4f6bc0019b51f2fa6eb9ddb83860d35196a34e51db24706a9f8d42c3821ed438

Analysis

max time kernel
150s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 02:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
Size

33KB
MD5

a51563747130d0795c8f53fe3f12f9ae
SHA1

e930abaf1331f97a497dc7d6088154906541869b
SHA256

4f6bc0019b51f2fa6eb9ddb83860d35196a34e51db24706a9f8d42c3821ed438
SHA512

388747aea615f512fe2102b222b6d1023a9978feeb2b3491db7f140fbf7738b2997792a20e7a7d4309efa84b436b54468c5826d5501d9a447851b538f9d40b97
SSDEEP

768:I0X7HC9hO5RroZJ767395uINnEfDKBbUCp1OTZ+/V:Ici9he+Zk77RNzLiTO

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened (read-only)	\??\W:	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened (read-only)	\??\T:	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened (read-only)	\??\S:	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened (read-only)	\??\H:	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened (read-only)	\??\Z:	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened (read-only)	\??\Q:	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened (read-only)	\??\J:	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened (read-only)	\??\I:	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened (read-only)	\??\X:	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened (read-only)	\??\R:	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened (read-only)	\??\P:	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened (read-only)	\??\O:	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened (read-only)	\??\E:	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened (read-only)	\??\G:	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened (read-only)	\??\V:	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened (read-only)	\??\U:	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened (read-only)	\??\N:	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened (read-only)	\??\M:	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened (read-only)	\??\L:	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened (read-only)	\??\K:	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\ja-JP\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Services\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\CrashReports\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Portable Devices\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\brx\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\es-ES\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\DW\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files\MSBuild\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ie\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es_MX\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\es-ES\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\it-IT\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\_desktop.ini	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
File created	C:\Windows\Dll.dll	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2208	3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe	30
PID 3000 wrote to memory of 2208	3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe	30
PID 3000 wrote to memory of 2208	3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe	30
PID 3000 wrote to memory of 2208	3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe	30
PID 2208 wrote to memory of 2564	2208	net.exe	32
PID 2208 wrote to memory of 2564	2208	net.exe	32
PID 2208 wrote to memory of 2564	2208	net.exe	32
PID 2208 wrote to memory of 2564	2208	net.exe	32
PID 3000 wrote to memory of 2844	3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe	33
PID 3000 wrote to memory of 2844	3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe	33
PID 3000 wrote to memory of 2844	3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe	33
PID 3000 wrote to memory of 2844	3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe	33
PID 2844 wrote to memory of 2948	2844	net.exe	35
PID 2844 wrote to memory of 2948	2844	net.exe	35
PID 2844 wrote to memory of 2948	2844	net.exe	35
PID 2844 wrote to memory of 2948	2844	net.exe	35
PID 3000 wrote to memory of 1268	3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe	21
PID 3000 wrote to memory of 1268	3000	a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1268
- C:\Users\Admin\AppData\Local\Temp\a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a51563747130d0795c8f53fe3f12f9ae_JaffaCakes118.exe"
  2⤵
  - Drops startup file
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2208
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2564
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2844
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
258KB

MD5
68a0c694558cf9f6d488514f50f8a4fd

SHA1
eb0e09d96f47c361193267e2606134190b955cb9

SHA256
bda2f7b289f79ea8ca5ae579b345703c374c303f9b3193d8e56646462077389f

SHA512
6b3cf632b303e1726a2cadfdfc83b4689afc87d704e80f496a2f7bf1b8e24a1fc995fcf36ccd14e6dcd6f315790608c734341c818727dfabe9b705d53e66d5f4

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
717KB

MD5
3258ac9fd8a17c2114f91d6483268b5d

SHA1
9472e5d11c9aa3ac75a0d9666fe0836f6eb55acd

SHA256
066949ac6d43ad262f8a2b2ac48fe154b970152244295c6686d69465e1bcd578

SHA512
f1a6e4aba72f867c6d1f5a9743003758f065bcbbdb65a650d0f62e3cf7c18deee9f8a9a7c446913900d1f3b35942663382a91c882a08483992cde1758df67f71

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
478KB

MD5
f5cd7b35ea5f0009cdb5355dbc356066

SHA1
c06af0b31cdebdc4e31d57f448acb174e5be44b7

SHA256
472ce6c84e17f672782a003fa17f8d412c85a25675f83d16b1a1fb7bfc085f6d

SHA512
89573e495959ad60f4a4079248f3cfb6991b8c700223538a269d7553baaacd6de837f26cfe1a4f6a6c0940b8d758406ae2d9e85f2e5738371c9025ea699a7d28

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-940600906-3464502421-4240639183-1000\_desktop.ini

Filesize
9B

MD5
36657916738d378a6daf6ec7b690badd

SHA1
e4d3726bd02e1e99b12ada04a242fd6ef7c2843c

SHA256
7cd83d4ff3f3c6844b544fa7790bc1e7ed8bf829627657544861ac726071831c

SHA512
b7878056ad1c2294fb0e659eee6c7861948010b69a43930d8a243f61cebbea83fcd6fb11db19c01f731a925a7a744c6cc4de2eb0ffdc3863acf71e4cc05b2d6b

Download Submit
memory/1268-3-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/3000-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3000-7-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3000-2976-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3000-4164-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download