Overview

overview

10

Static

static

10

580432b487...18.exe

windows10-1703-x64

10

Resubmissions

19/07/2024, 03:44

240719-eavnfa1dpn10

18/07/2024, 15:38

240718-s3epksyblc10

Analysis

  • max time kernel
    69s
  • max time network
    68s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    19/07/2024, 03:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    580432b487a577e230e77560da74d217_JaffaCakes118.exe
  • Size 6.3MB
  • Sample240719-eavnfa1dpn
  • SHA256 8ddc17f683f0dfa09484fb7574c8fecf3363801f7ad47bc55a8160044bfb17d5
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
neshtaxtremeratpersistenceratspywarestealerupx

Malware Config

Extracted

Family

  • xtremerat

C2

  • zocks.zapto.org

Signatures

  • Detect Neshta payload 57 IoCs
  • Detect XtremeRAT payload 7 IoCs
  • Modifies WinLogon for persistence 2 TTPs 4 IoCs
    persistence
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat
  • Adds policy Run key to start application 2 TTPs 8 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops file in Drivers directory 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 11 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 26 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 16 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 44 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\580432b487a577e230e77560da74d217_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\580432b487a577e230e77560da74d217_JaffaCakes118.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2948
    • C:\Users\Admin\AppData\Local\Temp\3582-490\580432b487a577e230e77560da74d217_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\580432b487a577e230e77560da74d217_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1264
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Roaming\MULTIH~1.EXE"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4612
        • C:\Users\Admin\AppData\Roaming\MULTIH~1.EXE
          C:\Users\Admin\AppData\Roaming\MULTIH~1.EXE
          4⤵
          • Modifies WinLogon for persistence
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:3736
          • C:\Windows\SysWOW64\svchost.exe
            svchost.exe
            5⤵
            • Modifies WinLogon for persistence
            • Adds policy Run key to start application
            • Boot or Logon Autostart Execution: Active Setup
            • Adds Run key to start application
            PID:5116
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            5⤵
              PID:2244
            • C:\Windows\SysWOW64\explorer.exe
              explorer.exe
              5⤵
                PID:772
              • C:\Windows\SysWOW64\explorer.exe
                explorer.exe
                5⤵
                • Suspicious use of SetWindowsHookEx
                PID:704
          • C:\Windows\svchost.com
            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Roaming\procexp.exe"
            3⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:3112
            • C:\Users\Admin\AppData\Roaming\procexp.exe
              C:\Users\Admin\AppData\Roaming\procexp.exe
              4⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1648
              • C:\Users\Admin\AppData\Roaming\procexp64.exe
                C:\Users\Admin\AppData\Roaming\procexp.exe
                5⤵
                • Drops file in Drivers directory
                • Sets service image path in registry
                • Executes dropped EXE
                • Enumerates connected drives
                • Checks system information in the registry
                • Checks SCSI registry key(s)
                • Checks processor information in registry
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious behavior: LoadsDriver
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                PID:4936
      • \??\c:\windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2628
        • C:\Windows\explorer.exe
          explorer.exe /LOADSAVEDWINDOWS
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2312
          • C:\Windows\svchost.com
            "C:\Windows\svchost.com" "C:\Windows\explorer\exple.exe" restart
            3⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:4208
            • C:\Windows\explorer\exple.exe
              C:\Windows\explorer\exple.exe restart
              4⤵
              • Executes dropped EXE
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:3128
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Windows\explorer\exple.exe"
                5⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:1972
                • C:\Windows\explorer\exple.exe
                  C:\Windows\explorer\exple.exe
                  6⤵
                  • Executes dropped EXE
                  PID:2712
          • C:\Windows\svchost.com
            "C:\Windows\svchost.com" "C:\Users\Admin\Desktop\STARTI~1.EXE"
            3⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:4040
      • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
        1⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:408
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:3240

      Network

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Persistence

            Boot or Logon Autostart Execution

            5
            T1547

            Active Setup

            1
            T1547.014

            Registry Run Keys / Startup Folder

            3
            T1547.001

            Winlogon Helper DLL

            1
            T1547.004

            Event Triggered Execution

            1
            T1546

            Change Default File Association

            1
            T1546.001

            Privilege Escalation

            Boot or Logon Autostart Execution

            5
            T1547

            Active Setup

            1
            T1547.014

            Registry Run Keys / Startup Folder

            3
            T1547.001

            Winlogon Helper DLL

            1
            T1547.004

            Event Triggered Execution

            1
            T1546

            Change Default File Association

            1
            T1546.001

            Defense Evasion

            Modify Registry

            7
            T1112

            Credential Access

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Peripheral Device Discovery

            2
            T1120

            Query Registry

            5
            T1012

            System Information Discovery

            6
            T1082

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            ACROBR~1.EXE
            • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
            • Size 328KB
            • SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ACROTE~1.EXE
            • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
            • Size 86KB
            • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ADOBEC~1.EXE
            • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
            • Size 5.7MB
            • SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ADelRCP.exe
            • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
            • Size 175KB
            • SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            RdrCEF.exe
            • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
            • Size 9.4MB
            • SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AcroRd32.exe
            • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
            • Size 2.4MB
            • SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            WCCHRO~1.EXE
            • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
            • Size 183KB
            • SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Eula.exe
            • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
            • Size 131KB
            • SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            FULLTR~1.EXE
            • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
            • Size 254KB
            • SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            LOGTRA~1.EXE
            • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
            • Size 386KB
            • SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            READER~1.EXE
            • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
            • Size 92KB
            • SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            WOW_HE~1.EXE
            • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE
            • Size 147KB
            • SHA256 750824b5f75c91a6c2eeb8c5e60ae28d7a81e323d3762c8652255bfea5cba0bb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            arh.exe
            • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
            • Size 125KB
            • SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            32BITM~1.EXE
            • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
            • Size 142KB
            • SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            64BITM~1.EXE
            • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
            • Size 278KB
            • SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ADOBEA~1.EXE
            • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
            • Size 454KB
            • SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AdobeARM.exe
            • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
            • Size 1.2MB
            • SHA256 b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jaureg.exe
            • Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
            • Size 555KB
            • SHA256 c5a99f42100834599e4995d0a178b32b772a6e774a4050a6bb00438af0a6a1f3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jucheck.exe
            • Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe
            • Size 1.2MB
            • SHA256 ade1db79870327538841d5470483c6474083f08d871bb7d56cfc9e76971c8640
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jusched.exe
            • Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe
            • Size 771KB
            • SHA256 adc7b8fc26491206149496e2bceaf3686424274f444f14e2dd6fbf2ac7423ddf
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSTOIN~1.EXE
            • Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
            • Size 121KB
            • SHA256 405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java.exe
            • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
            • Size 325KB
            • SHA256 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaw.exe
            • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
            • Size 325KB
            • SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaws.exe
            • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
            • Size 505KB
            • SHA256 da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            GO664E~1.EXE
            • Path C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE
            • Size 155KB
            • SHA256 8ee4aa23eb92c4aba9a46b18ac249a5fa11c5abb7e2c1ca82cd5196401db790a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            GOBD5D~1.EXE
            • Path C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE
            • Size 230KB
            • SHA256 6ce92587a138ec07dac387a294d0bbe8ab629599d1a2868d2afaccea3b245d67
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            GOF5E2~1.EXE
            • Path C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE
            • Size 155KB
            • SHA256 fc379fda348644fef660a3796861c122aa2dd5498e80279d1279a7ddb259e899
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            GOOGLE~2.EXE
            • Path C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE
            • Size 265KB
            • SHA256 8bbe59987228dd9ab297f9ea34143ea1e926bfb19f3d81c2904ab877f31e1217
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            GOOGLE~3.EXE
            • Path C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE
            • Size 342KB
            • SHA256 531e735e4e8940dfe21e30be0d4179ceaecb57ce431cf63c5044e07048ac1751
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            GOOGLE~4.EXE
            • Path C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE
            • Size 439KB
            • SHA256 cb5c5abb625a812d47007c75e3855be3f29da527a41cf03730ad5c81f3eb629a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            DISABL~1.EXE
            • Path C:\PROGRA~2\Google\Update\DISABL~1.EXE
            • Size 207KB
            • SHA256 57c993cadf4bf84810cea23a7112c6e260624beaab48d0e4332d3462900fec1d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MAINTE~1.EXE
            • Path C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE
            • Size 267KB
            • SHA256 8751c43ee0f3f0e080103a9b77be9e79346004769ed43d4cadd630ea15d26dcf
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            UNINST~1.EXE
            • Path C:\PROGRA~2\MOZILL~1\UNINST~1.EXE
            • Size 141KB
            • SHA256 8270ecef6079a21f5ae22f1a473e5eb8abac51628367f4acf6466529ba11d7e2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            setup.exe
            • Path C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe
            • Size 494KB
            • SHA256 7b945c7e6b8bfbb489f003ecd1d0dcd4803042003de4646d4206114361a0fbbb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            INTEGR~1.EXE
            • Path C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE
            • Size 6.7MB
            • SHA256 7d607fb69c69a72a5bf4305599279f46318312ce1082b6a34ac9100b8c7762ce
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VCREDI~1.EXE
            • Path C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE
            • Size 485KB
            • SHA256 8c35dcc975a5c7c687686a3970306452476d17a89787bc5bd3bf21b9de0d36a5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VC_RED~1.EXE
            • Path C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE
            • Size 674KB
            • SHA256 c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VC_RED~1.EXE
            • Path C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE
            • Size 674KB
            • SHA256 ccf37e88447a7afdb0ba4351b8c5606dbb05b984fb133194d71bcc00d7be4e36
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VCREDI~1.EXE
            • Path C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE
            • Size 495KB
            • SHA256 45966655baaed42df92cd6d8094b4172c0e7a0320528b59cf63fca7c25d66e9c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VCREDI~1.EXE
            • Path C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE
            • Size 485KB
            • SHA256 8d0045c74270281c705009d49441167c8a51ac70b720f84ff941b39fad220919
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VCREDI~1.EXE
            • Path C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE
            • Size 495KB
            • SHA256 d882f673ddf40a7ea6d89ce25e4ee55d94a5ef0b5403aa8d86656fd960d0e4ac
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            FILECO~1.EXE
            • Path C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\181510~1.001\FILECO~1.EXE
            • Size 499KB
            • SHA256 a811042693bc2b31be7e3f454b12312f67bc97f2b15335a97e8d8f2ba0a6b255
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            FILESY~1.EXE
            • Path C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\181510~1.001\FILESY~1.EXE
            • Size 293KB
            • SHA256 d2767c9c52835f19f6695c604081bf03cdd772a3731cd2e320d9db5e477d8af7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ONEDRI~1.EXE
            • Path C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\ONEDRI~1.EXE
            • Size 2.4MB
            • SHA256 8c6f9493c2045bb7c08630cf3709a63e221001f04289b311efb259de3eb76bce
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OneDrive.exe
            • Path C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\OneDrive.exe
            • Size 1.6MB
            • SHA256 0a023355d1cc0a2348475d63aaf6aa0521d11e12a5c70102d7b3ebde092849e8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            580432b487a577e230e77560da74d217_JaffaCakes118.exe
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\580432b487a577e230e77560da74d217_JaffaCakes118.exe
            • Size 6.3MB
            • SHA256 acc6d1f743c0bb790544722917a9644cdb423d01824b333f0472d553dc6fb930
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            tmp5023.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\tmp5023.tmp
            • Size 8B
            • SHA256 4884d4670da2d29cbd8724c624d9e0671c3e14737c5fe24dc3cc7273d7909efc
            • MD5 SHA1 SHA512
            Submit Download

            MULTIH~1.EXE
            • Path C:\Users\Admin\AppData\Roaming\MULTIH~1.EXE
            • Size 21KB
            • SHA256 94e0389f3f57d91e14b14780be168dea73e10c7050325d746ea7bfd55a8d9de7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            procexp.exe
            • Path C:\Users\Admin\AppData\Roaming\procexp.exe
            • Size 4.6MB
            • SHA256 a1f21763e1d35901d0414328a5d22dde114c3e2edae6d3c372661616d3db43b5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            procexp64.exe
            • Path C:\Users\Admin\AppData\Roaming\procexp64.exe
            • Size 1.0MB
            • SHA256 b007c53f91dbd95f2c0697e05d5d74f0695a631fd7495bc651b511ce2a4c3670
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            directx.sys
            • Path C:\Windows\directx.sys
            • Size 75B
            • SHA256 4b62d49e758c7de8aea8b032edce542e83187b3ea4ebef4045af1d1687157014
            • MD5 SHA1 SHA512
            Submit Download

            directx.sys
            • Path C:\Windows\directx.sys
            • Size 44B
            • SHA256 e77bcf666868ef7076436ee7f8c88b79a76c2833038c07718314c76cf1fadca9
            • MD5 SHA1 SHA512
            Submit Download

            svchost.com
            • Path C:\Windows\svchost.com
            • Size 40KB
            • SHA256 8ebca7c83579a9474d359800de175f7fb5b83aa10a845305a262001346639c79
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/408-195-0x0000029A40EE0000-0x0000029A40F00000-memory.dmp
            Download

            memory/408-219-0x0000029A412A0000-0x0000029A412C0000-memory.dmp
            Download

            memory/408-189-0x0000029A40A20000-0x0000029A40B20000-memory.dmp
            Download

            memory/704-117-0x0000000000C80000-0x0000000000C96000-memory.dmp
            Download

            memory/704-91-0x0000000000C80000-0x0000000000C96000-memory.dmp
            Download

            memory/1264-46-0x00007FFEBBF70000-0x00007FFEBC95C000-memory.dmp
            Download

            memory/1264-8-0x00007FFEBBF70000-0x00007FFEBC95C000-memory.dmp
            Download

            memory/1264-7-0x00007FFEBBF73000-0x00007FFEBBF74000-memory.dmp
            Download

            memory/1264-6-0x0000000000640000-0x000000000066E000-memory.dmp
            Download

            memory/1972-187-0x0000000000400000-0x000000000041B000-memory.dmp
            Download

            memory/2312-194-0x0000000004AB0000-0x0000000004AB1000-memory.dmp
            Download

            memory/2712-186-0x0000000000C80000-0x0000000000C96000-memory.dmp
            Download

            memory/2712-182-0x0000000000C80000-0x0000000000C96000-memory.dmp
            Download

            memory/2948-160-0x0000000000400000-0x000000000041B000-memory.dmp
            Download

            memory/2948-150-0x0000000000400000-0x000000000041B000-memory.dmp
            Download

            memory/2948-155-0x0000000000400000-0x000000000041B000-memory.dmp
            Download

            memory/3112-163-0x0000000000400000-0x000000000041B000-memory.dmp
            Download

            memory/3112-152-0x0000000000400000-0x000000000041B000-memory.dmp
            Download

            memory/3128-172-0x0000000000C80000-0x0000000000C96000-memory.dmp
            Download

            memory/3128-176-0x0000000000C80000-0x0000000000C96000-memory.dmp
            Download

            memory/3736-101-0x0000000000C80000-0x0000000000C96000-memory.dmp
            Download

            memory/3736-43-0x0000000000C80000-0x0000000000C96000-memory.dmp
            Download

            memory/4040-258-0x0000000000400000-0x000000000041B000-memory.dmp
            Download

            memory/4208-174-0x0000000000400000-0x000000000041B000-memory.dmp
            Download

            memory/4612-156-0x0000000000400000-0x000000000041B000-memory.dmp
            Download

            memory/4612-151-0x0000000000400000-0x000000000041B000-memory.dmp
            Download

            memory/4612-159-0x0000000000400000-0x000000000041B000-memory.dmp
            Download

            memory/5116-50-0x0000000000C80000-0x0000000000C96000-memory.dmp
            Download