-8-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/856-6-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/856-3-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/1908-1367-0x0000000024080000-0x00000000240E2000-memory.dmp

Download

memory/1908-78-0x0000000024080000-0x00000000240E2000-memory.dmp

Download

memory/1908-18-0x0000000000520000-0x0000000000521000-memory.dmp

Download

memory/1908-17-0x0000000000460000-0x0000000000461000-memory.dmp

Download

memory/2740-1822-0x0000000024160000-0x00000000241C2000-memory.dmp

Download

memory/2740-151-0x0000000024160000-0x00000000241C2000-memory.dmp

Download

memory/4048-661-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/4048-521-0x0000000000400000-0x0000000000459000-memory.dmp

Download