gh0strat | db2725ac686e28562c27ef88699ede3bb5dc3cdd58644cf2cb7bd02bb8d36680

Analysis

max time kernel
142s
max time network
141s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 09:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe
Size

196KB
MD5

66fb1bb18e75f0bb0bca89d55afb0ec9
SHA1

52b7f47a3ad12580434f956b21f98547a886284d
SHA256

db2725ac686e28562c27ef88699ede3bb5dc3cdd58644cf2cb7bd02bb8d36680
SHA512

b3541098cf04bdb3bdfec69981e79848afb4da6b1cebc19dfc75dfaa6ba5266c0a6cee180052380c37f6bc4d1c58e47a829f9df5f4c3cd974df3a83b569318de
SSDEEP

3072:1uwTNLvIi99v3kaVfH3b52iOXbbx16B0YMr/F3VvZqsmGqOHXIFBjm1/cY7Kx:PRvpVz5OXp1Y0YMr/FFFm1sUYWx

Score

10^/10

gh0strat bootkit evasion persistence rat

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral1/files/0x000600000001a4d9-579.dat	family_gh0strat
behavioral1/memory/552-581-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral1/memory/984-582-0x0000000000400000-0x0000000000430938-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe D:\\VolumeXX"	mshta.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	mshta.exe

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	3004	attrib.exe	58
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1420	3004	attrib.exe	58
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	3004	attrib.exe	58

Sets file to hidden 1 TTPs 3 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
3024	attrib.exe
1420	attrib.exe
1628	attrib.exe

Deletes itself 1 IoCs

pid	Process
1052	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
2876	inlC13F.tmp
2632	lie8C2B.tmp
916	kilA4AB.tmp
1100	19920306.exe
788	920306.exe
984	frfwoscpug

Loads dropped DLL 12 IoCs

pid	Process
2080	cmd.exe
2080	cmd.exe
840	cmd.exe
840	cmd.exe
1480	cmd.exe
1480	cmd.exe
916	kilA4AB.tmp
916	kilA4AB.tmp
916	kilA4AB.tmp
788	920306.exe
788	920306.exe
552	svchost.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	D:\VolumeXX\desktop.ini	mshta.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	svchost.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\glcbymemya	svchost.exe
File created	C:\Windows\SysWOW64\gtgygyndyg	svchost.exe
File created	C:\Windows\SysWOW64\wbem\fxsst.dll	inlC13F.tmp

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\frfwoscpug	920306.exe
File created	C:\Program Files\temp01\XX.exe	kilA4AB.tmp
File opened for modification	C:\Program Files\temp01\XX.exe	kilA4AB.tmp
File opened for modification	C:\Program Files (x86)\WinRAR\Formats\Date\E%SESSIONNAME%\wsseh.cc3	frfwoscpug
File created	C:\Program Files\Common Files\19920306.exe	kilA4AB.tmp
File created	C:\Program Files\Common Files\920306.exe	kilA4AB.tmp
File created	\??\c:\program files\frfwoscpug	920306.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	expand.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427890293"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000064d88521001684637eb336c81bf75a6313565c62c4d3ae6e65274d4accd7eb38000000000e8000000002000020000000ed456edb6322e406442d3aa89e7fdd118dd4af6e5890281d2e77b65eb7f6db1a2000000030671440fa573ca925db3c33e5e76a7ce975b93be6a07e9dde1331f6eab44ed44000000024db013b77835738bb57bcb746e7f6e29a3baecbcf6386bad74e9f7baa5bda020241d46f59f0bd2fb5ae14e6565712140f305022f1382c5493a67f10f2b587b8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1177238915-1004336348-682003330-500\Software\Microsoft\Internet Explorer\Main	mshta.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60d24b4be6dcda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000000cc681d62ea295b09566b7a2c3a29b871b8b9f7d6203d321e65c2ce0427c4189000000000e8000000002000020000000498925ed6f51bacca0016e17fdfbcfd64ae1d267860f3234d06d7926db7c99a19000000037814c145cfc03bb095ade561aac837fa12302c9e65fffd9c09c137aae39f500a90d67529cf38e4dc96c57b747523e3166539f562874aae8271bc987f8a7bdc494a8b3a3a0c446390b5378debdb9e8f4eb88e925fcdf17b32289cad791ca769ecc07c3d8ddd6562a2f4c1ec99e910cc7218c77549e075847c677059249b7c220f106d63c748379fac80dadb00f6338cb4000000045cc8fab6651ebdcd0e726040a9cb3312c055bf6787f766add97c832824acac0c3e2be887368ce63759eedb3c77cf9335c871339bc4bdc1f2a9334fcc436f6c7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{73D5D781-48D9-11EF-AAA3-7AF2B84EB3D8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.4191.com/?hta"	mshta.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	svchost.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	mshta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	mshta.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"	mshta.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}\IsShortCut	mshta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}\shell\open(&H)\command	mshta.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}\shell\open(&H)\command\ = "mshta.exe C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\NTUSER~1.HTA"	mshta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}	mshta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	mshta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}\shell	mshta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}\shell\open(&H)	mshta.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1108	PING.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2876	inlC13F.tmp
916	kilA4AB.tmp
984	frfwoscpug
552	svchost.exe
552	svchost.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2556	66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe
Token: SeRestorePrivilege	984	frfwoscpug
Token: SeBackupPrivilege	984	frfwoscpug
Token: SeBackupPrivilege	984	frfwoscpug
Token: SeRestorePrivilege	984	frfwoscpug
Token: SeBackupPrivilege	552	svchost.exe
Token: SeRestorePrivilege	552	svchost.exe
Token: SeBackupPrivilege	552	svchost.exe
Token: SeBackupPrivilege	552	svchost.exe
Token: SeSecurityPrivilege	552	svchost.exe
Token: SeSecurityPrivilege	552	svchost.exe
Token: SeBackupPrivilege	552	svchost.exe
Token: SeBackupPrivilege	552	svchost.exe
Token: SeSecurityPrivilege	552	svchost.exe
Token: SeBackupPrivilege	552	svchost.exe
Token: SeBackupPrivilege	552	svchost.exe
Token: SeSecurityPrivilege	552	svchost.exe
Token: SeBackupPrivilege	552	svchost.exe
Token: SeRestorePrivilege	552	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2808	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2808	iexplore.exe
2808	iexplore.exe
1560	IEXPLORE.EXE
1560	IEXPLORE.EXE
1560	IEXPLORE.EXE
1560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2080	2556	66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe	30
PID 2556 wrote to memory of 2080	2556	66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe	30
PID 2556 wrote to memory of 2080	2556	66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe	30
PID 2556 wrote to memory of 2080	2556	66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe	30
PID 2556 wrote to memory of 2052	2556	66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe	31
PID 2556 wrote to memory of 2052	2556	66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe	31
PID 2556 wrote to memory of 2052	2556	66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe	31
PID 2556 wrote to memory of 2052	2556	66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe	31
PID 2556 wrote to memory of 1052	2556	66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe	34
PID 2556 wrote to memory of 1052	2556	66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe	34
PID 2556 wrote to memory of 1052	2556	66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe	34
PID 2556 wrote to memory of 1052	2556	66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe	34
PID 2052 wrote to memory of 2888	2052	cmd.exe	36
PID 2052 wrote to memory of 2888	2052	cmd.exe	36
PID 2052 wrote to memory of 2888	2052	cmd.exe	36
PID 2052 wrote to memory of 2888	2052	cmd.exe	36
PID 2080 wrote to memory of 2876	2080	cmd.exe	37
PID 2080 wrote to memory of 2876	2080	cmd.exe	37
PID 2080 wrote to memory of 2876	2080	cmd.exe	37
PID 2080 wrote to memory of 2876	2080	cmd.exe	37
PID 2876 wrote to memory of 840	2876	inlC13F.tmp	40
PID 2876 wrote to memory of 840	2876	inlC13F.tmp	40
PID 2876 wrote to memory of 840	2876	inlC13F.tmp	40
PID 2876 wrote to memory of 840	2876	inlC13F.tmp	40
PID 2876 wrote to memory of 2808	2876	inlC13F.tmp	42
PID 2876 wrote to memory of 2808	2876	inlC13F.tmp	42
PID 2876 wrote to memory of 2808	2876	inlC13F.tmp	42
PID 2876 wrote to memory of 2808	2876	inlC13F.tmp	42
PID 2808 wrote to memory of 1560	2808	iexplore.exe	43
PID 2808 wrote to memory of 1560	2808	iexplore.exe	43
PID 2808 wrote to memory of 1560	2808	iexplore.exe	43
PID 2808 wrote to memory of 1560	2808	iexplore.exe	43
PID 840 wrote to memory of 2632	840	cmd.exe	44
PID 840 wrote to memory of 2632	840	cmd.exe	44
PID 840 wrote to memory of 2632	840	cmd.exe	44
PID 840 wrote to memory of 2632	840	cmd.exe	44
PID 2632 wrote to memory of 844	2632	lie8C2B.tmp	45
PID 2632 wrote to memory of 844	2632	lie8C2B.tmp	45
PID 2632 wrote to memory of 844	2632	lie8C2B.tmp	45
PID 2632 wrote to memory of 844	2632	lie8C2B.tmp	45
PID 844 wrote to memory of 1108	844	cmd.exe	47
PID 844 wrote to memory of 1108	844	cmd.exe	47
PID 844 wrote to memory of 1108	844	cmd.exe	47
PID 844 wrote to memory of 1108	844	cmd.exe	47
PID 2876 wrote to memory of 1480	2876	inlC13F.tmp	49
PID 2876 wrote to memory of 1480	2876	inlC13F.tmp	49
PID 2876 wrote to memory of 1480	2876	inlC13F.tmp	49
PID 2876 wrote to memory of 1480	2876	inlC13F.tmp	49
PID 1480 wrote to memory of 916	1480	cmd.exe	51
PID 1480 wrote to memory of 916	1480	cmd.exe	51
PID 1480 wrote to memory of 916	1480	cmd.exe	51
PID 1480 wrote to memory of 916	1480	cmd.exe	51
PID 916 wrote to memory of 1100	916	kilA4AB.tmp	52
PID 916 wrote to memory of 1100	916	kilA4AB.tmp	52
PID 916 wrote to memory of 1100	916	kilA4AB.tmp	52
PID 916 wrote to memory of 1100	916	kilA4AB.tmp	52
PID 916 wrote to memory of 788	916	kilA4AB.tmp	54
PID 916 wrote to memory of 788	916	kilA4AB.tmp	54
PID 916 wrote to memory of 788	916	kilA4AB.tmp	54
PID 916 wrote to memory of 788	916	kilA4AB.tmp	54
PID 788 wrote to memory of 984	788	920306.exe	55
PID 788 wrote to memory of 984	788	920306.exe	55
PID 788 wrote to memory of 984	788	920306.exe	55
PID 788 wrote to memory of 984	788	920306.exe	55

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3024	attrib.exe
1420	attrib.exe
1628	attrib.exe

C:\Users\Admin\AppData\Local\Temp\66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\66fb1bb18e75f0bb0bca89d55afb0ec9_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Users\Admin\AppData\Local\Temp\inlC13F.tmp
    C:\Users\Admin\AppData\Local\Temp\inlC13F.tmp cdf1912.tmp
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\run_lk_file.bat" "
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:840
    - - C:\Users\Admin\AppData\Local\Temp\lie8C2B.tmp
        
        C:\Users\Admin\AppData\Local\Temp\lie8C2B.tmp
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2632
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\run_rlh_tmp.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:844
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 88.99.00.00
        7⤵
        Runs ping.exe
        
        PID:1108
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Roaming\MICROS~1\NTUSER_LOG.hta"
        7⤵
        Modifies WinLogon for persistence
        Modifies visibility of file extensions in Explorer
        Drops desktop.ini file(s)
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        Modifies registry class
        
        PID:272
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://tc.92mh.com/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2808
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2808 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1560
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\run_kl_file.bat" "
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1480
    - - C:\Users\Admin\AppData\Local\Temp\kilA4AB.tmp
        
        C:\Users\Admin\AppData\Local\Temp\kilA4AB.tmp
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:916
      - C:\Program Files\Common Files\19920306.exe
        
        "C:\Program Files\Common Files\19920306.exe"
        6⤵
        Executes dropped EXE
        
        PID:1100
      - C:\Program Files\Common Files\920306.exe
        
        "C:\Program Files\Common Files\920306.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:788
        
        \??\c:\program files\frfwoscpug
        
        "C:\Program Files\Common Files\920306.exe" a -sc:\program files\common files\920306.exe
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:984
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\SysWOW64\expand.exe
    expand.exe "C:\Users\Admin\AppData\Local\Temp\favorites_url.cab" -F:*.* "C:\Users\Admin\Favorites"
    3⤵
    - Drops file in Windows directory
    PID:2888
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\66FB1B~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1052

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:552

C:\Windows\system32\attrib.exe
attrib +s +h "D:\RECYCLERMD4"
1⤵
- Process spawned unexpected child process
- Sets file to hidden
- Views/modifies file attributes
PID:3024

C:\Windows\system32\attrib.exe
attrib +s +h "D:\VolumeXX\desktop.ini"
1⤵
- Process spawned unexpected child process
- Sets file to hidden
- Views/modifies file attributes
PID:1420

C:\Windows\system32\attrib.exe
attrib +s +h "D:\VolumeXX"
1⤵
- Process spawned unexpected child process
- Sets file to hidden
- Views/modifies file attributes
PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\frfwoscpug

Filesize
24.2MB

MD5
2ebc555f24de2388b726c6e69d30f3fc

SHA1
2521743cc5bf3229284bf5ec179115eaaede7b39

SHA256
7dddbda0745f9656adfe7dff4097fbceaf22e2578db9ad9cbc0b6f34e1c79f61

SHA512
1d20b0be837e269d71854cf674969591b4364f5cb79e433079b945630e8e5ee83fe2855158c9109e6c6424761b9e3f10d01a571edcc59a098b4b653170585467

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9874f901d0a5e9e3160dc9408a89a699

SHA1
20da0c198efae5cb162c77003e1007c198adc54f

SHA256
fd5d8d52e058a539d9869c95c9c50f0439a3ce867e7cb4006b6222b055fab7f9

SHA512
92c8403615d7f3b291808a1c3e9c2bfa7886fb721f4e2288820bacb907b3f1fba720010be5674de44775944ece667f52e8c5dbed7725e51b4423dc4647c653ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ca9fb6c6a2ae35f6f109e23eb7d8461

SHA1
62bcccf6e6f86b3852ae8425a04c2616dd088377

SHA256
f2551a9f1dacc3daf97ed7b520cccf26be70dfbd948559976a27fd036aaa2d68

SHA512
a6300edfe6904e4272450eee16fb6ff8a4151bf21f9fe4a23ecc5e99385838823f4f9dea59f1e5c842ea8d21f7c454159c59de682f01adb1ba62bf975d1f1ca7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31c527aec78094b041d2260913705cf3

SHA1
3d625e9865016c7c6a0e5ccf1e8d265dd2a668f6

SHA256
16b2ed2647bbf72aeb26258e209c8b2f5e37d3b8ac4f436158015722732652bb

SHA512
90a3b6e2823d80b2b03adf671e29c00d356ef7225a366ce872c93c9bce4e3cd0d47ba6e2b5c5540cd6e85dbe384258116cc01f343a441a4900fa59e3d424e26d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4194445b2a51dc5bf04be4e0d52b67ee

SHA1
107b6e1f8713fc492da05b17e8fa1fb3175f16b8

SHA256
479f09cc5ab1a58bd7ee6b80f83c03ded341437cb7c06e02abf4f34967e76636

SHA512
1f5cc2dade63a070384da29c383118fa2abf30f202f66304f9d604568faeefe02a9319cb2f4a464aa48a894da6cc384ae7d9a68eee90867f6f27d7df450cd109

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90dec120a3b3906871dcd0e0d325d0fd

SHA1
5dee640d162a1aafd411c08b60d079bd41903251

SHA256
4613f13f7e7cb802c948bc90cdaafbd4877a97cd93da507081fe77edf589a564

SHA512
c20b25a9d8c381e9877ee83e1b898149f5b4bc38176b1263cb486ed2de7ff46cb01c98857a74fe5ce74b436569dd61092ea204ea999f686444ae00ff5480c59d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aacd677c45815cc8e3b16e7aadd59c37

SHA1
478e1b472fb7be0334fb5b34ef0287a45f7f5d56

SHA256
c280e2bb22ebb1b72abd05b37a19099e341794402dae5d9bf1297648ac3fd9bb

SHA512
63192b47c972f48f308b48b2086604dd6ebd2132e8f6a46aab723e962258bfff2e1eb080e9e437346ada821a3dd902b66352274b3bb95d8b29612b63630b4325

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cdd46cabf2a80c38044bba0961c0d7e

SHA1
4c08a3e0303e9efacec87863aa37a4d413a968b8

SHA256
d57fdc90b829e661a5dc533c892e130cb689d78b1405cd982b21680cc32fc926

SHA512
9fcc770938db6c629d76293c7ac61ddf54d61ee484f69bb6e8ffab99363ea87fe143758d5ae16e01f7eba2f90c654f1c531839694cd5ac97b56dc557451be1f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
678cbc1a39edc5bac1bf725a369da851

SHA1
4c70e70c2bbb1545eb0efc7d9786c24d617e80b8

SHA256
688f3402ffeab58523f7d4827b2e096c1889364f9df4586999079469aa70d622

SHA512
52616f3cb7f41ac7ffa9b43c7bc00eefed53f7d9d18e02391eaf058ac484a5022514c8583ccd1c344501fe20c822d3265c742c94a69be9553c866c5e573ec096

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a9c4539d1a87476a658f64b96fa551a

SHA1
fef930f43ca1455c497df71294a7c1e81ed73095

SHA256
684138c66ea7500c131331cb6f97a0d8a27f8474e3cda15e24c1423413578903

SHA512
f0a8b3a9ccab59b07ed96bc46fb4f3a1ddc7fd2f72c931c0b7aca93066d6158df954d7e8cc4b740ba23ec094d4e67d93b755095f94e03ba18eb31124dba41a37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13ccba185ab1d8a25575f00125b16af2

SHA1
42e6a866bdb53831c2098ad16667351e0b877bf4

SHA256
8dc5eaee4ec041c419ca747fb30afb6866e893bf14bf0e2d0db1220f31f23912

SHA512
2ba3c0eb591b9bc2cf8c59e913c8af24827ba14e024929643229391afe4257c7f0e18d3f57304a6dc8d24f8b64971a49b0a650ce339e0d0063746f1a3ebb016a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
839c0211bf09e6033b503313d650d76d

SHA1
d6efd78a43b6f3c0d2733fdb01493db184a2e1ee

SHA256
4209437d9317e67d6cf12d1a9962561b711cc1b88da679d700af7a50dd558671

SHA512
bdca2887faaeb123a342c5c74cd1a19184b7bcfc8dd05b300b3fda60c61c93d721ffbed27be2d0a1f928739ecd79133134e931d0bdcfc29ef92f1e7380358e76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c6960838bdf0e00c93875b4f4144db9

SHA1
49ed84ea90d15c5e21a15f2ac580c4ff7c50c07e

SHA256
2ef34538aff34301334cf9084233b47e5a20fbd0cc998c91a8a37dfae7e7c130

SHA512
5d5d4627e77fbfe8856ef58363e3f61e720d74ba73abb218597f17ae655bc576107e59ddebc2f4c2627398d851ad9c2cfd12f813ee6737e3139d64e0562c338f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c1f8a3e2354dd07328bf9fc932e3aa4

SHA1
37cbd51d76f7f09eed22b1df9b9c81e7e3d9ac5d

SHA256
0572a0672057f4fde10f1f9a65ef3d90df5bf7d307423a9d5e214ff448921350

SHA512
154f33001ac44b684aa8c2bffc86894940b2af79bd1adbcd6885d144345e8d3968be3c9dde0d6e0ddb65dbb62ddf67c6bca7901e67c77f7c67a1040cedf35e2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c676442aa46070bf4ad1fadb21315667

SHA1
a0312f85cb3025256820d9f2b0cec01bdb0edfd1

SHA256
2c89447c37eadb2f5e1cdcb3b157b934f4f14fae8efcb66ced835ff7046defa8

SHA512
d249dbb132a0b656d5843ab7bb80f611e0dcddaa4eda45d9b8ffc147e6ae8d51f54e7529ce6533b4f0c8d5ba39902703ba8989fd72fba72c0393513f9d6d8dc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1fb0efabbe4d3b8be82a8e0688114e0f

SHA1
dec9b3b90952271fe0ca0811c68f1c14fdbab399

SHA256
e392ed431c54e9280e0864672e5575d1d339d596d1b773d54f9c9297361e2c83

SHA512
cf251aecd7dd18970e50e68036646f38d6746ea0d9e46127a5b5c6909707d96c33cf4056db70f54d36f130a7b2f76234e550861a34477f49ef816b025b814cb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0402728975a607c12fec288e2a3b6347

SHA1
0741e39602b275651786aec7961dcb3f17ba2d1e

SHA256
aec09ecd23e7ef341bd6caf21cd161bb294cfeeb7e65abd1d1dc00cd645ab526

SHA512
be9f1e30f9301087c6726c6f196872785efaa7736f3a585955272554e5b023f160be1ec6b39b35a1307e51f987bba8d64c75044355b22e4ac1331af7012b1151

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
266e25738b8adc31483c37e8fb1e81ce

SHA1
33193b48030877fc59d248b605df596fb4096af4

SHA256
62ee73aaf546c5f6d4535dd73edf9a68b64a4cb1fea7c85a9ebbb834b9f2d1df

SHA512
e44673ec08e603b8e7c6f1270d7bb9c300ea2d6d3152a1fc759b804dc0cf917d50d6faaeccbbeaf02230d597443a71b3bdc9173eaaccfec8c3520be731718315

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17278beccbbcfb4ead6329b86ee7ad1e

SHA1
aac5b37c445bbd9e27193a81a290709e16df9453

SHA256
699b60e62e9463700ab4a5c276e2356e4590457e7c918a99f97fe164cc3d0779

SHA512
a9f737f92a7fd24ff1e5111378829e8eddca9ea231646d6e3fb625f9e8b2b38990e6ee769382a8a8d554a7b66c080742914ec99eeeb8af2416ef7e1a22d15e38

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB79F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB81F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

Filesize
766B

MD5
b69d002455f1a5a100e717a6a84ff991

SHA1
3a99b22845afb2132300095d84534e65823e678d

SHA256
c05465e73465c2d6addc7514ad50b517675ce26bfb1a4cad3d3b64b617940934

SHA512
1f2e36f1e8c6f66ba746a3450a9f5c07f300bff4682e32344541596b0bdae7e3f443f3e25deaa7936195c48642f9268e3a626a4018772417ce48d26e4f9d1505

Download Submit
C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat

Filesize
57B

MD5
992342e0c40fb5198d006af557bb4c3b

SHA1
f61c605d63a4d5cef4bb97a30407e536c5fe2164

SHA256
5ce5d159402e3cca63eaffbf853954109e6b2e54bc829e3b2e9449e9990acc68

SHA512
84c0323a1bf02c0fccfbad452a96c24c4428e6e25daec4444ac3a180105673163e9c5db5d24eea8d95a068c3dba589db1d61fa30484f11f0397286da0944430f

Download Submit
C:\Users\Admin\AppData\Local\Temp\run_kl_file.bat

Filesize
45B

MD5
92cf97f84f9d72c40b545fd34892c8f2

SHA1
c3d7d0dbd9f9aba840846bb3492a16217c5b7705

SHA256
24f47a172745f5704b2c99c40466067fb220c55ad8d9a652160fd71af28ed2d4

SHA512
af5bbf5db449acdeb03dab6ce08f9f1ef77bc6ecd035eb733fd8855c8c00e0e876b6e8b515d5ef57579e0f42c3f8664d08d02017f8eca475098508c30614abc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\run_lk_file.bat

Filesize
45B

MD5
90a0d913607a67481d2b119e6e108ec8

SHA1
2008ab055006efa35af6c4afb7e994c269e35371

SHA256
ba9457e2f6a43fde58ba6f20e151e2d88d61eaa32be6f9e80a2cee49c346882d

SHA512
81b4a238a63da50d63f09ecd7569a98dc16ecaccf10cfd57c919e5abcd814b6135af8e98afc6114f38b9a83c46829396d198da97e65dfa5cfd07a5b0796cd393

Download Submit
C:\Users\Admin\AppData\Local\Temp\run_rlh_tmp.bat

Filesize
70B

MD5
edea5cd5060d69b6c558fea75e330a67

SHA1
929e7c5ca8c300a98ac6833d0e8fa912ca9fa5dd

SHA256
1ed1bc8bfd84479497b2c1e3d0ca1df56eb2f3d82a68862e8b50eead06889b39

SHA512
adbe14c811b915972709530049bb6934eacead6c5d19243ecea07abdd6c93aeede3fcae99f6419fb7ca1b2394dcef19e642be36f22c572de01b069dac2b4aa61

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat

Filesize
98B

MD5
8663de6fce9208b795dc913d1a6a3f5b

SHA1
882193f208cf012eaf22eeaa4fef3b67e7c67c15

SHA256
2909ea8555f2fc19097c1070a1da8fcfd6dc6886aa1d99d7e0c05e53feeb5b61

SHA512
9381063e0f85e874be54ae22675393b82c6ab54b223090148e4acbeff6f22393c96c90b83d6538461b695528af01d1f1231cf5dc719f07d6168386974b490688

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\NTUSER_LOG.hta

Filesize
7KB

MD5
55409e8335285720e34eeb153fee993d

SHA1
51336bf33901c5a544387b8ae5fe3ca2f97f7db8

SHA256
90e0062b4e9e8dca75ff5f6792529075d2594e74fb4693ace0001fe226e6a42a

SHA512
1964296394ae968c3fdc5bbe9d808f2e51c45f5610d48f7db77d7ce70f9525290eede4f8411768825824131bfaffa43d4ccfb0fdfacd3c53ccd5458843d4049d

Download Submit
\??\c:\program files (x86)\winrar\formats\date\e%sessionname%\wsseh.cc3

Filesize
24.1MB

MD5
8340c238857b9e5cb09ce13bf36c408a

SHA1
46896130befd1a51f3167c5b083e55320e38cad9

SHA256
6f6cc983c050c3d5a27077f31d3873d3e094c3948c54ee4f4a6b155dbc5bd2e6

SHA512
5463a2228034ab71e1751f0f3f2b22a5e33a66cb1ea8c46877404e46acb91a6503789dffe68b570f56f5e7a6d38ace837d9b78adcf0583253c1bc847ea728c1e

Download Submit
\??\c:\users\admin\appdata\local\temp\favorites_url.cab

Filesize
425B

MD5
da68bc3b7c3525670a04366bc55629f5

SHA1
15fda47ecfead7db8f7aee6ca7570138ba7f1b71

SHA256
73f3605192b676c92649034768378909a19d13883a7ea6f8ba1b096c78ffadb5

SHA512
6fee416affcb6a74621479697bca6f14f5429b00de3aa595abe3c60c6b2e094877b59f8783bbe7bdd567fa565d0630bb02def5603f8f0ea92fe8f2c3ac5383c0

Download Submit
\Program Files\Common Files\19920306.exe

Filesize
24.1MB

MD5
a82f04d1fd1b6abb2ca8e94993851c1f

SHA1
1eb80cfbafa58610ba5f71098e8939f2aa18b4b9

SHA256
1e7c28e1212269aa32937edd00f03c82664cccd28bd896814297d135ea815a4e

SHA512
999890fa395afec55b4a4b0d091c635fff73d3c367b4fcdfb865d76cced4ed2726ac8cd75b3163ff577046275712b4b71046219293610921fb4b8493879210a6

Download Submit
\Program Files\Common Files\920306.exe

Filesize
24.2MB

MD5
66fca0dea236541aad7678c3f1f8e44d

SHA1
6e52b3a3ab6432ff82b6fbf4e37fa95da9612dbe

SHA256
2b35ada33435d7fa0151fa8520e53e30dbe61e9d34f1a4608f4000b1a2a5e78d

SHA512
fd59c6660bf764b2f9f1fbd0aaae907b5c68691ea8ee447dbf2e7565374806075a1690b4f95ea069f5bbe1d8dcf5c7db204506b97958d18abf10a77865fd8396

Download Submit
memory/552-581-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/552-583-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/788-571-0x0000000000400000-0x0000000000430938-memory.dmp

Filesize
194KB

Download
memory/788-327-0x0000000000400000-0x0000000000430938-memory.dmp

Filesize
194KB

Download
memory/916-575-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/916-325-0x00000000002C0000-0x00000000002F1000-memory.dmp

Filesize
196KB

Download
memory/916-324-0x00000000002C0000-0x00000000002F1000-memory.dmp

Filesize
196KB

Download
memory/916-115-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/984-576-0x0000000000400000-0x0000000000430938-memory.dmp

Filesize
194KB

Download
memory/984-582-0x0000000000400000-0x0000000000430938-memory.dmp

Filesize
194KB

Download
memory/1480-114-0x00000000022D0000-0x0000000002321000-memory.dmp

Filesize
324KB

Download
memory/1480-116-0x00000000022D0000-0x0000000002321000-memory.dmp

Filesize
324KB

Download
memory/2080-35-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2556-2-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2556-29-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2556-8-0x00000000006E0000-0x00000000006F0000-memory.dmp

Filesize
64KB

Download
memory/2556-3-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/2632-94-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2876-70-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2876-66-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2876-54-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2876-55-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/2876-122-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download