5376988888b8910a07fcbf46369e88e20ebf07aa0448fc3e0bbc5724f33490d6

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 15:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Size

1.6MB
MD5

5c9e80f700149dc90e32d5fe0a99344a
SHA1

ad02b83ad81de9cc40519a63b9301df79166ecc4
SHA256

5376988888b8910a07fcbf46369e88e20ebf07aa0448fc3e0bbc5724f33490d6
SHA512

f0c5b2ad05bc46f873893a2532a631be819dc5441699dec16e62f512f2a693b42d2752b743869f266821c014a9c10fad7fb6bd463816d4a9b089f99478867e85
SSDEEP

3072:ThzV9Rd1gWIoKMHOlQtjZtIax1I5NJK5cBnyypQ1x2Cmswz:dRbOCtjvQJFfKxms

Score

10^/10

evasion execution persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	DHCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	ftdisk.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Policies\SYSTEM\DISABLEREGISTRYTOOLS = "1"	DHCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Policies\SYSTEM\DISABLEREGISTRYTOOLS = "1"	ftdisk.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\directx.exe	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
704	DHCP.exe
1644	ftdisk.exe

Loads dropped DLL 2 IoCs

pid	Process
2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Client = "DHCP.exe"	ftdisk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Volume Manager Driver = "ftdisk.exe"	ftdisk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Client = "DHCP.exe"	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Volume Manager Driver = "ftdisk.exe"	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Client = "DHCP.exe"	DHCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Volume Manager Driver = "ftdisk.exe"	DHCP.exe

Enumerates connected drives 3 TTPs 8 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	cacls.exe
File opened (read-only)	\??\F:	cacls.exe
File opened (read-only)	\??\F:	cacls.exe
File opened (read-only)	\??\F:	cacls.exe
File opened (read-only)	\??\F:	cacls.exe
File opened (read-only)	\??\F:	cacls.exe
File opened (read-only)	\??\F:	cacls.exe
File opened (read-only)	\??\F:	cacls.exe

Drops autorun.inf file 1 TTPs 8 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	F:\Autorun.inf	ftdisk.exe
File opened for modification	F:\Autorun.inf	ftdisk.exe
File created	C:\Autorun.inf	DHCP.exe
File opened for modification	C:\Autorun.inf	DHCP.exe
File created	F:\Autorun.inf	DHCP.exe
File opened for modification	F:\Autorun.inf	DHCP.exe
File created	C:\Autorun.inf	ftdisk.exe
File opened for modification	C:\Autorun.inf	ftdisk.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dhcp.sys	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ftdisk.sys	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dpvsrv.dll	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\igfx32.lrc	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ftdisk.exe	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\helpsrv.exe	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\initgdi32.cui	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\compmhelp.htm	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DHCP.exe	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
File opened for modification	C:\Windows\media\funnu.wav	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
File opened for modification	C:\Windows\help\ipshelp.hlp	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe

Launches sc.exe 51 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2264	SC.exe
2828	SC.exe
1616	SC.exe
2364	SC.exe
1704	SC.exe
1560	SC.exe
2928	SC.exe
2084	SC.exe
2832	SC.exe
1844	SC.exe
2772	SC.exe
1288	SC.exe
1532	SC.exe
2080	SC.exe
920	SC.exe
2212	SC.exe
2792	SC.exe
2320	SC.exe
2240	SC.exe
2208	SC.exe
2008	SC.exe
1116	SC.exe
2508	SC.exe
844	SC.exe
2776	SC.exe
2708	SC.exe
2384	SC.exe
2468	SC.exe
2808	SC.exe
1592	SC.exe
1652	SC.exe
2016	SC.exe
1356	SC.exe
1804	SC.exe
2440	SC.exe
1528	SC.exe
924	SC.exe
3008	SC.exe
2068	SC.exe
2744	SC.exe
2924	SC.exe
1136	SC.exe
1284	SC.exe
1000	SC.exe
1676	SC.exe
2796	SC.exe
1668	SC.exe
2240	SC.exe
2304	SC.exe
2812	SC.exe
1796	SC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1229272821-838170752-839522115-1003\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN	DHCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1229272821-838170752-839522115-1003\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN	ftdisk.exe

