Analysis
- max time kernel
144s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
19/07/2024, 14:04
Behavioral task
behavioral1
Sample
5c40c877bab790968d447e42dce108d0_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
5c40c877bab790968d447e42dce108d0_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
23 signatures
150 seconds
General
- Target 5c40c877bab790968d447e42dce108d0_JaffaCakes118.exe
- Size 503KB
- Sample240719-rdht9svdmn
- SHA256 5b2fff916a8f186c3c0e7f0fa7728a0d7690c5696c1a45e94616cc4728afba99
- MD5 5c40c877bab790968d447e42dce108d0
- SHA1 5e145e58ac116e6806045d4fcbb04cd3786b92a4
- SHA512 97f4fe4183c2302af7944f6c1b7924d4f0323892e33b63ab251f0da611480df9cba14da3bb64ec155142836b3c6230282b5cfd75ab09f60f9954607a1f65a6b5
- SSDEEP 12288:Hikch8g3INv3t/D9huWdh68evA4WLXoULYd4hhq0F6w4gY8K:PMPy3dD956xAzJhtIwBRK
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\lsass.exe" csrss.exe - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 5c40c877bab790968d447e42dce108d0_JaffaCakes118.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 5c40c877bab790968d447e42dce108d0_JaffaCakes118.exe - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\KM_Path = "%SystemRoot%\\system32\\wbem\\cache\\files\\csrss.exe" csrss.exe - Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 3020 attrib.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation csrss.exe - Executes dropped EXE 28 IoCs
pid Process 1396 Tserv.exe 2472 hac.exe 880 hac.exe 1956 hac.exe 2432 wfpr.exe 3968 wfpr.exe 1600 wfpr.exe 816 csrss.exe 1188 lsass.exe 4532 lsass.exe 1840 csrss.exe 3048 lsass.exe 5064 csrss.exe 880 lsass.exe 4940 csrss.exe 4836 lsass.exe 4196 csrss.exe 4928 lsass.exe 2472 csrss.exe 4036 lsass.exe 1484 csrss.exe 1264 lsass.exe 3608 csrss.exe 2352 lsass.exe 1592 csrss.exe 3948 lsass.exe 5064 csrss.exe 1784 lsass.exe - Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power regedit.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc regedit.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys regedit.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager regedit.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc regedit.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys regedit.exe -
resource yara_rule behavioral2/memory/2884-0-0x0000000000400000-0x0000000000506000-memory.dmp upx behavioral2/memory/2884-63-0x0000000000400000-0x0000000000506000-memory.dmp upx behavioral2/files/0x00070000000234cb-127.dat upx - Drops desktop.ini file(s) 4 IoCs
description ioc Process File created C:\desktop.ini csrss.exe File opened for modification C:\desktop.ini csrss.exe File created F:\desktop.ini csrss.exe File opened for modification F:\desktop.ini csrss.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\tmp regedit.exe File created C:\Windows\SysWOW64\wbem\hac.exe Tserv.exe File opened for modification C:\Windows\SysWOW64\wbem\hctabt.dll Tserv.exe File opened for modification C:\Windows\SysWOW64\logo.bmp csrss.exe File created C:\windows\SysWOW64\oeminfo.ini cmd.exe File created C:\Windows\SysWOW64\usmt\csprt.dll cmd.exe File created C:\Windows\SysWOW64\wbem\Batch.bat Tserv.exe File created C:\Windows\SysWOW64\oemlogo.bmp 5c40c877bab790968d447e42dce108d0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\oeminfo.ini csrss.exe File opened for modification C:\Windows\SysWOW64\wbem\Brand.dll Tserv.exe File opened for modification C:\Windows\SysWOW64\wbem\hac.exe Tserv.exe File opened for modification C:\Windows\SysWOW64\wbem\wfpr.exe Tserv.exe File created C:\Windows\SysWOW64\wbem\drvin.dll Tserv.exe File created C:\Windows\SysWOW64\wbem\hctabl.dll Tserv.exe File opened for modification C:\Windows\SysWOW64\wbem\hctabl.dll Tserv.exe File opened for modification C:\Windows\SysWOW64\wbem\lsprt.dll Tserv.exe File opened for modification C:\Windows\SysWOW64\wbem\cache\files\source.ini csrss.exe File created C:\Windows\SysWOW64\wbem\Brand.dll Tserv.exe File opened for modification C:\Windows\SysWOW64\wbem\logob.bmp Tserv.exe File created C:\Windows\SysWOW64\wbem\hac.ini hac.exe File opened for modification C:\Windows\SysWOW64\wbem\Cache\desktop.ini cmd.exe File opened for modification C:\Windows\SysWOW64\wbem\logo.jpg Tserv.exe File opened for modification C:\Windows\SysWOW64\wbem\hac.ini hac.exe File opened for modification C:\Windows\SysWOW64\wbem\Cache attrib.exe File created C:\Windows\SysWOW64\wbem\oeminfo.ini Tserv.exe File created C:\Windows\SysWOW64\wbem\y.txt cmd.exe File created C:\Windows\SysWOW64\grand.dll 5c40c877bab790968d447e42dce108d0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wbem\Batch.bat Tserv.exe File created C:\Windows\SysWOW64\wbem\logo.jpg Tserv.exe File created C:\Windows\SysWOW64\wbem\logob.bmp Tserv.exe File created C:\Windows\SysWOW64\wbem\logos.jpg Tserv.exe File opened for modification C:\Windows\SysWOW64\wbem\hac.log hac.exe File opened for modification C:\Windows\SysWOW64\oemlogo.bmp csrss.exe File opened for modification C:\Windows\SysWOW64\oobe\runback.dll csrss.exe File created C:\Windows\SysWOW64\wbem\lsprt.dll Tserv.exe File created C:\Windows\SysWOW64\wbem\Self.dll Tserv.exe File opened for modification C:\Windows\SysWOW64\wbem\csrss.exe Tserv.exe File opened for modification C:\Windows\SysWOW64\pimgl.dll 5c40c877bab790968d447e42dce108d0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ofnimeo.dll 5c40c877bab790968d447e42dce108d0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wbem\oeminfo.ini Tserv.exe File opened for modification C:\Windows\SysWOW64\pimg.dll 5c40c877bab790968d447e42dce108d0_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\hac.log hac.exe File opened for modification C:\Windows\SysWOW64\wbem\Cache\desktop.ini attrib.exe File created C:\Windows\SysWOW64\wbem\cache\files\source.ini csrss.exe File opened for modification C:\Windows\SysWOW64\wbem\drvin.dll Tserv.exe File opened for modification C:\Windows\SysWOW64\wbem\logos.jpg Tserv.exe File created C:\Windows\SysWOW64\wbem\wfpr.exe Tserv.exe File created C:\Windows\SysWOW64\pimg.dll 5c40c877bab790968d447e42dce108d0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\grand.dll 5c40c877bab790968d447e42dce108d0_JaffaCakes118.exe File created C:\Windows\SysWOW64\pimgl.dll 5c40c877bab790968d447e42dce108d0_JaffaCakes118.exe File created C:\Windows\SysWOW64\usmt\lsprt.dll cmd.exe File created C:\Windows\SysWOW64\tmp csrss.exe File opened for modification C:\Windows\SysWOW64\wbem\hac.ini hac.exe File opened for modification C:\Windows\SysWOW64\wbem\Cache\files attrib.exe File created C:\Windows\SysWOW64\ofnimeo.dll csrss.exe File opened for modification C:\Windows\SysWOW64\Tserv.exe 5c40c877bab790968d447e42dce108d0_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\hctabt.dll Tserv.exe File opened for modification C:\Windows\SysWOW64\wbem\Self.dll Tserv.exe File created C:\Windows\SysWOW64\logo.bmp 5c40c877bab790968d447e42dce108d0_JaffaCakes118.exe File opened for modification C:\windows\SysWOW64\oeminfo.ini cmd.exe File opened for modification C:\Windows\SysWOW64\ofnimeo.dll csrss.exe File created C:\Windows\SysWOW64\tmp regedit.exe File created C:\Windows\SysWOW64\wbem\csrss.exe Tserv.exe File opened for modification C:\Windows\SysWOW64\wbem\hac.log hac.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\system32\\logo.bmp" csrss.exe - Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\system\sure.ini lsass.exe File opened for modification C:\Windows\system\sure.ini lsass.exe File opened for modification C:\Windows\system\sure.ini lsass.exe File created C:\Windows\lsass.exe cmd.exe File opened for modification C:\Windows\system\sure.ini lsass.exe File opened for modification C:\Windows\system\sure.ini lsass.exe File opened for modification C:\Windows\lsass.exe cmd.exe File opened for modification C:\Windows\system\sure.ini lsass.exe File opened for modification C:\Windows\system\sure.ini lsass.exe File opened for modification C:\Windows\system\sure.ini lsass.exe File opened for modification C:\Windows\system\sure.ini lsass.exe File opened for modification C:\Windows\system\sure.ini lsass.exe File opened for modification C:\Windows\system\sure.ini lsass.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\Desktop\WallpaperStyle = "2" csrss.exe Key created \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\Desktop csrss.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe - Modifies registry class 20 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Key created \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe - Runs regedit.exe 6 IoCs
pid Process 644 regedit.exe 1356 regedit.exe 2172 regedit.exe 2296 regedit.exe 4828 regedit.exe 768 regedit.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 840 explorer.exe - Suspicious use of SetWindowsHookEx 24 IoCs
pid Process 2884 5c40c877bab790968d447e42dce108d0_JaffaCakes118.exe 840 explorer.exe 840 explorer.exe 816 csrss.exe 1188 lsass.exe 4532 lsass.exe 1840 csrss.exe 3048 lsass.exe 5064 csrss.exe 880 lsass.exe 4940 csrss.exe 4836 lsass.exe 4196 csrss.exe 4928 lsass.exe 2472 csrss.exe 4036 lsass.exe 1484 csrss.exe 1264 lsass.exe 3608 csrss.exe 2352 lsass.exe 1592 csrss.exe 3948 lsass.exe 5064 csrss.exe 1784 lsass.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2884 wrote to memory of 920 2884 5c40c877bab790968d447e42dce108d0_JaffaCakes118.exe 84 PID 2884 wrote to memory of 920 2884 5c40c877bab790968d447e42dce108d0_JaffaCakes118.exe 84 PID 2884 wrote to memory of 920 2884 5c40c877bab790968d447e42dce108d0_JaffaCakes118.exe 84 PID 2884 wrote to memory of 3528 2884 5c40c877bab790968d447e42dce108d0_JaffaCakes118.exe 87 PID 2884 wrote to memory of 3528 2884 5c40c877bab790968d447e42dce108d0_JaffaCakes118.exe 87 PID 2884 wrote to memory of 3528 2884 5c40c877bab790968d447e42dce108d0_JaffaCakes118.exe 87 PID 3528 wrote to memory of 1396 3528 cmd.exe 91 PID 3528 wrote to memory of 1396 3528 cmd.exe 91 PID 3528 wrote to memory of 1396 3528 cmd.exe 91 PID 2884 wrote to memory of 2136 2884 5c40c877bab790968d447e42dce108d0_JaffaCakes118.exe 93 PID 2884 wrote to memory of 2136 2884 5c40c877bab790968d447e42dce108d0_JaffaCakes118.exe 93 PID 2884 wrote to memory of 2136 2884 5c40c877bab790968d447e42dce108d0_JaffaCakes118.exe 93 PID 2136 wrote to memory of 2472 2136 cmd.exe 95 PID 2136 wrote to memory of 2472 2136 cmd.exe 95 PID 2136 wrote to memory of 2472 2136 cmd.exe 95 PID 2136 wrote to memory of 880 2136 cmd.exe 96 PID 2136 wrote to memory of 880 2136 cmd.exe 96 PID 2136 wrote to memory of 880 2136 cmd.exe 96 PID 2136 wrote to memory of 1956 2136 cmd.exe 99 PID 2136 wrote to memory of 1956 2136 cmd.exe 99 PID 2136 wrote to memory of 1956 2136 cmd.exe 99 PID 2136 wrote to memory of 2432 2136 cmd.exe 101 PID 2136 wrote to memory of 2432 2136 cmd.exe 101 PID 2136 wrote to memory of 2432 2136 cmd.exe 101 PID 2136 wrote to memory of 3968 2136 cmd.exe 102 PID 2136 wrote to memory of 3968 2136 cmd.exe 102 PID 2136 wrote to memory of 3968 2136 cmd.exe 102 PID 2136 wrote to memory of 1600 2136 cmd.exe 103 PID 2136 wrote to memory of 1600 2136 cmd.exe 103 PID 2136 wrote to memory of 1600 2136 cmd.exe 103 PID 2136 wrote to memory of 4664 2136 cmd.exe 104 PID 2136 wrote to memory of 4664 2136 cmd.exe 104 PID 2136 wrote to memory of 4664 2136 cmd.exe 104 PID 2136 wrote to memory of 3020 2136 cmd.exe 105 PID 2136 wrote to memory of 3020 2136 cmd.exe 105 PID 2136 wrote to memory of 3020 2136 cmd.exe 105 PID 2136 wrote to memory of 5052 2136 cmd.exe 106 PID 2136 wrote to memory of 5052 2136 cmd.exe 106 PID 2136 wrote to memory of 5052 2136 cmd.exe 106 PID 2136 wrote to memory of 3976 2136 cmd.exe 107 PID 2136 wrote to memory of 3976 2136 cmd.exe 107 PID 2136 wrote to memory of 3976 2136 cmd.exe 107 PID 2136 wrote to memory of 816 2136 cmd.exe 108 PID 2136 wrote to memory of 816 2136 cmd.exe 108 PID 2136 wrote to memory of 816 2136 cmd.exe 108 PID 2136 wrote to memory of 1188 2136 cmd.exe 109 PID 2136 wrote to memory of 1188 2136 cmd.exe 109 PID 2136 wrote to memory of 1188 2136 cmd.exe 109 PID 816 wrote to memory of 3988 816 csrss.exe 115 PID 816 wrote to memory of 3988 816 csrss.exe 115 PID 816 wrote to memory of 3988 816 csrss.exe 115 PID 3988 wrote to memory of 4532 3988 cmd.exe 117 PID 3988 wrote to memory of 4532 3988 cmd.exe 117 PID 3988 wrote to memory of 4532 3988 cmd.exe 117 PID 816 wrote to memory of 4784 816 csrss.exe 118 PID 816 wrote to memory of 4784 816 csrss.exe 118 PID 816 wrote to memory of 4784 816 csrss.exe 118 PID 816 wrote to memory of 644 816 csrss.exe 119 PID 816 wrote to memory of 644 816 csrss.exe 119 PID 816 wrote to memory of 644 816 csrss.exe 119 PID 816 wrote to memory of 1356 816 csrss.exe 120 PID 816 wrote to memory of 1356 816 csrss.exe 120 PID 816 wrote to memory of 1356 816 csrss.exe 120 PID 816 wrote to memory of 2172 816 csrss.exe 121 - System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "145" csrss.exe - Views/modifies file attributes 1 TTPs 3 IoCs
pid Process 5052 attrib.exe 4664 attrib.exe 3020 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c40c877bab790968d447e42dce108d0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5c40c877bab790968d447e42dce108d0_JaffaCakes118.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:2⤵PID:920
-
-
C:\Windows\SysWOW64\cmd.execmd /k start C:\Windows\system32\Tserv.exe & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\SysWOW64\Tserv.exeC:\Windows\system32\Tserv.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1396
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\wbem\batch.bat2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\wbem\hac.exehac.exe -extract "ntoskrnl.exe","Blast.bmp",BITMAP,1,3⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2472
-
-
C:\Windows\SysWOW64\wbem\hac.exehac.exe -addoverwrite "ntkrnlpa.exe","ntkrnlpa.exe","logob.bmp",BITMAP,1,3⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:880
-
-
C:\Windows\SysWOW64\wbem\hac.exehac.exe -addoverwrite "ntoskrnl.exe","ntoskrnl.exe","logob.bmp",BITMAP,1,3⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1956
-
-
C:\Windows\SysWOW64\wbem\wfpr.exewfpr.exe "C:\windows\system32\ntkrnlpa.exe" "ntkrnlpa.exe"3⤵
- Executes dropped EXE
PID:2432
-
-
C:\Windows\SysWOW64\wbem\wfpr.exewfpr.exe "C:\windows\system32\ntoskrnl.exe" "ntoskrnl.exe"3⤵
- Executes dropped EXE
PID:3968
-
-
C:\Windows\SysWOW64\wbem\wfpr.exewfpr.exe "C:\windows\system32\Restore\rstrui.exe" "rstrui.exe"3⤵
- Executes dropped EXE
PID:1600
-
-
C:\Windows\SysWOW64\attrib.exeattrib files +s +r3⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:4664
-
-
C:\Windows\SysWOW64\attrib.exeattrib desktop.ini +s +h +r3⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:3020
-
-
C:\Windows\SysWOW64\attrib.exeattrib "cache" +s +r3⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:5052
-
-
C:\Windows\SysWOW64\cacls.exeC:\Windows\system32\cacls.exe "cache" /p everyone:n3⤵PID:3976
-
-
C:\Windows\SysWOW64\wbem\cache\files\csrss.exeC:\Windows\system32\wbem\cache\files\csrss.exe3⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Checks computer location settings
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:816 -
C:\Windows\SysWOW64\cmd.execmd.exe /k start C:\Windows\lsass.exe & exit4⤵
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\lsass.exeC:\Windows\lsass.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4532
-
-
-
C:\Windows\SysWOW64\RUNDLL32.EXE"C:\Windows\System32\RUNDLL32.EXE" user32.dll,UpdatePerUserSystemParameters4⤵PID:4784
-
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe" /s /e "C:\Windows\system32\tmp" "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\NetWork"4⤵
- Drops file in System32 directory
- Runs regedit.exe
PID:644
-
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe" /s "C:\Windows\system32\tmp"4⤵
- Runs regedit.exe
PID:1356
-
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe" /s "C:\Windows\system32\tmp"4⤵
- Runs regedit.exe
PID:2172
-
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe" /s /e "C:\Windows\system32\tmp" "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\Minimal"4⤵
- Drops file in System32 directory
- Runs regedit.exe
PID:2296
-
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe" /s "C:\Windows\system32\tmp"4⤵
- Runs regedit.exe
PID:4828
-
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe" /s "C:\Windows\system32\tmp"4⤵
- Impair Defenses: Safe Mode Boot
- Runs regedit.exe
PID:768
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /k start C:\Windows\lsass.exe & exit4⤵PID:2676
-
C:\Windows\lsass.exeC:\Windows\lsass.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3048
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /k start C:\Windows\lsass.exe & exit4⤵PID:2092
-
C:\Windows\lsass.exeC:\Windows\lsass.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:880
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /k start C:\Windows\lsass.exe & exit4⤵PID:732
-
C:\Windows\lsass.exeC:\Windows\lsass.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4836
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /k start C:\Windows\lsass.exe & exit4⤵PID:3124
-
C:\Windows\lsass.exeC:\Windows\lsass.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4928
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /k start C:\Windows\lsass.exe & exit4⤵PID:3972
-
C:\Windows\lsass.exeC:\Windows\lsass.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4036
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /k start C:\Windows\lsass.exe & exit4⤵PID:4544
-
C:\Windows\lsass.exeC:\Windows\lsass.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1264
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /k start C:\Windows\lsass.exe & exit4⤵PID:1356
-
C:\Windows\lsass.exeC:\Windows\lsass.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2352
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /k start C:\Windows\lsass.exe & exit4⤵PID:3596
-
C:\Windows\lsass.exeC:\Windows\lsass.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3948
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /k start C:\Windows\lsass.exe & exit4⤵PID:4336
-
C:\Windows\lsass.exeC:\Windows\lsass.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1784
-
-
-
-
C:\Windows\lsass.exeC:\Windows\lsass.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1188 -
C:\Windows\SysWOW64\cmd.execmd.exe /k start C:\Windows\system32\wbem\cache\files\csrss.exe & exit4⤵PID:2400
-
C:\Windows\SysWOW64\wbem\cache\files\csrss.exeC:\Windows\system32\wbem\cache\files\csrss.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1840
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /k start C:\Windows\system32\wbem\cache\files\csrss.exe & exit4⤵PID:3652
-
C:\Windows\SysWOW64\wbem\cache\files\csrss.exeC:\Windows\system32\wbem\cache\files\csrss.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5064
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /k start C:\Windows\system32\wbem\cache\files\csrss.exe & exit4⤵PID:2432
-
C:\Windows\SysWOW64\wbem\cache\files\csrss.exeC:\Windows\system32\wbem\cache\files\csrss.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4940
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /k start C:\Windows\system32\wbem\cache\files\csrss.exe & exit4⤵PID:3332
-
C:\Windows\SysWOW64\wbem\cache\files\csrss.exeC:\Windows\system32\wbem\cache\files\csrss.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4196
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /k start C:\Windows\system32\wbem\cache\files\csrss.exe & exit4⤵PID:1124
-
C:\Windows\SysWOW64\wbem\cache\files\csrss.exeC:\Windows\system32\wbem\cache\files\csrss.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2472
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /k start C:\Windows\system32\wbem\cache\files\csrss.exe & exit4⤵PID:1528
-
C:\Windows\SysWOW64\wbem\cache\files\csrss.exeC:\Windows\system32\wbem\cache\files\csrss.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1484
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /k start C:\Windows\system32\wbem\cache\files\csrss.exe & exit4⤵PID:2772
-
C:\Windows\SysWOW64\wbem\cache\files\csrss.exeC:\Windows\system32\wbem\cache\files\csrss.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3608
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /k start C:\Windows\system32\wbem\cache\files\csrss.exe & exit4⤵PID:2400
-
C:\Windows\SysWOW64\wbem\cache\files\csrss.exeC:\Windows\system32\wbem\cache\files\csrss.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1592
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /k start C:\Windows\system32\wbem\cache\files\csrss.exe & exit4⤵PID:3904
-
C:\Windows\SysWOW64\wbem\cache\files\csrss.exeC:\Windows\system32\wbem\cache\files\csrss.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5064
-
-
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:840
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\Tserv.exe
- Size 475KB
- SHA256 4505cfdb9804c6c336c3b11d10872fa50ad9c9ca4592977946c495789b358e3d
- MD5 483e38bd4c57660baab697402b291c86
- SHA1 bc3d30a199e5d207d6e866e6b1977decd24368c6
- SHA512 7c15a372b34ad88d7e6ff58b88d6063204673b3e1d7426da7d035889a57e200c3d358ff5f9584ffe797f7229da764bdc8b72ce33af77b1cac82362699d478235
- SSDEEP 12288:Hr3ZBIRmc1xs4B5IDx7jnClb0FwljX1ct3q8NGLr:zZB2mcwIKDtU3Qt3qRLr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\pimg.dll
- Size 900KB
- SHA256 0a46c6b430337c057fc404d133fa6e03cb796628c44f9aeb618e4049d23dbe8f
- MD5 f42d3190b1a49adbab4b860ab8274de4
- SHA1 099539c4b62087b380b8e6ed6d55e769c131288c
- SHA512 1eb475923dc0f1906ac549c744d45ea629ffd16a722ff12e4795632a07ed769ce9d99163aaea216f35d9ded26865628b76e47aa38cbc5492ba53cf60527f109b
- SSDEEP 12288:rqYNWf1pDYXj3C/YeVxwwKwrVVBwVxAh8t4W:rqYkNOXj3OYeVbVVMAh8t4W
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\pimgl.dll
- Size 44KB
- SHA256 70078e47235a881aa05b777ca65d44d470d371fa72af4a527f3f87298b6efc2e
- MD5 1f50359cd39fa7e764e63d5eca55de22
- SHA1 4a84e8728dcf17e193ad3dc9dec97d53692f0f24
- SHA512 351d51467ef473d966d5a14b178d59f7fde2731b18dfbbc6a420c969c653cd27bb362707f92eae35134a7b102a8f683fe477378601d86a46c3959e1d3bb7d217
- SSDEEP 768:6LWzRz+mCrd0qgcmy9KT/Ka3afCAqW5TGfVEls:WgAgFT/K8aKAaV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\tmp
- Size 29KB
- SHA256 c552b22cbc0d19a3b4ffc1bd8be7836172ca81d500de606fedf58bc97a18a43d
- MD5 034c58dcb560ed646cc658a5622366e7
- SHA1 56104b6dbe9d46dbb89fa54152bb2934a1971833
- SHA512 c2441f8d66434fd05ae8aa2bfc026751391413e32cbec667de00877c20fa147a583587d6d2135a487709cbdf6882b9784d7cd6842d52af0314960f16512fd01c
- SSDEEP 96:UcacSpc0cGcVcTcEckcT/cTfcscucMcIcDcLcacdc1cnc8cUc+cYctczcjcfcncR:A0C1rrL8X6Torb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\tmp
- Size 29KB
- SHA256 01e84a3a5fedf634674c111d19be32c1b99ec4a86737e97a57e249678e16525a
- MD5 9e1e3f7e8cd96bcf9b65d727cf1fbc25
- SHA1 55a8f4a6db93ff178ec970034d9894d5444dc9c1
- SHA512 4e84756009bf21b499df6e8c01df186b4103ba87711924ebe6c0197fa920c2a0ce3701078d142d381fc4e398b60ae2e777362a1e00a476b47b08d9a070a0f9ae
- SSDEEP 96:UcQccpcmckcrc9cWc2ct/ctfcuccc+cSctc1cAcTcrcpcuc2cMciczc9c9chcJcP:AKMbrMs1up6dWlb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\tmp
- Size 18KB
- SHA256 54b8cb4087739be30ac6f5bddeee71c262cae0303faba2ff519c998bfd1396f0
- MD5 1ab966dc6dcee57a191ea240ab0028b4
- SHA1 c14b9a7ca99b41beaa94ef76f744e500c0fd2c52
- SHA512 9a5f482367b74f10438345fde7151c2dcd8a9ec93771a41d8cdd0f75fb9de356aacd1b91788a73ade8d2497d62f79ae5e3ec3f2b2372adae1bf5a61e4a3dc50b
- SSDEEP 96:UcXcdcrckcmc9cFco/cofcrcdcWcvckc8cKcdc2cacKcTcucecuc2cTcGcscccMK:55NWf06WjQb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\tmp
- Size 228B
- SHA256 f92e8ada2625f60f89e0ff42f40384d7bce8342dee1ddb6d6f4524b61275642f
- MD5 9b9588565aaea376aecf3adb4fce0a9c
- SHA1 73bcf6237e84913b58f45fa7618353a44523fe1a
- SHA512 6170ddb1fdb214dda2b11d21321a3c40b7a1c4d750d9ae68f1fdb1e0f9d5066522a70548cd9dda265a7c4a80acaa90a8b4b668f068201817aab63b113c9e74e3
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\tmp
- Size 17KB
- SHA256 7b43ad6a916aaef87be2e55e12aeb99756c54e6fa27e4110959ac66c44dc6f64
- MD5 9bd7ea285604515d261f764ef13a0197
- SHA1 8fa22862db6f260cb17b290be724989854fbcc7a
- SHA512 8d18dda91433c8ddd9f447c49fcfb8c0ffefdeb8a3f98fab248e69a61a53f0958b0efdcbefc54a376026a8105af1d8826a7f2e0b275d61cc1b00f4f83672e812
- SSDEEP 96:UcZcDc1cGckcDcrcm/cmfcFcDc0cBcmc+cgcDc0cwcgctcMcMcscUctckc+cecO6:ZnzWvq60tub
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\tmp
- Size 228B
- SHA256 12c588ae4260278a902324c8622a6d344af2d0451bc11ab92771d178962648b0
- MD5 e096697779f4b6242c379d94bc0d28b7
- SHA1 1ce4930bf4e46aa56053e56105c610b114eef164
- SHA512 ca430c7075dbc83d94907576ace45efe9d257d4657cdab61839415cc5c47c4e6016669d55b8cb3b0ab99b6bea29144375feb144d6eccea95a7dd4e94a6d27991
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\wbem\Batch.bat
- Size 1KB
- SHA256 8b9c4908d25dbe5d24059d6fb9df59ef63466b8b82c5992112cc6e1eac8fe134
- MD5 4645a61fb575f8a631174594db55ecc8
- SHA1 15525c377f4ef31e7e12ce61a2bcb85729101f14
- SHA512 3ee721e7d172474b1f4dacf64294e777f19d2139aa1f896b0be01102fde04f92c153d8498b201474692667d34826a2193a3d11b337fd498dc5d4bb751461aadb
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\wbem\Brand.dll
- Size 2KB
- SHA256 06e56c82c05b9de6e60bc2262d5e58c2d804750c2ace3f19f62e82d4cbd9df56
- MD5 899d2034155b504d8be4a62d4805bee4
- SHA1 432689804f3edac70da5f88fc307c7ff140e110f
- SHA512 3ca0dbeadc69391e17288ae63e773f2d07f6262d2eb69d37f6a35f86650beba56a6258d74c39d5449bfc04515ecac406ae05dd7411f508deb3f83faf36b04206
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\wbem\Cache\desktop.ini
- Size 67B
- SHA256 34d749e227752ff74002e89ce0fb64dbee9a8596c36ac3f19156e576d1fb15c1
- MD5 a285b56e62d82b7fa7abc98f9a85965a
- SHA1 447770f7df4e89685df1a62fc82aef55db6587a2
- SHA512 a64ba95c3d6852ce32d1480ac442565d38476402092a0f7f653f12d5cc3d2ed338cd7f266c89696cde4f1eb0373917f321f6f310be38aed88d50caea616b593b
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\wbem\Cache\files\source.ini
- Size 503KB
- SHA256 5b2fff916a8f186c3c0e7f0fa7728a0d7690c5696c1a45e94616cc4728afba99
- MD5 5c40c877bab790968d447e42dce108d0
- SHA1 5e145e58ac116e6806045d4fcbb04cd3786b92a4
- SHA512 97f4fe4183c2302af7944f6c1b7924d4f0323892e33b63ab251f0da611480df9cba14da3bb64ec155142836b3c6230282b5cfd75ab09f60f9954607a1f65a6b5
- SSDEEP 12288:Hikch8g3INv3t/D9huWdh68evA4WLXoULYd4hhq0F6w4gY8K:PMPy3dD956xAzJhtIwBRK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\wbem\csrss.exe
- Size 60KB
- SHA256 538f7e09f4c4b20a13584a788e53ae6f60a7f3c936f852f1e7552f27c76e2c40
- MD5 30ddfc1991f6d881e0915d719141d473
- SHA1 c8e3d9019614ea0cb81055123f35ea8c6af44810
- SHA512 854baa1f1363f2d316a21d0b385c8935ed024c7ef01f90b88bd51158860a5b6561864b925d332f1ba80fb214556b0247cd686ebc1e660a4a9b79c611634b2047
- SSDEEP 1536:d3gesW1gTDCqrbQUeJ1r3WeWsawOFg0tb+7r3:f1gTDCqrbQUeJ1r3nOREr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\wbem\hac.exe
- Size 299KB
- SHA256 df9c06d11ea5bb65b58121d80c98f07829187cab958e78066c7ea540a392bbc8
- MD5 535ec7614e6ef0f4eb0af6c82718ecd2
- SHA1 16730f7e3ff0bdcfe20bf6438881f741cb677094
- SHA512 4f3741c389fecc9df8af8fb941ccb68bc31c97a77b507d0b969f361c3e511512b917f4040ce1759ae074fe7799b0208aa75f2c13f29844e5dc687e45cf384cf6
- SSDEEP 6144:uyFALmLVVLSZAc2CUBiEIQ+cEzWUSqBdZnZYZ42lPD:ULmjSZAFijQArSidZZwzlPD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\wbem\hac.ini
- Size 190B
- SHA256 36b4c00e21d96742320d98e502305c8ceeb2e058f064addab98d2c6604f99b8c
- MD5 e8c34f16e20975043420507a810ca184
- SHA1 a959aaab872e43cc38520fdf3236918bcfd8eb62
- SHA512 84abed8365e0c34bdf958c319304626ab5c8f27c44b8fc58c2e39267e9b4b71d7cbd5ddb02bad09a728204825f357d141149ac153b96137e649f3aef68c71cda
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\wbem\hac.log
- Size 139B
- SHA256 108d319e1f8969e1b47461c3e49cb9884605dc0685ac9929aeab07a4a00078ac
- MD5 df68673ee67cc7d066950afb746ca9d9
- SHA1 273c15c15fa7c800c6b408d9db498352e5c3f5ca
- SHA512 cc32405b5c80f2f2ef0b84501be552cc20bb35fd4285408793e3d0bff358872b28f1c7dca34193895ca7a7c9c03adeb8c5a88a0ee580a25d04306c1e3d2957a0
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\wbem\hac.log
- Size 139B
- SHA256 6bd73943c4505bc10ba9625111197188d723d42fe0ee87ea91cfd97afef7bfc9
- MD5 a98e3d092880a0a5d0a6da2943c267bb
- SHA1 2472fffdb394008346dffb25903b3a4600079fc2
- SHA512 4d48e2d243fa0a4fd22dde2f34ab490079560c099c94f1eecf1edc6248dbbd0d8656e84ae1dd8398cbe9e6fe62e8a23ce59bdc5296bb843d174b7865755fc38f
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\wbem\logo.jpg
- Size 31KB
- SHA256 6e62a57ab9784fe1b19663a4427407ac99721215de63f9c7737501db3897ad63
- MD5 44d347b15524a976fe36d22e9f778db5
- SHA1 16abe95730b6faf954c2a41315e20c1f171b3065
- SHA512 f2ba88d9bbc0dca3aa0af43b059eec4267d89374eb1a5f2176d947dfca07b2d82806fe44f38f6073613476086bdae74aef6a6bb9227d4baf24fb600f13fff5fc
- SSDEEP 768:yHGANE0wLOYrlpGPVOUL3QENtIf9YvZwFFBacj:yM0JgItI+eFFBacj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\wbem\logob.bmp
- Size 150KB
- SHA256 3fa16de25a9bf32d2d10985696435457b5f618f84a8dc81b0bd2a08f74685ed0
- MD5 252fa7bfc4935dc1f170c8653ad86ac4
- SHA1 a8d81c5ae2696343d9cf8a9edd500aa5dddad8b4
- SHA512 edcf8c957be5a14fc1420b43136c8b873050fe1a2febd8940d56416185a7e4555210aed2f623f0e7bffd33b052ec9594cf5c058801a8f3aad766712f572818f7
- SSDEEP 48:kpZCj1KuDjr+F7VyF0eomJyh6kp9/q08M/WVda7JvBXME:kCj1Kt09dbMeja
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\wbem\logos.jpg
- Size 2KB
- SHA256 416484e9cc4397e5106fc7eafce9abf21323934bc57001593e76a73987b1eb26
- MD5 dd17fc7ba3cf3ef7abde474a7651d328
- SHA1 bba5a6a09206eea973cdc44b5d221bd9900195d2
- SHA512 0596199319260973e0947938a673711e12a85a91d483a99890de5262aa2073c793f7996931cfd28126f901c800f24710564faeffe5a0611c559e88f5f4fb13fc
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\wbem\lsprt.dll
- Size 28KB
- SHA256 3f14d394fe5a6f9097da95b32d7ac2fc0993c598ee6e360601ae7a9d671dcb3b
- MD5 99269db51563b7d343238c4584bc0109
- SHA1 a12eca499a99f478df98043d484cfaaa671131e7
- SHA512 c061c66efa9b69cd219f2769df0747ffd0b7a37f662eb7ce9a4736459ff9299fb8e480cc22d2b38d0d4a60f029ad520e667b9a3b64412a15ee2f42449603b618
- SSDEEP 384:7tPft1wXSDRvV4tPuwl0Oy9BlcaZqZL3W4bA:JX8GvXOenqx7k
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\wbem\oeminfo.ini
- Size 589B
- SHA256 4869e76a81bb3dc6d20bff0cb00ba2e65beb9fa809c82083fe99ab13a2c0aab5
- MD5 3de86f7705ba71aaa8490b2e7e23510f
- SHA1 f6876de50b9028f600b3b47548d9576b1279dba5
- SHA512 4c660c4bb092fb1d3f37dc103ce5ebb59f187afff36473617f15dfd242e1a9d0983b6af923750541a315702aa01f8b2d082e856ec4be59f08502df33c03b6158
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\wbem\self.dll
- Size 216B
- SHA256 79410d6f73fa758d84fdbc6c3445e5615bc28161c31b37f3ca5691ddd9ebc9b7
- MD5 90783225396deab2b08648b60dff0b99
- SHA1 30508e64cd187cfc4b18bb2ba26ed26e6b26e042
- SHA512 94f77cf1dc7b6d16178085aadabd19478c21510ad74c91f2064d0c22f9b62349c8729877a49c4dad58ead78b4f5a9416f7d417a7f61de52b389c53335cdd6bdc
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\wbem\wfpr.exe
- Size 54KB
- SHA256 5155d83d073551c4b801c0785edebd25f644bbaafefb36961132ae594ba9637d
- MD5 470ef77ec1cc2aa3657d2703e568cf7a
- SHA1 b8694f156de636207d4bdaace40345a6e87da9eb
- SHA512 5e5fb245e74f351b57a3aae0d52f16a367e489f1bcc37a4ae6b89732f8d4b028119ec587305a22298647a1d08f5c76fb2c71943a82bc8d3c4a0d08caa8bfaab1
- SSDEEP 768:eFUAQgqRLZGReYboH7AkjFL+IQEFYl7g3WMNCXCSFYQQR94en3Jeo5H:eYgqRlMcsGL1QQYpgmMcXBXQRzp5H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\desktop.ini
- Size 334B
- SHA256 a64687552bbde33558ccb88583c98d638d3a664bafe38139f4c85957323fee71
- MD5 c58c0da2414cb3c9f7cc053cb5376229
- SHA1 cebe23db2a58c63222856c49cb327ec42ea21263
- SHA512 afcdeedd2f0200d220fca38488663b586aefc22f87d4d8f3ed9788020ea2480f01fec5a6f90bfbd24d6c9cc59c389312778d3553f1cbbd19972e00b04a6d4952
- MD5 SHA1 SHA512