bf0b459c3c9d8a26636157fb8b9c693df0b75f7ded288ebafe8d6374853176fa

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 05:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9db6c03c9ddf1ca0308c40781c11f43_JaffaCakes118.exe
Size

24KB
MD5

a9db6c03c9ddf1ca0308c40781c11f43
SHA1

68cf505a3e033a3b863fe52b16fea2cf6347aa16
SHA256

bf0b459c3c9d8a26636157fb8b9c693df0b75f7ded288ebafe8d6374853176fa
SHA512

86562dd907d42da3c422ab7230f298bab68fe35669e828782b97e66a2d23a07fc41906fdf4d780443c5f5803067f6dae4a21ed6081cb67234b022e47dcabb2bd
SSDEEP

192:teOtaGSJAeBqaVKwlf3e4gbZdH0dHRdHwdHPH1SdHB18GZCju11K7kvBPOnT3Uvb:MMGPVx3ehVqrmuJk2VvBR

Score

8^/10

discovery persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 8 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	a9db6c03c9ddf1ca0308c40781c11f43_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "0"	a9db6c03c9ddf1ca0308c40781c11f43_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	LSFPRN.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "0"	LSFPRN.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	LSFPRN.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "0"	LSFPRN.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	a9db6c03c9ddf1ca0308c40781c11f43_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "0"	a9db6c03c9ddf1ca0308c40781c11f43_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1672	LSFPRN.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PrinterSecurityLayer = "C:\\Windows\\LSFPRN.EXE"	LSFPRN.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PrinterSecurityLayer = "C:\\Windows\\LSFPRN.EXE"	a9db6c03c9ddf1ca0308c40781c11f43_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\44upd.dll	a9db6c03c9ddf1ca0308c40781c11f43_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\44upd.dll	LSFPRN.EXE

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\LSFPRN.EXE	a9db6c03c9ddf1ca0308c40781c11f43_JaffaCakes118.exe
File created	C:\Windows\iexplore.htm	LSFPRN.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LSFPRN.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a9db6c03c9ddf1ca0308c40781c11f43_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Security\DisableSecuritySettingsCheck = "1"	a9db6c03c9ddf1ca0308c40781c11f43_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Security	a9db6c03c9ddf1ca0308c40781c11f43_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\	LSFPRN.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Security\DisableSecuritySettingsCheck = "1"	LSFPRN.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7CE89C01-5DF0-11EF-A0B2-6AE4CEDF004B} = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000024957da9feb188c2a3060f94a263b30ff5f79e78ce77a6787cab4511e61236c1000000000e8000000002000020000000c243f71431387df5525567414171c5744a5912b32bf3e7c53dfd95d7be605d4e2000000085cb1f28cf86789c654c795e3c3cbf381ee4b33399fcda4d1411fb75fa0256a4400000009f1e7ae92132d5c9291850767ff2f952a51df54678d7d64fc163367af1874b67c55009f814b902fad32cd8d488b96cd23ead0f0ef3d6cb8a0a5670f880c4174a	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20b32054fdf1da01	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Security\IEFileProtect = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a9db6c03c9ddf1ca0308c40781c11f43_JaffaCakes118.exe"	a9db6c03c9ddf1ca0308c40781c11f43_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000c838785618dd273c5ee56d9c26580fb074c37784bab208874d73dc70904f60f0000000000e80000000020000200000006d1d2624c831ab6463a16c5b7456985ef8ff9ba16ee846c5294344af44b16a8990000000e865c360a9636bae3862f77628d8ff87670e60891743a8af358dbf381452a1975188a7f380d7c46ef4003dd588f84dd49ae38bb14d73abcb24267085944ede853252cf365a9318fc71444c9f699a1403ce1bdd80414e95dcd7f869ebcdf0bacc4834caa81449de459942563f2c00f123d32a6b446bebb2972ad94264470d0e002271b8a964c6510e78cb3f74ccf064e7400000006f09f689a9c9aba084972bdb3d93f270f16a1d063f7aeea2aa52dd1bdb971146bbc3dd38aa28a7bffb0bbc000ee9c58d4d3b7047e6495ac7730d61aa0b94ce0d	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\	a9db6c03c9ddf1ca0308c40781c11f43_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe = "0"	a9db6c03c9ddf1ca0308c40781c11f43_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe = "0"	LSFPRN.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3024	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 1672	3056	a9db6c03c9ddf1ca0308c40781c11f43_JaffaCakes118.exe	31
PID 3056 wrote to memory of 1672	3056	a9db6c03c9ddf1ca0308c40781c11f43_JaffaCakes118.exe	31
PID 3056 wrote to memory of 1672	3056	a9db6c03c9ddf1ca0308c40781c11f43_JaffaCakes118.exe	31
PID 3056 wrote to memory of 1672	3056	a9db6c03c9ddf1ca0308c40781c11f43_JaffaCakes118.exe	31
PID 1672 wrote to memory of 2984	1672	LSFPRN.EXE	33
PID 1672 wrote to memory of 2984	1672	LSFPRN.EXE	33
PID 1672 wrote to memory of 2984	1672	LSFPRN.EXE	33
PID 1672 wrote to memory of 2984	1672	LSFPRN.EXE	33
PID 2984 wrote to memory of 3024	2984	iexplore.exe	34
PID 2984 wrote to memory of 3024	2984	iexplore.exe	34
PID 2984 wrote to memory of 3024	2984	iexplore.exe	34
PID 2984 wrote to memory of 3024	2984	iexplore.exe	34
PID 3024 wrote to memory of 2964	3024	IEXPLORE.EXE	35
PID 3024 wrote to memory of 2964	3024	IEXPLORE.EXE	35
PID 3024 wrote to memory of 2964	3024	IEXPLORE.EXE	35
PID 3024 wrote to memory of 2964	3024	IEXPLORE.EXE	35

C:\Users\Admin\AppData\Local\Temp\a9db6c03c9ddf1ca0308c40781c11f43_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a9db6c03c9ddf1ca0308c40781c11f43_JaffaCakes118.exe"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\LSFPRN.EXE
  "C:\Windows\LSFPRN.EXE"
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe" C:\Windows\iexplore.htm
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE" C:\Windows\iexplore.htm
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3024
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b68106da0e4cbfe37048c0d6762d8cb3

SHA1
3d0fbf7ce18e9d129bcb2b484d8935254f8d369a

SHA256
4364cf3a9ee3df8b25a49758751d307d0d61765b9ca436676fe0e01a1548eed3

SHA512
731cacd7b1eb1b6789d2c1a52b7c77d315b2bab7ea71d16d64f8dc0a264bfe49133b8df5d0382b3a9e7485b68d33a8df2b0efe6602351332ab52e675efd6032c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4216fd46abc0fd54da3290f076b339c

SHA1
f94ea94e4dd37ddc8b6e28ffc59050d0819bb06d

SHA256
e8dc5ff427172e0a6e2ef39b3e045f6a05db2dc2088856d156f6f5bbb4263899

SHA512
7eb51d51688a11bc7d0d278aa64fdf44bc4afa4bf5caaf31326a82db9634c2ef617b3a1b2f3459ef0fb0faed474710455d8268a887bf12d095d13d0847938fc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02a7206c1463b6fb4fc3071606aa2462

SHA1
9538afbfbe4496154e1668d981db9b60d25e4812

SHA256
e5db993b89a1f5467f5154dd0fbc3e17b4482fc0bf66541cd6f2eb07a5a3b519

SHA512
a424b79e816aacb2e39a68634df05dd6efce7e5eeeef26d27c13311412a4b3fab79c9c2796c8cba06bad2a2cc040dc27934eca5ad5c571553a89a3b8d7614cb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44578384ce890f73f5071bf1223aadfa

SHA1
ab387c4f053cb30bb00cca6214cd9e6f761feae9

SHA256
c1b0672234941ba6078e2c99650b160103045c8492773985e8032a31ce10d181

SHA512
5b0e94c2baa3b81d5b72366f2c9f600146c76c50cdcc58da5b27a08947b51e6cf8c679aca573ef01983cd72ad2cde43f20b4e17307831192be0c4bd1c5910342

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b5ac8adf7754e1794424442186d4979

SHA1
2d38be2d7523d3041fe5538e757ad6444d7da0d7

SHA256
38def028ba9324d987657be6744c0e9eb6e1743d37a58d8d74fc5a86985c82c4

SHA512
af1c7ac223e350b88b1e231032a2a491b6ff3803c90e630a7d0b79b67b4644e426861a78072cb933b4b80b4b1c9b0f8668e5f15eb4d2639b90df652fec909b48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f717b1e7301bac425a36082441067a93

SHA1
f88c42c69d78d09f8b3fd93656d33310316dd53e

SHA256
b8dbb53e0e8ffb0fe9bd11507f67aa2047961412e6c42d2ce4321b0885f74459

SHA512
3bda331f707aa0e138dcdfcc35b1e3f8aff37080cfb8a47fb2d821f981cf22214d1d867b3ebb2dcaed245e47f77e61de54182fd6045a0f6f2b4638dac9a384ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd3b68f699cb863c2cf93247fff83d1e

SHA1
66e23bc1921ffa8f2924e13500f2ff3359ea9981

SHA256
ee3f8c3e949d7dc6ee53686e65c2a0be3abb76d7d6054f7b108baba5f82d8c6d

SHA512
38fb1fe3c2105b76c9578422a74888de019ce3d25d9b475387070bd1f249c11010179e2bfa82d04a996b9bcdeb53a0a5c84e9ec27217feff6e615de963278185

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdc1394fb84f0b500651275d7750beff

SHA1
38155a261958d5f6826d3c28b65b3a5698d91acb

SHA256
af7286768ecf9f22aeb90c70d2eb6f35bea50e43abd9a92e64b9eb7314d2ae9a

SHA512
2d40423f2841d9cdf7f802ffbda330a8f673b8002c9755baefe072c63d6c9cc09f147727352a52a9e71b50d524846395160e99cb012bd074d47466a070de0ba1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
689996ca8922f40d3afd26490f579849

SHA1
c15fbac213ec4a1821d810e34e4ca7f8278ded8b

SHA256
002910dac52cc2b7a1beb3606897aec652acd0f2f36dfb2a0180042037ad6dd2

SHA512
5a282fd16d35c07a9cc884ebb28aeb8e293258e089966ddc91d72f19596635c44dd330ea461baf102ad3ac626e115b8dc98b754967bf9125f1915c1fd05ff36d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4FB9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5058.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\LSFPRN.EXE

Filesize
24KB

MD5
a9db6c03c9ddf1ca0308c40781c11f43

SHA1
68cf505a3e033a3b863fe52b16fea2cf6347aa16

SHA256
bf0b459c3c9d8a26636157fb8b9c693df0b75f7ded288ebafe8d6374853176fa

SHA512
86562dd907d42da3c422ab7230f298bab68fe35669e828782b97e66a2d23a07fc41906fdf4d780443c5f5803067f6dae4a21ed6081cb67234b022e47dcabb2bd

Download Submit
C:\Windows\SysWOW64\44upd.dll

Filesize
256B

MD5
7fc27f0eb3c1ab6ef579f4ef0ac12774

SHA1
d04c43eb42a01467e1bb8996de0160e959d50079

SHA256
a0aca3e8c478cbe4fd866047007bab97099b03512841c67fd139df62e47d6f02

SHA512
c7706b6ea625da5aa968f4be791127e1faea3a00f458052210158d685666241bc15175b55d14f569493026e7cdb8c36d0892e284e426125e45c9b77abed89379

Download Submit
C:\Windows\iexplore.htm

Filesize
1KB

MD5
1d47e608ba041a2325a1eab479180bf4

SHA1
7316d2d1a0fc1ccd6d1d4530db63ca55167c16c0

SHA256
843ad1039e884b2dc398b7db77ea920e7853b8490bf2960dbf14882729435899

SHA512
3fae7d2409d8a2cad5f0370ac93a373d874d5a83d9692fb10012e4d587f9e77c1c25cfc55a2b18d39308ca734b385abe48f28411aa197126b8ed4b6264b35e15

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads