f9bdd2f729a9b754cb9a63e0e35feb31016e3f7d094c4b99782c430d804f7205

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 02:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe
Size

567KB
MD5

a92f412369acf81f4c94d4f1c19e2970
SHA1

6b18dc3d2e6ff98153233af5d38c6f5293fa976c
SHA256

f9bdd2f729a9b754cb9a63e0e35feb31016e3f7d094c4b99782c430d804f7205
SHA512

5f488a6323cf98d6232f4c9a1261c00cb617060aeefa35b46b79c15d8026077ae6edcdb98d084702f1ec5d5773161703c47fe1ed86a528f21fe4587c5964f936
SSDEEP

12288:tnM4rY4ApZUFo2TP7Vt5v7xIE7LenCzfwstECI3f3oS:tbYJaTzXxxI/njstECI3

Score

10^/10

discovery evasion persistence upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 8 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\youtube.exe = "C:\\Users\\Admin\\AppData\\Roaming\\youtube.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Winlog\Winlogon.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe

Executes dropped EXE 3 IoCs

pid	Process
1956	Winlogon.exe
2972	Winlogon.exe
2884	Winlogon.exe

Loads dropped DLL 7 IoCs

pid	Process
1972	a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe
1972	a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe
1972	a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe
1972	a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe
1972	a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe
1956	Winlogon.exe
1956	Winlogon.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2972-46-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/2972-51-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/2972-50-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/2972-58-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/2972-69-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/2972-72-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/2972-75-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/2972-77-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/2972-79-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/2972-82-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/2972-86-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/2972-91-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/2972-93-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/2972-96-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/2972-98-0x0000000000400000-0x0000000000473000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe"	reg.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1956 set thread context of 2972	1956	Winlogon.exe	34
PID 1956 set thread context of 2884	1956	Winlogon.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
3040	reg.exe
2016	reg.exe
2644	reg.exe
2288	reg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: 1	2972	Winlogon.exe
Token: SeCreateTokenPrivilege	2972	Winlogon.exe
Token: SeAssignPrimaryTokenPrivilege	2972	Winlogon.exe
Token: SeLockMemoryPrivilege	2972	Winlogon.exe
Token: SeIncreaseQuotaPrivilege	2972	Winlogon.exe
Token: SeMachineAccountPrivilege	2972	Winlogon.exe
Token: SeTcbPrivilege	2972	Winlogon.exe
Token: SeSecurityPrivilege	2972	Winlogon.exe
Token: SeTakeOwnershipPrivilege	2972	Winlogon.exe
Token: SeLoadDriverPrivilege	2972	Winlogon.exe
Token: SeSystemProfilePrivilege	2972	Winlogon.exe
Token: SeSystemtimePrivilege	2972	Winlogon.exe
Token: SeProfSingleProcessPrivilege	2972	Winlogon.exe
Token: SeIncBasePriorityPrivilege	2972	Winlogon.exe
Token: SeCreatePagefilePrivilege	2972	Winlogon.exe
Token: SeCreatePermanentPrivilege	2972	Winlogon.exe
Token: SeBackupPrivilege	2972	Winlogon.exe
Token: SeRestorePrivilege	2972	Winlogon.exe
Token: SeShutdownPrivilege	2972	Winlogon.exe
Token: SeDebugPrivilege	2972	Winlogon.exe
Token: SeAuditPrivilege	2972	Winlogon.exe
Token: SeSystemEnvironmentPrivilege	2972	Winlogon.exe
Token: SeChangeNotifyPrivilege	2972	Winlogon.exe
Token: SeRemoteShutdownPrivilege	2972	Winlogon.exe
Token: SeUndockPrivilege	2972	Winlogon.exe
Token: SeSyncAgentPrivilege	2972	Winlogon.exe
Token: SeEnableDelegationPrivilege	2972	Winlogon.exe
Token: SeManageVolumePrivilege	2972	Winlogon.exe
Token: SeImpersonatePrivilege	2972	Winlogon.exe
Token: SeCreateGlobalPrivilege	2972	Winlogon.exe
Token: 31	2972	Winlogon.exe
Token: 32	2972	Winlogon.exe
Token: 33	2972	Winlogon.exe
Token: 34	2972	Winlogon.exe
Token: 35	2972	Winlogon.exe
Token: SeDebugPrivilege	2884	Winlogon.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1972	a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe
1956	Winlogon.exe
2972	Winlogon.exe
2972	Winlogon.exe
2884	Winlogon.exe
2972	Winlogon.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1140	1972	a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe	30
PID 1972 wrote to memory of 1140	1972	a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe	30
PID 1972 wrote to memory of 1140	1972	a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe	30
PID 1972 wrote to memory of 1140	1972	a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe	30
PID 1140 wrote to memory of 3060	1140	cmd.exe	32
PID 1140 wrote to memory of 3060	1140	cmd.exe	32
PID 1140 wrote to memory of 3060	1140	cmd.exe	32
PID 1140 wrote to memory of 3060	1140	cmd.exe	32
PID 1972 wrote to memory of 1956	1972	a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe	33
PID 1972 wrote to memory of 1956	1972	a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe	33
PID 1972 wrote to memory of 1956	1972	a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe	33
PID 1972 wrote to memory of 1956	1972	a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe	33
PID 1956 wrote to memory of 2972	1956	Winlogon.exe	34
PID 1956 wrote to memory of 2972	1956	Winlogon.exe	34
PID 1956 wrote to memory of 2972	1956	Winlogon.exe	34
PID 1956 wrote to memory of 2972	1956	Winlogon.exe	34
PID 1956 wrote to memory of 2972	1956	Winlogon.exe	34
PID 1956 wrote to memory of 2972	1956	Winlogon.exe	34
PID 1956 wrote to memory of 2972	1956	Winlogon.exe	34
PID 1956 wrote to memory of 2972	1956	Winlogon.exe	34
PID 1956 wrote to memory of 2972	1956	Winlogon.exe	34
PID 1956 wrote to memory of 2884	1956	Winlogon.exe	35
PID 1956 wrote to memory of 2884	1956	Winlogon.exe	35
PID 1956 wrote to memory of 2884	1956	Winlogon.exe	35
PID 1956 wrote to memory of 2884	1956	Winlogon.exe	35
PID 1956 wrote to memory of 2884	1956	Winlogon.exe	35
PID 1956 wrote to memory of 2884	1956	Winlogon.exe	35
PID 1956 wrote to memory of 2884	1956	Winlogon.exe	35
PID 2972 wrote to memory of 2088	2972	Winlogon.exe	36
PID 2972 wrote to memory of 2088	2972	Winlogon.exe	36
PID 2972 wrote to memory of 2088	2972	Winlogon.exe	36
PID 2972 wrote to memory of 2088	2972	Winlogon.exe	36
PID 2972 wrote to memory of 2932	2972	Winlogon.exe	37
PID 2972 wrote to memory of 2932	2972	Winlogon.exe	37
PID 2972 wrote to memory of 2932	2972	Winlogon.exe	37
PID 2972 wrote to memory of 2932	2972	Winlogon.exe	37
PID 2972 wrote to memory of 2764	2972	Winlogon.exe	38
PID 2972 wrote to memory of 2764	2972	Winlogon.exe	38
PID 2972 wrote to memory of 2764	2972	Winlogon.exe	38
PID 2972 wrote to memory of 2764	2972	Winlogon.exe	38
PID 2972 wrote to memory of 2944	2972	Winlogon.exe	39
PID 2972 wrote to memory of 2944	2972	Winlogon.exe	39
PID 2972 wrote to memory of 2944	2972	Winlogon.exe	39
PID 2972 wrote to memory of 2944	2972	Winlogon.exe	39
PID 1956 wrote to memory of 2884	1956	Winlogon.exe	35
PID 2088 wrote to memory of 2644	2088	cmd.exe	44
PID 2088 wrote to memory of 2644	2088	cmd.exe	44
PID 2088 wrote to memory of 2644	2088	cmd.exe	44
PID 2088 wrote to memory of 2644	2088	cmd.exe	44
PID 2932 wrote to memory of 2288	2932	cmd.exe	45
PID 2932 wrote to memory of 2288	2932	cmd.exe	45
PID 2932 wrote to memory of 2288	2932	cmd.exe	45
PID 2932 wrote to memory of 2288	2932	cmd.exe	45
PID 2764 wrote to memory of 3040	2764	cmd.exe	46
PID 2764 wrote to memory of 3040	2764	cmd.exe	46
PID 2764 wrote to memory of 3040	2764	cmd.exe	46
PID 2764 wrote to memory of 3040	2764	cmd.exe	46
PID 2944 wrote to memory of 2016	2944	cmd.exe	47
PID 2944 wrote to memory of 2016	2944	cmd.exe	47
PID 2944 wrote to memory of 2016	2944	cmd.exe	47
PID 2944 wrote to memory of 2016	2944	cmd.exe	47

C:\Users\Admin\AppData\Local\Temp\a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a92f412369acf81f4c94d4f1c19e2970_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\RiAQy.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Winlogon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Winlog\Winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:3060
- C:\Users\Admin\AppData\Roaming\Winlog\Winlogon.exe
  "C:\Users\Admin\AppData\Roaming\Winlog\Winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Users\Admin\AppData\Roaming\Winlog\Winlogon.exe
    "C:\Users\Admin\AppData\Roaming\Winlog\Winlogon.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2088
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2644
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Winlog\Winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Winlog\Winlogon.exe:*:Enabled:Windows Messanger" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2932
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Winlog\Winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Winlog\Winlogon.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2288
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2764
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3040
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\youtube.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\youtube.exe:*:Enabled:Windows Messanger" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2944
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\youtube.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\youtube.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2016
- - C:\Users\Admin\AppData\Roaming\Winlog\Winlogon.exe
    "C:\Users\Admin\AppData\Roaming\Winlog\Winlogon.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RiAQy.bat

Filesize
143B

MD5
91c7ca71e475f94738561f6057b1b7e7

SHA1
cabf52c017c40baf4394f94048995f0d55ba165a

SHA256
32f3560b7e69707070076b6a71774324a12c4869ce26cad4999edd345e7fa683

SHA512
6d4e833401deda56bb08ccbc60fd1bb554c7c452180847b50edaf43fc4625fde157a0a8e372ad0e8833776e2e607052d6a5d4ae604e01de27dc3d0329516f566

Download Submit
\Users\Admin\AppData\Roaming\Winlog\Winlogon.exe

Filesize
567KB

MD5
a92f412369acf81f4c94d4f1c19e2970

SHA1
6b18dc3d2e6ff98153233af5d38c6f5293fa976c

SHA256
f9bdd2f729a9b754cb9a63e0e35feb31016e3f7d094c4b99782c430d804f7205

SHA512
5f488a6323cf98d6232f4c9a1261c00cb617060aeefa35b46b79c15d8026077ae6edcdb98d084702f1ec5d5773161703c47fe1ed86a528f21fe4587c5964f936

Download Submit
memory/1956-57-0x0000000002D60000-0x0000000003263000-memory.dmp

Filesize
5.0MB

Download
memory/1956-40-0x0000000000400000-0x0000000000903000-memory.dmp

Filesize
5.0MB

Download
memory/1956-68-0x0000000000400000-0x0000000000903000-memory.dmp

Filesize
5.0MB

Download
memory/1972-34-0x0000000003BE0000-0x00000000040E3000-memory.dmp

Filesize
5.0MB

Download
memory/1972-38-0x0000000003BE0000-0x00000000040E3000-memory.dmp

Filesize
5.0MB

Download
memory/1972-41-0x0000000000400000-0x0000000000903000-memory.dmp

Filesize
5.0MB

Download
memory/1972-37-0x0000000003BE0000-0x00000000040E3000-memory.dmp

Filesize
5.0MB

Download
memory/1972-0-0x0000000000400000-0x0000000000903000-memory.dmp

Filesize
5.0MB

Download
memory/1972-35-0x0000000003BE0000-0x00000000040E3000-memory.dmp

Filesize
5.0MB

Download
memory/2884-64-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2884-71-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2884-62-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2884-61-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2884-63-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2972-75-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2972-79-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2972-46-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2972-69-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2972-50-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2972-72-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2972-58-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2972-77-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2972-51-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2972-82-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2972-86-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2972-91-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2972-93-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2972-96-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2972-98-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads