313344cf29008cd703534c5b8244e31771d3cb53527739c352771b0e4200fb24

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 23:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
Size

255KB
MD5

b58dbb21dfb0088cc3121d4407f9bcf0
SHA1

3a19718474d92352b0b2d5372056b4557489b5ca
SHA256

313344cf29008cd703534c5b8244e31771d3cb53527739c352771b0e4200fb24
SHA512

d894fea47a356b4b9573924ecc43d24df5a81c97f00fec5cd8b0dc819f7855d6940320bf231bdb2e9391b8391c457f1ff7ab352dbf9401464a7376004eff7e25
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJK:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIh

Score

10^/10

discovery evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	supdgqiyco.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	supdgqiyco.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	supdgqiyco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	supdgqiyco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	supdgqiyco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	supdgqiyco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	supdgqiyco.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	supdgqiyco.exe

Executes dropped EXE 5 IoCs

pid	Process
1144	supdgqiyco.exe
1976	oatdavzowrrjlas.exe
1996	oewphsxiaxktu.exe
2148	akijcfmw.exe
2924	akijcfmw.exe

Loads dropped DLL 5 IoCs

pid	Process
1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
1144	supdgqiyco.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1952-0-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x00080000000174af-9.dat	upx
behavioral1/memory/1144-28-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x00080000000174a8-40.dat	upx
behavioral1/files/0x00080000000174f5-41.dat	upx
behavioral1/files/0x000700000001211b-39.dat	upx
behavioral1/memory/1996-38-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1976-37-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2924-45-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1952-47-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x00090000000173c2-69.dat	upx
behavioral1/files/0x0007000000018660-71.dat	upx
behavioral1/memory/1144-73-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1976-74-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2148-76-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1996-75-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2924-77-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2924-82-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1996-81-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2148-80-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1976-79-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1144-78-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1144-83-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2924-87-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1996-86-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2148-85-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1976-84-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2148-90-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2924-91-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1976-94-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1996-95-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1144-93-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1144-96-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1996-98-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1976-97-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1976-100-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1996-101-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1144-99-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1144-102-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1996-104-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1976-103-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1976-107-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1996-108-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1144-106-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1144-109-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1996-111-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1976-110-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1976-113-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1996-114-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1144-112-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1144-133-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1996-135-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1976-134-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1144-136-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1976-137-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1996-138-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1976-140-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1996-141-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1144-139-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1144-142-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1976-143-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1996-144-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1144-145-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1976-146-0x0000000000400000-0x00000000004A0000-memory.dmp	upx

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	supdgqiyco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	supdgqiyco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	supdgqiyco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	supdgqiyco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	supdgqiyco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	supdgqiyco.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\xuttcwhp = "supdgqiyco.exe"	oatdavzowrrjlas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gbrrfeew = "oatdavzowrrjlas.exe"	oatdavzowrrjlas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "oewphsxiaxktu.exe"	oatdavzowrrjlas.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	supdgqiyco.exe
File opened (read-only)	\??\s:	supdgqiyco.exe
File opened (read-only)	\??\e:	akijcfmw.exe
File opened (read-only)	\??\u:	supdgqiyco.exe
File opened (read-only)	\??\z:	akijcfmw.exe
File opened (read-only)	\??\r:	akijcfmw.exe
File opened (read-only)	\??\w:	akijcfmw.exe
File opened (read-only)	\??\b:	supdgqiyco.exe
File opened (read-only)	\??\x:	supdgqiyco.exe
File opened (read-only)	\??\v:	akijcfmw.exe
File opened (read-only)	\??\q:	akijcfmw.exe
File opened (read-only)	\??\s:	akijcfmw.exe
File opened (read-only)	\??\k:	supdgqiyco.exe
File opened (read-only)	\??\n:	supdgqiyco.exe
File opened (read-only)	\??\x:	akijcfmw.exe
File opened (read-only)	\??\l:	supdgqiyco.exe
File opened (read-only)	\??\a:	akijcfmw.exe
File opened (read-only)	\??\w:	akijcfmw.exe
File opened (read-only)	\??\b:	akijcfmw.exe
File opened (read-only)	\??\n:	akijcfmw.exe
File opened (read-only)	\??\p:	akijcfmw.exe
File opened (read-only)	\??\u:	akijcfmw.exe
File opened (read-only)	\??\m:	supdgqiyco.exe
File opened (read-only)	\??\j:	akijcfmw.exe
File opened (read-only)	\??\l:	akijcfmw.exe
File opened (read-only)	\??\s:	akijcfmw.exe
File opened (read-only)	\??\t:	akijcfmw.exe
File opened (read-only)	\??\x:	akijcfmw.exe
File opened (read-only)	\??\y:	akijcfmw.exe
File opened (read-only)	\??\r:	supdgqiyco.exe
File opened (read-only)	\??\r:	akijcfmw.exe
File opened (read-only)	\??\u:	akijcfmw.exe
File opened (read-only)	\??\t:	akijcfmw.exe
File opened (read-only)	\??\o:	supdgqiyco.exe
File opened (read-only)	\??\p:	supdgqiyco.exe
File opened (read-only)	\??\w:	supdgqiyco.exe
File opened (read-only)	\??\p:	akijcfmw.exe
File opened (read-only)	\??\e:	akijcfmw.exe
File opened (read-only)	\??\a:	supdgqiyco.exe
File opened (read-only)	\??\y:	supdgqiyco.exe
File opened (read-only)	\??\b:	akijcfmw.exe
File opened (read-only)	\??\h:	akijcfmw.exe
File opened (read-only)	\??\k:	akijcfmw.exe
File opened (read-only)	\??\k:	akijcfmw.exe
File opened (read-only)	\??\v:	supdgqiyco.exe
File opened (read-only)	\??\g:	akijcfmw.exe
File opened (read-only)	\??\v:	akijcfmw.exe
File opened (read-only)	\??\g:	supdgqiyco.exe
File opened (read-only)	\??\t:	supdgqiyco.exe
File opened (read-only)	\??\n:	akijcfmw.exe
File opened (read-only)	\??\a:	akijcfmw.exe
File opened (read-only)	\??\z:	akijcfmw.exe
File opened (read-only)	\??\g:	akijcfmw.exe
File opened (read-only)	\??\q:	akijcfmw.exe
File opened (read-only)	\??\y:	akijcfmw.exe
File opened (read-only)	\??\h:	akijcfmw.exe
File opened (read-only)	\??\i:	akijcfmw.exe
File opened (read-only)	\??\l:	akijcfmw.exe
File opened (read-only)	\??\o:	akijcfmw.exe
File opened (read-only)	\??\q:	supdgqiyco.exe
File opened (read-only)	\??\z:	supdgqiyco.exe
File opened (read-only)	\??\o:	akijcfmw.exe
File opened (read-only)	\??\m:	akijcfmw.exe
File opened (read-only)	\??\i:	supdgqiyco.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	supdgqiyco.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	supdgqiyco.exe

AutoIT Executable 56 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1996-38-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1976-37-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1952-47-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1144-73-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1976-74-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2148-76-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1996-75-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2924-77-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2924-82-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1996-81-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2148-80-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1976-79-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1144-78-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1144-83-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2924-87-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1996-86-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2148-85-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1976-84-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2148-90-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2924-91-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1976-94-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1996-95-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1144-93-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1144-96-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1996-98-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1976-97-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1976-100-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1996-101-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1144-99-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1144-102-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1996-104-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1976-103-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1976-107-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1996-108-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1144-106-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1144-109-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1996-111-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1976-110-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1976-113-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1996-114-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1144-112-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1144-133-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1996-135-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1976-134-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1144-136-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1976-137-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1996-138-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1976-140-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1996-141-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1144-139-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1144-142-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1976-143-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1996-144-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1144-145-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1976-146-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1996-147-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\oewphsxiaxktu.exe	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	supdgqiyco.exe
File created	C:\Windows\SysWOW64\supdgqiyco.exe	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\oatdavzowrrjlas.exe	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\akijcfmw.exe	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\oewphsxiaxktu.exe	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\supdgqiyco.exe	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\oatdavzowrrjlas.exe	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\akijcfmw.exe	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	akijcfmw.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	akijcfmw.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	akijcfmw.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	akijcfmw.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	akijcfmw.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	akijcfmw.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	akijcfmw.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	akijcfmw.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	akijcfmw.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	akijcfmw.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	akijcfmw.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	akijcfmw.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	akijcfmw.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	akijcfmw.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\mydoc.rtf	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	supdgqiyco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oatdavzowrrjlas.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oewphsxiaxktu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	akijcfmw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	akijcfmw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe

Office loads VBA resources, possible macro or embedded object present

Modifies registry class 19 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FCAB12147E739E853CDBAD43298D4BE"	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat	supdgqiyco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile"	supdgqiyco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile"	supdgqiyco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile"	supdgqiyco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg	supdgqiyco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	supdgqiyco.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLV.Classes	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFEFF824F27826A9130D65D7E9DBDE4E133583067356243D691"	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	supdgqiyco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	supdgqiyco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32402D7D9D5083206A4477D1702F2DD77DF664D6"	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E08668B0FF1B22DCD273D1A98A0E906A"	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "183EC60814E0DBC0B8B97CE1EDE237CE"	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	supdgqiyco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsh	supdgqiyco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsf	supdgqiyco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABAFACCFE10F1E2830E3A4781EA39E5B388038F42110333E1B9429A09A9"	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc	supdgqiyco.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2916	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
1144	supdgqiyco.exe
1144	supdgqiyco.exe
1144	supdgqiyco.exe
1144	supdgqiyco.exe
1144	supdgqiyco.exe
1976	oatdavzowrrjlas.exe
1976	oatdavzowrrjlas.exe
1976	oatdavzowrrjlas.exe
1976	oatdavzowrrjlas.exe
1976	oatdavzowrrjlas.exe
1996	oewphsxiaxktu.exe
1996	oewphsxiaxktu.exe
1996	oewphsxiaxktu.exe
1996	oewphsxiaxktu.exe
1996	oewphsxiaxktu.exe
1996	oewphsxiaxktu.exe
2148	akijcfmw.exe
2148	akijcfmw.exe
2148	akijcfmw.exe
2148	akijcfmw.exe
2924	akijcfmw.exe
2924	akijcfmw.exe
2924	akijcfmw.exe
2924	akijcfmw.exe
1976	oatdavzowrrjlas.exe
1996	oewphsxiaxktu.exe
1996	oewphsxiaxktu.exe
1976	oatdavzowrrjlas.exe
1976	oatdavzowrrjlas.exe
1996	oewphsxiaxktu.exe
1996	oewphsxiaxktu.exe
1976	oatdavzowrrjlas.exe
1996	oewphsxiaxktu.exe
1996	oewphsxiaxktu.exe
1976	oatdavzowrrjlas.exe
1996	oewphsxiaxktu.exe
1996	oewphsxiaxktu.exe
1976	oatdavzowrrjlas.exe
1996	oewphsxiaxktu.exe
1996	oewphsxiaxktu.exe
1976	oatdavzowrrjlas.exe
1996	oewphsxiaxktu.exe
1996	oewphsxiaxktu.exe
1976	oatdavzowrrjlas.exe
1996	oewphsxiaxktu.exe
1996	oewphsxiaxktu.exe
1976	oatdavzowrrjlas.exe
1996	oewphsxiaxktu.exe
1996	oewphsxiaxktu.exe
1976	oatdavzowrrjlas.exe
1996	oewphsxiaxktu.exe
1996	oewphsxiaxktu.exe
1976	oatdavzowrrjlas.exe
1996	oewphsxiaxktu.exe
1996	oewphsxiaxktu.exe
1976	oatdavzowrrjlas.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
1144	supdgqiyco.exe
1144	supdgqiyco.exe
1144	supdgqiyco.exe
1976	oatdavzowrrjlas.exe
1976	oatdavzowrrjlas.exe
1976	oatdavzowrrjlas.exe
1996	oewphsxiaxktu.exe
1996	oewphsxiaxktu.exe
1996	oewphsxiaxktu.exe
2148	akijcfmw.exe
2148	akijcfmw.exe
2148	akijcfmw.exe
2924	akijcfmw.exe
2924	akijcfmw.exe
2924	akijcfmw.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
1144	supdgqiyco.exe
1144	supdgqiyco.exe
1144	supdgqiyco.exe
1976	oatdavzowrrjlas.exe
1976	oatdavzowrrjlas.exe
1976	oatdavzowrrjlas.exe
1996	oewphsxiaxktu.exe
1996	oewphsxiaxktu.exe
1996	oewphsxiaxktu.exe
2148	akijcfmw.exe
2148	akijcfmw.exe
2148	akijcfmw.exe
2924	akijcfmw.exe
2924	akijcfmw.exe
2924	akijcfmw.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2916	WINWORD.EXE
2916	WINWORD.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1144	1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe	30
PID 1952 wrote to memory of 1144	1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe	30
PID 1952 wrote to memory of 1144	1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe	30
PID 1952 wrote to memory of 1144	1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe	30
PID 1952 wrote to memory of 1976	1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe	31
PID 1952 wrote to memory of 1976	1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe	31
PID 1952 wrote to memory of 1976	1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe	31
PID 1952 wrote to memory of 1976	1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe	31
PID 1952 wrote to memory of 2148	1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe	32
PID 1952 wrote to memory of 2148	1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe	32
PID 1952 wrote to memory of 2148	1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe	32
PID 1952 wrote to memory of 2148	1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe	32
PID 1952 wrote to memory of 1996	1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe	33
PID 1952 wrote to memory of 1996	1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe	33
PID 1952 wrote to memory of 1996	1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe	33
PID 1952 wrote to memory of 1996	1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe	33
PID 1144 wrote to memory of 2924	1144	supdgqiyco.exe	34
PID 1144 wrote to memory of 2924	1144	supdgqiyco.exe	34
PID 1144 wrote to memory of 2924	1144	supdgqiyco.exe	34
PID 1144 wrote to memory of 2924	1144	supdgqiyco.exe	34
PID 1952 wrote to memory of 2916	1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe	35
PID 1952 wrote to memory of 2916	1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe	35
PID 1952 wrote to memory of 2916	1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe	35
PID 1952 wrote to memory of 2916	1952	b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe	35
PID 2916 wrote to memory of 2788	2916	WINWORD.EXE	38
PID 2916 wrote to memory of 2788	2916	WINWORD.EXE	38
PID 2916 wrote to memory of 2788	2916	WINWORD.EXE	38
PID 2916 wrote to memory of 2788	2916	WINWORD.EXE	38

C:\Users\Admin\AppData\Local\Temp\b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b58dbb21dfb0088cc3121d4407f9bcf0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\supdgqiyco.exe
  supdgqiyco.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\SysWOW64\akijcfmw.exe
    C:\Windows\system32\akijcfmw.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2924
- C:\Windows\SysWOW64\oatdavzowrrjlas.exe
  oatdavzowrrjlas.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1976
- C:\Windows\SysWOW64\akijcfmw.exe
  akijcfmw.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2148
- C:\Windows\SysWOW64\oewphsxiaxktu.exe
  oewphsxiaxktu.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1996
- C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

Filesize
255KB

MD5
fa6243efbb9adc960e679e9808e36b90

SHA1
b0fe0f364c5274d08bd419e69f3ff4f5ad89d4a2

SHA256
c544f0eb6679707d07d072e4cebcb3a587352d96f770d9df1adb65bc0060d6c9

SHA512
4aee5418f09315c32419ad8faad7a6a5dc33bcb836bf56d2280f39b0de31d24e1771d5335cda96f16d892d6a339d8f9562b88fcf852c0fb3f8f874b38ccc2bee

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

Filesize
255KB

MD5
aac3b355fd4357f3902c48a3d1ea5608

SHA1
f12fbe292c2e1c05895fbb045d88451e0fc099b8

SHA256
0585caeb4b16f6e3126337c6707fe164a3a425db70577e91e977e0dbc7b8080a

SHA512
76fd94b12ce6a1a0ce004092ef20b7a74f40e034419bad582d1fd4b3a434da5eb41561695d13c117d3f61d2a1887c0c821245d7a346ada57c8e12ec9d96913a6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
adeddffe7663e973c428ba7299d4d6f1

SHA1
d9b3387ea2cc2e5ca75b3a2f4c7c7fa087e12a98

SHA256
3cc2354186302f888f77fb02192d840bb95dc1592abba53457920c7e20dc6c3c

SHA512
ed34e0228a3ce2e552089639a33888843b65626611ca547300b3e3106872ef5971ee772732db4f3f91c7f247a09148aef0c44c65bf7ad815b799666cefa8e725

Download Submit
C:\Windows\SysWOW64\akijcfmw.exe

Filesize
255KB

MD5
0ebfa1b0eccd9000eaa57353936022b8

SHA1
dff7b9d58231318801f5304b90947a7fec97e891

SHA256
c00cf60b4dd36f537e35e36ffc6167d834389545dcdd265c3b5a94fb1bbb2e9f

SHA512
aed06ef6d7fbe7dd5b0b3f83e9184a24231d844497d1ce4a622f5d59eaa7342419bf7c586f39e5efbd4250d317a5c262ec4a99e884557d6152f27c4aef6dfa74

Download Submit
C:\Windows\SysWOW64\oatdavzowrrjlas.exe

Filesize
255KB

MD5
cb4b60ecdfb173e5bb4a36dd5e5c8c15

SHA1
eb1cd013f15fad7a9478529c0d7c8e7b131eb795

SHA256
46d650ba21cad6fb4b5235f2d3c07c3b1a7c565db55b5a08501bab4c75fc8e67

SHA512
b6d1b2c732c6e87945158ba4a10811b69baa36235818b7caf7b41c9fc8f9624864860525a35fd83aafad05111d5195e1f779a22e0e817894970838a9aaf6dbd9

Download Submit
C:\Windows\SysWOW64\oewphsxiaxktu.exe

Filesize
255KB

MD5
67e398e313bab46d296898858b5c4103

SHA1
c85eb99883c49b4285f2d3ee4959670ea845e873

SHA256
d2f323f3fc5ea21ebd197b35747494e5ee644b1be4ed4f1da73ec800b7549687

SHA512
affa1b4c6d5a7c0f1c3e1d751cf2f489d82240244a597463ceed04688936b4b56e29d34776a9c65257abbeef5bb087b425e680b89a3d620c2ba15d5fe40f58e0

Download Submit
C:\Windows\SysWOW64\supdgqiyco.exe

Filesize
255KB

MD5
392250e78eec2245b1d30e5d00219f6b

SHA1
833e088f6d7eae34e980908fd17da1b121e03794

SHA256
32a2c5887899b82ba0622d8e156a50d56d3f1ce92947cec4ada5798d7689e872

SHA512
965fd7619c272099c6bf8cea22772f81f963868a0112b094a41bc95efcb1379f584fea8b4b4f1a18563bf9aae3e31b2f7a93f395f23373039a7038bdee68e283

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
memory/1144-142-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1144-106-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1144-139-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1144-93-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1144-136-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1144-83-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1144-78-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1144-145-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1144-73-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1144-133-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1144-28-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1144-112-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1144-109-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1144-96-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1144-102-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1144-99-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1952-24-0x0000000002B30000-0x0000000002BD0000-memory.dmp

Filesize
640KB

Download
memory/1952-0-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1952-33-0x0000000002B30000-0x0000000002BD0000-memory.dmp

Filesize
640KB

Download
memory/1952-47-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1976-94-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1976-103-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1976-84-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1976-146-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1976-143-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1976-37-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1976-140-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1976-137-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1976-79-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1976-134-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1976-97-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1976-100-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1976-74-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1976-113-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1976-110-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1976-107-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1996-111-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1996-141-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1996-108-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1996-147-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1996-38-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1996-144-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1996-81-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1996-86-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1996-114-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1996-75-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1996-104-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1996-95-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1996-101-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1996-135-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1996-98-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1996-138-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2148-76-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2148-80-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2148-85-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2148-90-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2916-48-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2916-132-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2924-87-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2924-45-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2924-91-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2924-77-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2924-82-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download