Modifies registry class 27 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\NodeSlot = "1"	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = ffffffff	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = c80031000000000000000000160035633965383066373030313439646339306533326435666530613939333434615f4a6166666143616b657331313800008a0008000400efbe00000000000000002a00000000000000000000000000000000000000000000000000350063003900650038003000660037003000300031003400390064006300390030006500330032006400350066006500300061003900390033003400340061005f004a006100660066006100430061006b006500730031003100380000003e000000	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_Classes\Local Settings	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 7e0074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f3c0008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4a0031000000000000000000100054656d700000360008000400efbe00000000000000002a00000000000000000000000000000000000000000000000000540065006d007000000014000000	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 4c003100000000000000000010004c6f63616c00380008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
704	DHCP.exe
704	DHCP.exe
1644	ftdisk.exe
1644	ftdisk.exe
704	DHCP.exe
1644	ftdisk.exe
704	DHCP.exe
1644	ftdisk.exe
704	DHCP.exe
1644	ftdisk.exe
704	DHCP.exe
1644	ftdisk.exe
704	DHCP.exe
1644	ftdisk.exe
704	DHCP.exe
1644	ftdisk.exe
704	DHCP.exe
1644	ftdisk.exe
704	DHCP.exe
1644	ftdisk.exe
704	DHCP.exe
1644	ftdisk.exe
704	DHCP.exe
1644	ftdisk.exe
704	DHCP.exe
1644	ftdisk.exe
704	DHCP.exe
1644	ftdisk.exe
704	DHCP.exe
1644	ftdisk.exe
704	DHCP.exe
1644	ftdisk.exe
704	DHCP.exe
1644	ftdisk.exe
704	DHCP.exe
1644	ftdisk.exe
704	DHCP.exe
1644	ftdisk.exe
704	DHCP.exe
1644	ftdisk.exe
704	DHCP.exe
1644	ftdisk.exe
704	DHCP.exe
1644	ftdisk.exe
704	DHCP.exe
1644	ftdisk.exe
704	DHCP.exe
1644	ftdisk.exe
704	DHCP.exe
1644	ftdisk.exe
704	DHCP.exe
1644	ftdisk.exe
704	DHCP.exe
1644	ftdisk.exe
704	DHCP.exe
1644	ftdisk.exe
704	DHCP.exe
1644	ftdisk.exe
704	DHCP.exe
1644	ftdisk.exe
704	DHCP.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
704	DHCP.exe
1644	ftdisk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2384	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	30
PID 2544 wrote to memory of 2384	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	30
PID 2544 wrote to memory of 2384	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	30
PID 2544 wrote to memory of 2384	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	30
PID 2544 wrote to memory of 1676	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	31
PID 2544 wrote to memory of 1676	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	31
PID 2544 wrote to memory of 1676	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	31
PID 2544 wrote to memory of 1676	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	31
PID 2544 wrote to memory of 2364	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	119
PID 2544 wrote to memory of 2364	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	119
PID 2544 wrote to memory of 2364	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	119
PID 2544 wrote to memory of 2364	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	119
PID 2544 wrote to memory of 2796	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	33
PID 2544 wrote to memory of 2796	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	33
PID 2544 wrote to memory of 2796	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	33
PID 2544 wrote to memory of 2796	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	33
PID 2544 wrote to memory of 2320	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	34
PID 2544 wrote to memory of 2320	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	34
PID 2544 wrote to memory of 2320	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	34
PID 2544 wrote to memory of 2320	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	34
PID 2544 wrote to memory of 2240	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	116
PID 2544 wrote to memory of 2240	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	116
PID 2544 wrote to memory of 2240	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	116
PID 2544 wrote to memory of 2240	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	116
PID 2544 wrote to memory of 1668	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	36
PID 2544 wrote to memory of 1668	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	36
PID 2544 wrote to memory of 1668	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	36
PID 2544 wrote to memory of 1668	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	36
PID 2544 wrote to memory of 2468	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	37
PID 2544 wrote to memory of 2468	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	37
PID 2544 wrote to memory of 2468	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	37
PID 2544 wrote to memory of 2468	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	37
PID 2544 wrote to memory of 2304	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	38
PID 2544 wrote to memory of 2304	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	38
PID 2544 wrote to memory of 2304	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	38
PID 2544 wrote to memory of 2304	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	38
PID 2544 wrote to memory of 2744	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	40
PID 2544 wrote to memory of 2744	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	40
PID 2544 wrote to memory of 2744	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	40
PID 2544 wrote to memory of 2744	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	40
PID 2544 wrote to memory of 2832	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	41
PID 2544 wrote to memory of 2832	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	41
PID 2544 wrote to memory of 2832	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	41
PID 2544 wrote to memory of 2832	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	41
PID 2544 wrote to memory of 2812	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	42
PID 2544 wrote to memory of 2812	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	42
PID 2544 wrote to memory of 2812	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	42
PID 2544 wrote to memory of 2812	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	42
PID 2544 wrote to memory of 2828	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	43
PID 2544 wrote to memory of 2828	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	43
PID 2544 wrote to memory of 2828	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	43
PID 2544 wrote to memory of 2828	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	43
PID 2544 wrote to memory of 2924	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	44
PID 2544 wrote to memory of 2924	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	44
PID 2544 wrote to memory of 2924	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	44
PID 2544 wrote to memory of 2924	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	44
PID 2544 wrote to memory of 2808	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	45
PID 2544 wrote to memory of 2808	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	45
PID 2544 wrote to memory of 2808	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	45
PID 2544 wrote to memory of 2808	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	45
PID 2544 wrote to memory of 2772	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	126
PID 2544 wrote to memory of 2772	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	126
PID 2544 wrote to memory of 2772	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	126
PID 2544 wrote to memory of 2772	2544	5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe	126

System policy modification 1 TTPs 8 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\EXPLORER	ftdisk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NOFIND = "1"	ftdisk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NORUN = "1"	ftdisk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSecurityTab = "1"	ftdisk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\EXPLORER	DHCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NOFIND = "1"	DHCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NORUN = "1"	DHCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSecurityTab = "1"	DHCP.exe

C:\Users\Admin\AppData\Local\Temp\5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5c9e80f700149dc90e32d5fe0a99344a_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\SysWOW64\SC.exe
  SC STOP AudioSrv
  2⤵
  - Launches sc.exe
  PID:2384
- C:\Windows\SysWOW64\SC.exe
  SC DELETE AudioSrv
  2⤵
  - Launches sc.exe
  PID:1676
- C:\Windows\SysWOW64\SC.exe
  SC STOP spooler
  2⤵
  - Launches sc.exe
  PID:2364
- C:\Windows\SysWOW64\SC.exe
  SC DELETE spooler
  2⤵
  - Launches sc.exe
  PID:2796
- C:\Windows\SysWOW64\SC.exe
  SC STOP SENS
  2⤵
  - Launches sc.exe
  PID:2320
- C:\Windows\SysWOW64\SC.exe
  SC DELETE SENS
  2⤵
  - Launches sc.exe
  PID:2240
- C:\Windows\SysWOW64\SC.exe
  SC STOP wscsvc
  2⤵
  - Launches sc.exe
  PID:1668
- C:\Windows\SysWOW64\SC.exe
  SC DELETE wscsvc
  2⤵
  - Launches sc.exe
  PID:2468
- C:\Windows\SysWOW64\SC.exe
  SC STOP SharedAccess
  2⤵
  - Launches sc.exe
  PID:2304
- C:\Windows\SysWOW64\SC.exe
  SC DELETE SharedAccess
  2⤵
  - Launches sc.exe
  PID:2744
- C:\Windows\SysWOW64\SC.exe
  SC STOP srservice
  2⤵
  - Launches sc.exe
  PID:2832
- C:\Windows\SysWOW64\SC.exe
  SC DELETE srservice
  2⤵
  - Launches sc.exe
  PID:2812
- C:\Windows\SysWOW64\SC.exe
  SC STOP wuauserv
  2⤵
  - Launches sc.exe
  PID:2828
- C:\Windows\SysWOW64\SC.exe
  SC DELETE wuauserv
  2⤵
  - Launches sc.exe
  PID:2924
- C:\Windows\SysWOW64\SC.exe
  SC STOP avp
  2⤵
  - Launches sc.exe
  PID:2808
- C:\Windows\SysWOW64\SC.exe
  SC DELETE avp
  2⤵
  - Launches sc.exe
  PID:2772
- C:\Windows\DHCP.exe
  C:\Windows\DHCP.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops autorun.inf file
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:704
- - C:\Windows\SysWOW64\SC.exe
    SC STOP AudioSrv
    3⤵
    - Launches sc.exe
    PID:2212
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE AudioSrv
    3⤵
    - Launches sc.exe
    PID:2440
- - C:\Windows\SysWOW64\SC.exe
    SC STOP spooler
    3⤵
    - Launches sc.exe
    PID:1704
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE spooler
    3⤵
    - Launches sc.exe
    PID:1136
- - C:\Windows\SysWOW64\SC.exe
    SC STOP SENS
    3⤵
    - Launches sc.exe
    PID:1560
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE SENS
    3⤵
    - Launches sc.exe
    PID:1116
- - C:\Windows\SysWOW64\SC.exe
    SC STOP wscsvc
    3⤵
    - Launches sc.exe
    PID:2508
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE wscsvc
    3⤵
    - Launches sc.exe
    PID:844
- - C:\Windows\SysWOW64\SC.exe
    SC STOP SharedAccess
    3⤵
    - Launches sc.exe
    PID:1356
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE SharedAccess
    3⤵
    - Launches sc.exe
    PID:1592
- - C:\Windows\SysWOW64\SC.exe
    SC STOP srservice
    3⤵
    - Launches sc.exe
    PID:1284
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE srservice
    3⤵
    - Launches sc.exe
    PID:1796
- - C:\Windows\SysWOW64\SC.exe
    SC STOP wuauserv
    3⤵
    - Launches sc.exe
    PID:1288
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE wuauserv
    3⤵
    - Launches sc.exe
    PID:1528
- - C:\Windows\SysWOW64\SC.exe
    SC STOP avp
    3⤵
    - Launches sc.exe
    PID:1532
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE avp
    3⤵
    - Launches sc.exe
    PID:1652
- - C:\Windows\SysWOW64\SC.exe
    SC START Themes
    3⤵
    - Launches sc.exe
    PID:2792
- - C:\Windows\SysWOW64\SC.exe
    SC STOP Themes
    3⤵
    - Launches sc.exe
    PID:2016
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\_dsP.bat
    3⤵
    PID:2444
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls C:\C_Diaco /d SYSTEM
      4⤵
      PID:1680
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls C:\C_Diaco /e /r SYSTEM
      4⤵
      PID:756
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls F:\F_Diaco /d SYSTEM
      4⤵
      Enumerates connected drives
      PID:1532
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls F:\F_Diaco /e /r SYSTEM
      4⤵
      Enumerates connected drives
      PID:1580
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\_dhS.bat
    3⤵
    PID:1744
  - - C:\Windows\SysWOW64\diskpart.exe
      Diskpart /s C:\Users\Admin\AppData\Local\Temp\hcdRS.txt
      4⤵
      PID:1620
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\_dsP.bat
    3⤵
    PID:2268
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls C:\C_Diaco /d SYSTEM
      4⤵
      PID:572
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls C:\C_Diaco /e /r SYSTEM
      4⤵
      PID:2024
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls F:\F_Diaco /d SYSTEM
      4⤵
      Enumerates connected drives
      PID:2276
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls F:\F_Diaco /e /r SYSTEM
      4⤵
      Enumerates connected drives
      PID:1556
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\_dhS.bat
    3⤵
    PID:2884
  - - C:\Windows\SysWOW64\diskpart.exe
      Diskpart /s C:\Users\Admin\AppData\Local\Temp\hcdRS.txt
      4⤵
      PID:2724
- C:\Windows\SysWOW64\ftdisk.exe
  C:\Windows\system32\ftdisk.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops autorun.inf file
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1644
- - C:\Windows\SysWOW64\SC.exe
    SC STOP AudioSrv
    3⤵
    - Launches sc.exe
    PID:2208
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE AudioSrv
    3⤵
    - Launches sc.exe
    PID:1616
- - C:\Windows\SysWOW64\SC.exe
    SC STOP spooler
    3⤵
    - Launches sc.exe
    PID:2084
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE spooler
    3⤵
    - Launches sc.exe
    PID:1804
- - C:\Windows\SysWOW64\SC.exe
    SC STOP SENS
    3⤵
    - Launches sc.exe
    PID:1844
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE SENS
    3⤵
    - Launches sc.exe
    PID:920
- - C:\Windows\SysWOW64\SC.exe
    SC STOP wscsvc
    3⤵
    - Launches sc.exe
    PID:2928
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE wscsvc
    3⤵
    - Launches sc.exe
    PID:2264
- - C:\Windows\SysWOW64\SC.exe
    SC STOP SharedAccess
    3⤵
    - Launches sc.exe
    PID:3008
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE SharedAccess
    3⤵
    - Launches sc.exe
    PID:924
- - C:\Windows\SysWOW64\SC.exe
    SC STOP srservice
    3⤵
    - Launches sc.exe
    PID:1000
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE srservice
    3⤵
    - Launches sc.exe
    PID:2776
- - C:\Windows\SysWOW64\SC.exe
    SC STOP wuauserv
    3⤵
    - Launches sc.exe
    PID:2708
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE wuauserv
    3⤵
    - Launches sc.exe
    PID:2240
- - C:\Windows\SysWOW64\SC.exe
    SC STOP avp
    3⤵
    - Launches sc.exe
    PID:2008
- - C:\Windows\SysWOW64\SC.exe
    SC DELETE avp
    3⤵
    - Launches sc.exe
    PID:2080
- - C:\Windows\SysWOW64\SC.exe
    SC START Themes
    3⤵
    - Launches sc.exe
    PID:2068
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\_dsP.bat
    3⤵
    PID:1652
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls C:\C_Diaco /d SYSTEM
      4⤵
      PID:1216
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls C:\C_Diaco /e /r SYSTEM
      4⤵
      PID:2796
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls F:\F_Diaco /d SYSTEM
      4⤵
      Enumerates connected drives
      PID:2224
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls F:\F_Diaco /e /r SYSTEM
      4⤵
      Enumerates connected drives
      PID:2092
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\_dhS.bat
    3⤵
    PID:800
  - - C:\Windows\SysWOW64\diskpart.exe
      Diskpart /s C:\Users\Admin\AppData\Local\Temp\hcdRS.txt
      4⤵
      PID:1068
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\_dsP.bat
    3⤵
    PID:1412
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls C:\C_Diaco /d SYSTEM
      4⤵
      PID:2356
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls C:\C_Diaco /e /r SYSTEM
      4⤵
      PID:2992
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls F:\F_Diaco /d SYSTEM
      4⤵
      Enumerates connected drives
      PID:1772
  - - C:\Windows\SysWOW64\cacls.exe
      Cacls F:\F_Diaco /e /r SYSTEM
      4⤵
      Enumerates connected drives
      PID:992
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\_dhS.bat
    3⤵
    PID:2388
  - - C:\Windows\SysWOW64\diskpart.exe
      Diskpart /s C:\Users\Admin\AppData\Local\Temp\hcdRS.txt
      4⤵
      PID:1392

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
1⤵
PID:672

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1704827805149982528815524916118283589711444933068214710833712563376961646910835"
1⤵
PID:2364

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-911788948103150655863704118610090194451259911826-1110410361-7709985831798383701"
1⤵
PID:2772

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2148

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:880

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1808

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_dhS.bat

Filesize
30B

MD5
e364adc1af8dcd8855917c5f5e5aa32b

SHA1
95946e4905d32aba06e5e8f8df345ac2e80e688c

SHA256
0712c019ea16c5cd38cd6d71e7087abace758c7abbc63c5e4410fb9f6cb40b5f

SHA512
0faa612365b28429080983c1835595f74d5b1d94cae04418adcc1896871e84a1333f1f8f2715ae2c6951ee3cc452fb47f9bad1e31faa61b04f8fe8222f924d73

Download Submit
C:\Users\Admin\AppData\Local\Temp\_dsP.bat

Filesize
154B

MD5
a9175117fbe053af5801fab1fc1d10c2

SHA1
a73480add868d1b38301c6a9357305f5e26a3937

SHA256
b0aed7ed335174276eff28862bc12a7ec2068c7f120d05ed0c1c97ef769c7d16

SHA512
9ca0c82fcfe6179a3fb3031d2f8418ecf5155a876a0f667573a4249e51f72d1a673e182c0b7adc5efad12b246f324212a6e5a9bf1b239b46129dc9fffe8736c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_dyR.txt

Filesize
3B

MD5
3841822014f738222634f8040e3e5fef

SHA1
035aad85eef262df6c47a767762832f093d7411a

SHA256
b259bcb434250e59221023c52831a95998cc89345587a711578627e51ade37ec

SHA512
371b4cb8353a240dd6897b1af0a79d9e96c6e7e481a83f82dd21b175b292824df43f3e41d0c9b28409c2ae8cb2bcfe01619e2dbd560a001795433178b9dc21d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\hcdRS.txt

Filesize
56B

MD5
274a7ef1109cd1b66e34dee14669cbdb

SHA1
dc318e1568d7e5b9440556ec94d42b1f3c1bbafa

SHA256
1343f7baec62086f30e2135dde0a8c152903e0531dd6747ee9b63ec04effff32

SHA512
cbd0b86c452edbf4c1c2d78b724ee913c2f67d53458148f1bc2355d1ee420f1d5719cc0560a677c2189be0f6663cc94e430efce961297e54c251234b0a04ccdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\hcdRS.txt

Filesize
70B

MD5
a032766ba071c84d6753494860262f8a

SHA1
322ece9396bcc9f37835f089383b807f0c528192

SHA256
b9dc0cbc1d166e8b291bc737fc7a4431320b276ab803039509eef72a969eed56

SHA512
603870a15175a8a0edf321173b8b75d4566564f44f9de1c3818bedeac64f40170942562a0bf87f1e693435a59d02ad85cf70d6fc0e65ec2f4c4ca29cafe5857c

Download Submit
C:\Windows\DHCP.exe

Filesize
1.7MB

MD5
d0977d0419a3a148f9d31e316933a0d6

SHA1
97564772d0f81b63ce1504a630b89f0e6cd95ae1

SHA256
e0f416fd0e6c14bd2362f782adf257f0a6decb8afb130a98f53055a044e1d0cd

SHA512
fefc48c0e06d7d85e10d95042f4a9b3ff4b361afed41518c89d5a77c08860804329d31910fd4088df771759fdee3b8ca05a941d71affa2cd2b1a1a6bdd6c3230

Download Submit
C:\Windows\Media\funnu.wav

Filesize
1.6MB

MD5
52919d30f9e9e01aaff631fdd5cfc672

SHA1
147c08174cd2d5fd78bc4f66e640acbdc1576fbc

SHA256
63abac1e77623c41bd0485e634a0858f17ee0d57f203ae21a51ea8aa0e0fcd9e

SHA512
300cf3bb1a0190f27a7463891d4d77a04e4abe9d1cdcfda51abd622e3f6f76c2e14764b36a0a0e501e319321e807c6f0dd4f648b11bd832235f07beaf899b52b

Download Submit
C:\Windows\SysWOW64\ftdisk.exe

Filesize
1.7MB

MD5
4d156fb568f051e7c49b11ef3cedc3b2

SHA1
ba5b0f0f384a551348a69d3ea2157c6fff2ebf6b

SHA256
e985a91a5665d0c05b497c140c4b68bfc778d904d0e99a7da0e8078d5fa08597

SHA512
b44face66251a79726766ac2b7a99f74b1baaa76d13cd9d7b329f6fbb53e5bb7608219f744921fb8e1f73dd0352c7cbc4bf6743b449866de785f059cbc82cf5c

Download Submit
C:\Windows\SysWOW64\initgdi32.cui

Filesize
1.6MB

MD5
40bfc7b479145c9fdfed9320fc84a22c

SHA1
1dc0714068f56e521f2ad12d2d4dac6e00bbb1ab

SHA256
172e0d28a5079d8b1c18586ccdb3c7c19bc3f2f3df12ca05ad302c3b43b6be18

SHA512
2d460396b0af02ef06b64e8f1c903639ed7aac799f1a9668ed41a25bffcd25452c3e258cf96b65a8811c508a9b36e9a28418fb944f43bcf495d3735f6fb371aa

Download Submit
C:\Windows\Temp\Drctx.bsti

Filesize
1KB

MD5
790c3f0c0ec3525d69efd88e9355de96

SHA1
a605cd2bd84d2d4096cd8f85d3baae9d120f1c70

SHA256
611ab7718034cdeca3b1540ea5b5b3d509750ac2e7d9b423b7f3cc20e52ca376

SHA512
4f383c4820602e61c27390ccc75ee7e76995dc7fdcf6c5e3313f7f754436505919d81b6a83f86478ed3490e66bc6b7e06a1b7e45d5fedccbdc18dc4b96472cb5

Download Submit
C:\Windows\Temp\Iter.inx

Filesize
14KB

MD5
a3b40ae1ea1007b944035a89e96eb21b

SHA1
323f6de8b18484ae979f479653132edbb8677142

SHA256
485c1d5ed308e41fa543d97855766f145867eb91882b172db3eb9ea6280d0ba4

SHA512
d9e26174c3e69fe40b53e8c91554e49b61705352357ecd0afc5a10b548623ec4c3d65799238a99e65c93e1b2e49416510e75470d0f10fddebd411c15002a09c6

Download Submit
C:\Windows\Temp\chk.chm

Filesize
14KB

MD5
144b85f03abbfab788298dfb9fa4b7a8

SHA1
97d2a008c95ca8b094e91b74d99f5959fe3fe7e4

SHA256
02241e88aa5dd0b99d4e9130f4d0557caf5c61eec5d6fc150fe54a5fe1542a0e

SHA512
25e0aedffc33a82807c63ad9694ac5f0605edf769a73986eb5121334db75a700781c0d202575f8b38d34fa20e53b7f1ca931e319179014482e7f336c63a97fef

Download Submit
C:\Windows\Temp\dos.cli

Filesize
1KB

MD5
11ec3af30ebabf1d7e9c36304bf4f57b

SHA1
c5aa8682392037064f8a0b852b84bf78455f5bb8

SHA256
a1d354df63b96640b5e61f9d5ce1d1cb9db501899683fb856d5bffa02a7ceece

SHA512
9223bfc220f0475ee81c220f8286776b2e6a93ac98d4fdc1e24c14de0084224da24c8b2f61bcd0ec6c4357d89ea6fc515fdc3ce78e0778c1bea0a4e3afc5b306

Download Submit
C:\Windows\Temp\ent.bnt

Filesize
1KB

MD5
97e8a304d95bb98ea34d1f54039cebe5

SHA1
26b51816c8145b5fd4a499c90b9c2fe38590a86a

SHA256
b26468b5b105833c8c557441e84892c8e620563ac0fb226a45580fdaa1bd7f4b

SHA512
8bdbdb526cc5933059512bc2f3889be2c2911e4736d0fa9110eb83b648fcff25906ab6993261dd6600888f4ae72e16036ea9f0866b742501b0668c53d8fe0156

Download Submit
C:\Windows\Temp\fldR.lnk

Filesize
17KB

MD5
f4fac00cb7f1638353ae9c0957fd4e69

SHA1
62f5b31658f60fdddc1fe8b2e5e99ebddac7083e

SHA256
67fde9c9f53ac9f14ca76c9bb912ae006083a19465fbf73a45e1e411c1c9e1bb

SHA512
41a031241d05e9f58e24055a71e67a23e03257c1c8c37b4190b92dc3d4a8c0e8d14f87a4d52a548915dc3c152fdf7098306391cc21fd20f045513be0b30de39d

Download Submit
C:\Windows\Temp\msi.cmu

Filesize
14KB

MD5
4659511a62321b0ed69c38a5dfe8fb95

SHA1
d74f52bd08d95776c84777892d1d099dd2836918

SHA256
a7b694859598040c5f854d40600eb02c343279bbc098b559ad6e9ed935082e1e

SHA512
bee9e33a2dbd5a9d254f5d776f81617dd80e06bb10cc26ad9b9535600c1beb490e7806462ac9bafef3af179c4936f51f5f9b4a91bea3c88d31b1f47e457f11fa

Download Submit
C:\Windows\Temp\plknfs.cab

Filesize
14KB

MD5
d9740b9d8b8e7ede7d0a1e12dc1c71a0

SHA1
452a256fcb5dbdaaebb3e169ddcf845877555e29

SHA256
d21c73bcd86c6041bd8c4a533e948b7d9b7f701a4a5b13c784b3a8f071e903f7

SHA512
fe2db2a23225a880f05dc74af61fd00fe8e25967eb3851162e3b67ad11f78339178ebbcbb7dc2176504a4b38274b7be221b463119ab5b3ee8806a5bfa1fa4534

Download Submit
F:\Autorun.inf

Filesize
145B

MD5
384005d30a82e12a6223861eeb85ac7e

SHA1
2c1aa5dc2744617e8d42e2c3270596fa92cc17c6

SHA256
77a9539c1ede9ec5e331076ca2fe1103c4318b96a5d72904621b3b47159822d7

SHA512
7ff368c01638e9701138f20b108e02b8d1e9e4d7b40443fa00429b8bf6bd0dfcae8e364281756aa95f95982ff79c843a9b466929ed18d1cca00f418dfb2ef019

Download Submit