8f643a5f4ef8c250d8b0047629672e660d69ae1b2414e30d2633cf483a0e2889

Analysis

max time kernel
73s
max time network
128s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a255e623a782ddccdbcba4e79da5e7ef_JaffaCakes118.exe
Size

163KB
MD5

a255e623a782ddccdbcba4e79da5e7ef
SHA1

20553c96df543c10e007a655f31f7b6923d96fd8
SHA256

8f643a5f4ef8c250d8b0047629672e660d69ae1b2414e30d2633cf483a0e2889
SHA512

f5e00c96a43fafc4fb54f6434f1eeb4b9e5dff3e4a55dbb5ee783819c0a26a99d50c13fdd40fc4b677dd4bca2be56dd33878d281d12226fcb79d56528fa7e586
SSDEEP

3072:PUgmcYpOqQWts5oXpT3uob27b1j3K7tkGaA45McajwuLR5aGdt1:PUgmc2vKoZT+ob0VIxazjmhLH1

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2872	hotwetlove.exe

Loads dropped DLL 11 IoCs

pid	Process
2268	a255e623a782ddccdbcba4e79da5e7ef_JaffaCakes118.exe
2268	a255e623a782ddccdbcba4e79da5e7ef_JaffaCakes118.exe
2268	a255e623a782ddccdbcba4e79da5e7ef_JaffaCakes118.exe
2268	a255e623a782ddccdbcba4e79da5e7ef_JaffaCakes118.exe
2268	a255e623a782ddccdbcba4e79da5e7ef_JaffaCakes118.exe
2268	a255e623a782ddccdbcba4e79da5e7ef_JaffaCakes118.exe
2268	a255e623a782ddccdbcba4e79da5e7ef_JaffaCakes118.exe
2268	a255e623a782ddccdbcba4e79da5e7ef_JaffaCakes118.exe
2872	hotwetlove.exe
2872	hotwetlove.exe
2872	hotwetlove.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HotWetLove = "c:\\program files\\dialers\\hotwetlove\\hotwetlove.exe /noconnect"	a255e623a782ddccdbcba4e79da5e7ef_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HotWetLove-uninstall.exe	a255e623a782ddccdbcba4e79da5e7ef_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\HotWetLove-uninstall.exe	a255e623a782ddccdbcba4e79da5e7ef_JaffaCakes118.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	\??\c:\program files\dialers\hotwetlove\hotwetlove.exe	a255e623a782ddccdbcba4e79da5e7ef_JaffaCakes118.exe
File opened for modification	\??\c:\program files\dialers\hotwetlove\hotwetlove.exe	a255e623a782ddccdbcba4e79da5e7ef_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a255e623a782ddccdbcba4e79da5e7ef_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hotwetlove.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000da0466a417188cbb8bc47f458d80804df268affa267d708424365ff5e15e31cd000000000e80000000020000200000001a6769f18051e11a8b27bb3b4e9cfcf4ba6e493d2ace312cd22942e7c581bef09000000085e21669dbe7679d3bc1d223fdf0345c331d296a07a86051721340d1284ed60bbd8c6f82a59deede20b18a93dd79a0684e31dc9b7e9dc1b0fb403df630d2fa39f4a59447e8e505f1fe2dc7e21390e717d2a2315cd9ac52fa83038c37da915b99119d92db8ef6448efee0c43fb1f7a0795effd540c6836b36e4483588ed678353d01c01a42048b46836c842bc7c495aba40000000e36f594d7d3a28e6e1190ff8442e40af1531490c7fbb28795404aa9353c9816cec6facd4e84308ae3332f56ddb6f34a869c2b42d41284b6097dd2a1a230af1d4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430055611"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 902495e797f0da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F9B41E61-5C8A-11EF-AC25-4298DBAE743E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb90000000002000000000010660000000100002000000000a7f7025e6e733c48722218368dd374d09586c77d8638e631f9af4ea35267cc000000000e8000000002000020000000d9f59a8ca2f41ec8bd822ff7f338518502e3f91379d6fe9dc3e685ee028db25b20000000db8090787a6a9ea1a5d1cd82c6455b02b71dcc46b65b992dbc6bdc77df0a683c400000001b72e0c08b634fde8d14b374dad30aaf4e7da0692452b42f17f9595b8209a9e7e8a01b4d469db37d59ad4284e4f7410aafeb69138eeb87a64b8a4f73cd46d876	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.default\software\netscape\netscape navigator\viewers	hotwetlove.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\netscape	hotwetlove.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\netscape\netscape navigator\viewers	hotwetlove.exe
Key created	\REGISTRY\USER\.default\software\netscape\netscape navigator\user trusted external applications	hotwetlove.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\netscape\netscape navigator\suffixes\application/x-HWTLV = "HWTLV"	hotwetlove.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\netscape\netscape navigator\user trusted external applications\c:\program files\dialers\hotwetlove\hotwetlove.exe = "yes"	hotwetlove.exe
Key created	\REGISTRY\USER\.default\software\netscape\netscape navigator\suffixes	hotwetlove.exe
Key created	\REGISTRY\USER\.default	hotwetlove.exe
Key created	\REGISTRY\USER\.DEFAULT\software	hotwetlove.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\netscape\netscape navigator	hotwetlove.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\netscape\netscape navigator\viewers\application/x-HWTLV = "c:\\program files\\dialers\\hotwetlove\\hotwetlove.exe %1"	hotwetlove.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\netscape\netscape navigator\viewers\TYPE1 = "application/x-HWTLV"	hotwetlove.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.HWTLV	hotwetlove.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mime\database\content type\application/x-HWTLV	hotwetlove.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\HWTLV File\EditFlags = 00000100	hotwetlove.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-HWTLV\Extension = ".HWTLV"	hotwetlove.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HWTLV File\shell	hotwetlove.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HWTLV File\shell\open\command\ = "c:\\program files\\dialers\\hotwetlove\\hotwetlove.exe %1"	hotwetlove.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HWTLV File\shell\ = "open"	hotwetlove.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HWTLV File\shell\open	hotwetlove.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.HWTLV\ = "HWTLV File"	hotwetlove.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.HWTLV\Content Type = "application/x-HWTLV"	hotwetlove.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HWTLV File	hotwetlove.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HWTLV File\ = "HWTLV Data"	hotwetlove.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HWTLV File\shell\open\command	hotwetlove.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2872	hotwetlove.exe
2832	iexplore.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2872	hotwetlove.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2832	iexplore.exe
2832	iexplore.exe
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2872	2268	a255e623a782ddccdbcba4e79da5e7ef_JaffaCakes118.exe	29
PID 2268 wrote to memory of 2872	2268	a255e623a782ddccdbcba4e79da5e7ef_JaffaCakes118.exe	29
PID 2268 wrote to memory of 2872	2268	a255e623a782ddccdbcba4e79da5e7ef_JaffaCakes118.exe	29
PID 2268 wrote to memory of 2872	2268	a255e623a782ddccdbcba4e79da5e7ef_JaffaCakes118.exe	29
PID 2832 wrote to memory of 2712	2832	iexplore.exe	31
PID 2832 wrote to memory of 2712	2832	iexplore.exe	31
PID 2832 wrote to memory of 2712	2832	iexplore.exe	31
PID 2832 wrote to memory of 2712	2832	iexplore.exe	31

C:\Users\Admin\AppData\Local\Temp\a255e623a782ddccdbcba4e79da5e7ef_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a255e623a782ddccdbcba4e79da5e7ef_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2268
- C:\program files\dialers\hotwetlove\hotwetlove.exe
  "C:\program files\dialers\hotwetlove\hotwetlove.exe" -kill c:\users\admin\appdata\local\temp\a255e623a782ddccdbcba4e79da5e7ef_jaffacakes118.exe /install
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2872

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2832 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dea78ccf38f3e5efb048a40a4242c947

SHA1
79756411b6cadbafcd3864954fef4cdd1a5dd7ce

SHA256
0c91b742d02113df0f2be940ae5f5b54df59fcd68b4b68b5771949dcf2ee70c9

SHA512
5b6d165167dd3d4052f7349f9d8d259f7235bc1afe8dff3268a06cd7e882d4002b5e87754acc03deab9a436b4442817a79867480e416013742de308481e60f9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
adadf25c69edd1757afb67bfce72ba6a

SHA1
3f1282308c891e48d489fe518cae3de1e499bd8d

SHA256
2ea1354d865b397083ca1d0a47773a5d8d375addc7b88f36799cd054fea33c26

SHA512
5a41ad74d87e356b87446a74ff8fa5c7668989250758738e31f81eb7252733fc467042ef9a6c6faee9b3b6fd408d86f7c6c2d982db45e9d732d3edf256724007

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06c47046eec61809cc865d1f0651968c

SHA1
242c468f425b144b5d88dcdb6085a6eaf5c0c895

SHA256
4dd9a53ddea239101bdb5d76b0b328658bd5b50b0c31c26d09b262f6a874abe7

SHA512
01b4ce95567105c549af2d15ded948e2f8279bae1e042bc6233baed693e4af53b04a972fa89a39967acea5e5d45a005745fc481aa18e90ab01aed4e1c297bac4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b39731e4c50b2f081d13612a0f1bb530

SHA1
0cc5d648e40f9a04ae1108d60e7776df637d700c

SHA256
142d0cd58d1f3d058feb94d8d65873a34e377cf588854a2afaccee366e8e31f4

SHA512
748780736f30e0372a0a4eb0025de803e9d58d227e0ea9afd40809a83087eecd2303a9ec4cd754702f48c08380f9346187282019b610b994abec758dd20a2d05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b13ae5e8fa8ef073cd1ac2fa5803902

SHA1
5571c4ec3f6b33546cb5e530c9477225c43fbf77

SHA256
765ddec598e8b6a753b240e41e7690ace4a5e1b6ad869f4519c621bf527cdcfb

SHA512
704aae7d6788822bc115c037da4e3921ff3c6ed5c250348118f8bbfa01fa33bd531fe45017560618f4c63d7113510412db9aeb0258c178dbeaaac2f18cc26908

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07ce059405291aac6b0dab1ced786709

SHA1
dcb1e0f34c40663e3a1a212abe5495838c990b18

SHA256
2ef820b3e1468ea0052e32eb01eced5f66d7af4d0e894ad0581a4c20d3ae67a6

SHA512
5e42a5e5f0f3fe23ef60f1aeb8dac88c4c9c043de2da7024d0fbb425c4eb239274ef0c75e55962804c8cd83a41a19f5a5f55dafd7e7b3a952c8caf724a2a2711

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa13892ed79ed6a976a18b19062cd27c

SHA1
00e65f63837f870aeab1b4f910d3729c83e55767

SHA256
9e7080afb19992eea10a80709ec84357413a5d948823484bd8710d2f0b69f56c

SHA512
3e5f72068e1bb1de2423a4f75a936206e8a7d157a7d315058285ad12cbcedc9c7a18efa10ceb610e7118c6f35fcfae2e4571873ae0ea926cf355b1d4fb4ec8c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f22b0f2309b26b490855834026254a52

SHA1
9ee974e4146495e6113839bd6eef31f259bea03e

SHA256
54c326c181614646f880fd2f8ad720850c5655c08f598f12900a7c1c7d3f0e40

SHA512
f219dca36c2c3d1d4b53d225e4e44b00451dd5c9566d5e048e141f30fb36ecbfc43954ee0f57a3a4777db50373ffb25663a605901c4a97b67eba2feff39eac62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14d493560f254bdc0fb98af358fa27e0

SHA1
b5f95439d38791195e10f5c60fab4955888796d8

SHA256
026e46725a375fbf578f67b5bc76e4b9434078a4f9f0e3998acbd6b2f58d7cf3

SHA512
9a2ece0cd7a47552b22e70e9cb5a8d2b2fb2d328b2434c27d0a654104c50a5c2aeaecc524351b73313bc671816c65844555ec38bd93f94def2540bd20e0f88e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb83d7fef577a48d4eb112e77814acfc

SHA1
2eb3c0c5a9074e0c459b800c27ba9c54a0ff7926

SHA256
06e4bc8e4f70e5e655372940320c890d08ecc3e13c3f6ec6eae792cfba997c5f

SHA512
812da0a7ca96825c0feff8231c54f1ba697e7a970ccffc6fe0d44ed3c574b9e2205574c2f7af7f8fee2283d9bf64d6f6db9552bf72c9ff0c42486c2eaffe699b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBB84.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBFEB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\HotWetLove.lnk

Filesize
939B

MD5
106ca640eba47dd60792aee9221d760c

SHA1
6385d2505fab4927f26dcfe1162ed056e880ad30

SHA256
f2e7c39b8ec306c0adcadef27ab504ec745fae83189e0211197804b647bbd8fc

SHA512
6efb336bd8925a2d48cb08987f71b5af1d29fde14476fd7d6b50ed55165c66fb91b2b9f21e9b5ffc728695dd6ed4e03cff028014034063d93153ec477108d270

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HotWetLove.lnk

Filesize
945B

MD5
5cf69a0a70e61e6057990933cdb1050b

SHA1
141aca48d5380b5970e625d0012fe549e698797d

SHA256
88e863b4899bc0afe2e84a47dc850127a69a5b8cff2f0de224df63d981f2b499

SHA512
5c98e4ac83131323e1d60a233983e26f977c81a07769582dfc1dd9769dfbd536adae4d399bb719eda61d40bbee0dad2b65c99c09ee4f01f97cb204d7bf730c6b

Download Submit
C:\Users\Admin\Desktop\HotWetLove.lnk

Filesize
915B

MD5
efae48325e10dc0a566014d1d4ac2714

SHA1
f3ad4cbcda6f8ab061f283fbfc16a2f552ed282b

SHA256
deda47c619c6312ebb3736a00560d3ec371742ff4003c6da456f494fb6e4ad16

SHA512
326ac532fa610da0b564db5a7f8ef5a3387991c3879e4a9b91265e7c9e8799e77667b24274efb5ee94618b77d772176a9d7686dbe5a0dc420503e54be13c94d2

Download Submit
\Program Files\dialers\hotwetlove\hotwetlove.exe

Filesize
163KB

MD5
a255e623a782ddccdbcba4e79da5e7ef

SHA1
20553c96df543c10e007a655f31f7b6923d96fd8

SHA256
8f643a5f4ef8c250d8b0047629672e660d69ae1b2414e30d2633cf483a0e2889

SHA512
f5e00c96a43fafc4fb54f6434f1eeb4b9e5dff3e4a55dbb5ee783819c0a26a99d50c13fdd40fc4b677dd4bca2be56dd33878d281d12226fcb79d56528fa7e586

Download Submit
memory/2268-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2268-39-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2268-17-0x0000000000520000-0x0000000000530000-memory.dmp

Filesize
64KB

Download
memory/2872-57-0x0000000002520000-0x0000000002530000-memory.dmp

Filesize
64KB

Download
memory/2872-56-0x0000000002520000-0x0000000002530000-memory.dmp

Filesize
64KB

Download
memory/2872-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2872-54-0x0000000002560000-0x0000000002562000-memory.dmp

Filesize
8KB

Download
memory/2872-51-0x0000000002520000-0x0000000002530000-memory.dmp

Filesize
64KB

Download
memory/2872-52-0x0000000002520000-0x0000000002530000-memory.dmp

Filesize
64KB

Download
memory/2872-53-0x0000000002520000-0x0000000002530000-memory.dmp

Filesize
64KB

Download
memory/2872-40-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads