Analysis
- max time kernel
150s - max time network
20s - platform
windows7_x64 - resource
win7-20240708-en - resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system - submitted
25/08/2024, 11:42
Behavioral task
behavioral1
Sample
c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
26 signatures
150 seconds
General
- Target c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe
- Size 255KB
- Sample240825-nt7lsathlr
- SHA256 84661e06b67e06bd1452e21d055ada35f5da425f33aa5de4f8be1b60ab1dfd16
- MD5 c0ab976b462dcd16f10ad7bc2dc538da
- SHA1 8ac08f43a4ca2fb6c281bb6e7987d50d7d7427d3
- SHA512 3a603ba3074ad4c7318e26e74a54e4271759ede80381cd67636e6a26e0ad6b984ec1cb58e15071aba5f67bd05f741712cdface16049ef0d7bcb78e64af0df5f0
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJB:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIs
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" pqjqlpubzz.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" pqjqlpubzz.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" pqjqlpubzz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" pqjqlpubzz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" pqjqlpubzz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" pqjqlpubzz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" pqjqlpubzz.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" pqjqlpubzz.exe - Executes dropped EXE 5 IoCs
pid Process 2108 pqjqlpubzz.exe 2180 izqyzoxtsizlvdj.exe 1484 mgtcyywxbbooc.exe 2904 eappgvwn.exe 2956 eappgvwn.exe - Loads dropped DLL 5 IoCs
pid Process 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 2108 pqjqlpubzz.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2908-0-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/files/0x000800000001660d-6.dat upx behavioral1/files/0x0009000000012119-17.dat upx behavioral1/files/0x000800000001688f-43.dat upx behavioral1/memory/2180-30-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/files/0x0008000000016688-28.dat upx behavioral1/memory/1484-42-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2904-40-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2108-26-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2956-46-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2908-48-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/files/0x0009000000016d21-76.dat upx behavioral1/files/0x0007000000016caa-74.dat upx behavioral1/memory/2108-78-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2180-79-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2904-80-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1484-81-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2956-83-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2956-89-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1484-88-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2904-87-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2180-86-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2108-85-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1484-93-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2956-94-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2904-92-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2180-91-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2108-90-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2956-98-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2904-97-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2108-100-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2180-101-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1484-102-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2180-104-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1484-105-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2108-103-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2180-107-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1484-108-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2108-106-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2108-109-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1484-111-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2180-110-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2180-114-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1484-115-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2108-113-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2180-117-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2108-116-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1484-118-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2180-120-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1484-121-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2108-119-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1484-129-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2180-128-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2108-127-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2180-144-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1484-145-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2108-143-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2108-146-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2180-147-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1484-148-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2108-149-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2180-150-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1484-151-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2180-153-0x0000000000400000-0x00000000004A0000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" pqjqlpubzz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" pqjqlpubzz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" pqjqlpubzz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" pqjqlpubzz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" pqjqlpubzz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" pqjqlpubzz.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fcotrrgu = "pqjqlpubzz.exe" izqyzoxtsizlvdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cjvdglns = "izqyzoxtsizlvdj.exe" izqyzoxtsizlvdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mgtcyywxbbooc.exe" izqyzoxtsizlvdj.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\r: eappgvwn.exe File opened (read-only) \??\j: eappgvwn.exe File opened (read-only) \??\l: eappgvwn.exe File opened (read-only) \??\r: eappgvwn.exe File opened (read-only) \??\a: eappgvwn.exe File opened (read-only) \??\u: eappgvwn.exe File opened (read-only) \??\w: eappgvwn.exe File opened (read-only) \??\b: pqjqlpubzz.exe File opened (read-only) \??\j: pqjqlpubzz.exe File opened (read-only) \??\m: pqjqlpubzz.exe File opened (read-only) \??\l: eappgvwn.exe File opened (read-only) \??\q: eappgvwn.exe File opened (read-only) \??\h: pqjqlpubzz.exe File opened (read-only) \??\w: pqjqlpubzz.exe File opened (read-only) \??\m: eappgvwn.exe File opened (read-only) \??\t: eappgvwn.exe File opened (read-only) \??\x: eappgvwn.exe File opened (read-only) \??\e: pqjqlpubzz.exe File opened (read-only) \??\i: pqjqlpubzz.exe File opened (read-only) \??\j: eappgvwn.exe File opened (read-only) \??\t: eappgvwn.exe File opened (read-only) \??\x: eappgvwn.exe File opened (read-only) \??\g: pqjqlpubzz.exe File opened (read-only) \??\q: pqjqlpubzz.exe File opened (read-only) \??\h: eappgvwn.exe File opened (read-only) \??\a: pqjqlpubzz.exe File opened (read-only) \??\z: pqjqlpubzz.exe File opened (read-only) \??\e: eappgvwn.exe File opened (read-only) \??\b: eappgvwn.exe File opened (read-only) \??\u: eappgvwn.exe File opened (read-only) \??\y: eappgvwn.exe File opened (read-only) \??\n: pqjqlpubzz.exe File opened (read-only) \??\o: pqjqlpubzz.exe File opened (read-only) \??\v: eappgvwn.exe File opened (read-only) \??\s: eappgvwn.exe File opened (read-only) \??\k: pqjqlpubzz.exe File opened (read-only) \??\s: eappgvwn.exe File opened (read-only) \??\i: eappgvwn.exe File opened (read-only) \??\k: eappgvwn.exe File opened (read-only) \??\q: eappgvwn.exe File opened (read-only) \??\s: pqjqlpubzz.exe File opened (read-only) \??\p: eappgvwn.exe File opened (read-only) \??\b: eappgvwn.exe File opened (read-only) \??\e: eappgvwn.exe File opened (read-only) \??\o: eappgvwn.exe File opened (read-only) \??\g: eappgvwn.exe File opened (read-only) \??\y: eappgvwn.exe File opened (read-only) \??\a: eappgvwn.exe File opened (read-only) \??\g: eappgvwn.exe File opened (read-only) \??\k: eappgvwn.exe File opened (read-only) \??\p: eappgvwn.exe File opened (read-only) \??\m: eappgvwn.exe File opened (read-only) \??\n: eappgvwn.exe File opened (read-only) \??\u: pqjqlpubzz.exe File opened (read-only) \??\x: pqjqlpubzz.exe File opened (read-only) \??\n: eappgvwn.exe File opened (read-only) \??\z: eappgvwn.exe File opened (read-only) \??\h: eappgvwn.exe File opened (read-only) \??\l: pqjqlpubzz.exe File opened (read-only) \??\i: eappgvwn.exe File opened (read-only) \??\v: eappgvwn.exe File opened (read-only) \??\z: eappgvwn.exe File opened (read-only) \??\t: pqjqlpubzz.exe File opened (read-only) \??\o: eappgvwn.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" pqjqlpubzz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" pqjqlpubzz.exe - AutoIT Executable 57 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2180-30-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2904-40-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2908-48-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2108-78-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2180-79-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2904-80-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1484-81-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2108-82-0x0000000004030000-0x00000000040D0000-memory.dmp autoit_exe behavioral1/memory/2956-83-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2956-89-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1484-88-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2904-87-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2180-86-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2108-85-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1484-93-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2956-94-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2904-92-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2180-91-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2108-90-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2956-98-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2904-97-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2108-100-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2180-101-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1484-102-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2180-104-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1484-105-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2108-103-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2180-107-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1484-108-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2108-106-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2108-109-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1484-111-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2180-110-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2180-114-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1484-115-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2108-113-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2180-117-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2108-116-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1484-118-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2180-120-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1484-121-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2108-119-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1484-129-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2180-128-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2108-127-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2180-144-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1484-145-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2108-143-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2108-146-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2180-147-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1484-148-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2108-149-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2180-150-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1484-151-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2180-153-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1484-154-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2108-152-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe - Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\eappgvwn.exe c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe File created C:\Windows\SysWOW64\mgtcyywxbbooc.exe c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll pqjqlpubzz.exe File opened for modification C:\Windows\SysWOW64\pqjqlpubzz.exe c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe File created C:\Windows\SysWOW64\izqyzoxtsizlvdj.exe c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\izqyzoxtsizlvdj.exe c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe File created C:\Windows\SysWOW64\pqjqlpubzz.exe c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\eappgvwn.exe c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mgtcyywxbbooc.exe c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe eappgvwn.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe eappgvwn.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe eappgvwn.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal eappgvwn.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe eappgvwn.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe eappgvwn.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal eappgvwn.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe eappgvwn.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal eappgvwn.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe eappgvwn.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe eappgvwn.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal eappgvwn.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe eappgvwn.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe eappgvwn.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language izqyzoxtsizlvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pqjqlpubzz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eappgvwn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mgtcyywxbbooc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eappgvwn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE - Office loads VBA resources, possible macro or embedded object present
- Modifies registry class 19 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABCF9BEFE17F290847A3B3781EC3E95B38C02FD4262034CE2C8429D08A0" c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf pqjqlpubzz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs pqjqlpubzz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg pqjqlpubzz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32432D799C2382276A3077D077232CDC7C8465AA" c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F76BB6FE6B22DCD172D1D38A7E9016" c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh pqjqlpubzz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" pqjqlpubzz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" pqjqlpubzz.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" pqjqlpubzz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" pqjqlpubzz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc pqjqlpubzz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" pqjqlpubzz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" pqjqlpubzz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "183AC67B14E4DABFB8BA7CE8ED9037CA" c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFCFFFB4F5F85129031D62E7E92BCE5E130594567316331D7EE" c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat pqjqlpubzz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB7B12B44EE38E253C9B9D43392D7C8" c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2824 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 2180 izqyzoxtsizlvdj.exe 2180 izqyzoxtsizlvdj.exe 2180 izqyzoxtsizlvdj.exe 2180 izqyzoxtsizlvdj.exe 2180 izqyzoxtsizlvdj.exe 2108 pqjqlpubzz.exe 2108 pqjqlpubzz.exe 2108 pqjqlpubzz.exe 2108 pqjqlpubzz.exe 2108 pqjqlpubzz.exe 1484 mgtcyywxbbooc.exe 1484 mgtcyywxbbooc.exe 1484 mgtcyywxbbooc.exe 1484 mgtcyywxbbooc.exe 1484 mgtcyywxbbooc.exe 1484 mgtcyywxbbooc.exe 2904 eappgvwn.exe 2904 eappgvwn.exe 2904 eappgvwn.exe 2904 eappgvwn.exe 2956 eappgvwn.exe 2956 eappgvwn.exe 2956 eappgvwn.exe 2956 eappgvwn.exe 2180 izqyzoxtsizlvdj.exe 1484 mgtcyywxbbooc.exe 1484 mgtcyywxbbooc.exe 2180 izqyzoxtsizlvdj.exe 2180 izqyzoxtsizlvdj.exe 1484 mgtcyywxbbooc.exe 1484 mgtcyywxbbooc.exe 2180 izqyzoxtsizlvdj.exe 1484 mgtcyywxbbooc.exe 1484 mgtcyywxbbooc.exe 2180 izqyzoxtsizlvdj.exe 1484 mgtcyywxbbooc.exe 1484 mgtcyywxbbooc.exe 2180 izqyzoxtsizlvdj.exe 1484 mgtcyywxbbooc.exe 1484 mgtcyywxbbooc.exe 2180 izqyzoxtsizlvdj.exe 1484 mgtcyywxbbooc.exe 1484 mgtcyywxbbooc.exe 2180 izqyzoxtsizlvdj.exe 1484 mgtcyywxbbooc.exe 1484 mgtcyywxbbooc.exe 2180 izqyzoxtsizlvdj.exe 1484 mgtcyywxbbooc.exe 1484 mgtcyywxbbooc.exe 2180 izqyzoxtsizlvdj.exe 1484 mgtcyywxbbooc.exe 1484 mgtcyywxbbooc.exe 2180 izqyzoxtsizlvdj.exe 1484 mgtcyywxbbooc.exe 1484 mgtcyywxbbooc.exe 2180 izqyzoxtsizlvdj.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 2180 izqyzoxtsizlvdj.exe 2180 izqyzoxtsizlvdj.exe 2180 izqyzoxtsizlvdj.exe 2108 pqjqlpubzz.exe 2108 pqjqlpubzz.exe 2108 pqjqlpubzz.exe 1484 mgtcyywxbbooc.exe 1484 mgtcyywxbbooc.exe 1484 mgtcyywxbbooc.exe 2904 eappgvwn.exe 2904 eappgvwn.exe 2904 eappgvwn.exe 2956 eappgvwn.exe 2956 eappgvwn.exe 2956 eappgvwn.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 2180 izqyzoxtsizlvdj.exe 2180 izqyzoxtsizlvdj.exe 2180 izqyzoxtsizlvdj.exe 2108 pqjqlpubzz.exe 2108 pqjqlpubzz.exe 2108 pqjqlpubzz.exe 1484 mgtcyywxbbooc.exe 1484 mgtcyywxbbooc.exe 1484 mgtcyywxbbooc.exe 2904 eappgvwn.exe 2904 eappgvwn.exe 2904 eappgvwn.exe 2956 eappgvwn.exe 2956 eappgvwn.exe 2956 eappgvwn.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2824 WINWORD.EXE 2824 WINWORD.EXE - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2908 wrote to memory of 2108 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 30 PID 2908 wrote to memory of 2108 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 30 PID 2908 wrote to memory of 2108 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 30 PID 2908 wrote to memory of 2108 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 30 PID 2908 wrote to memory of 2180 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 31 PID 2908 wrote to memory of 2180 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 31 PID 2908 wrote to memory of 2180 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 31 PID 2908 wrote to memory of 2180 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 31 PID 2908 wrote to memory of 2904 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 32 PID 2908 wrote to memory of 2904 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 32 PID 2908 wrote to memory of 2904 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 32 PID 2908 wrote to memory of 2904 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 32 PID 2908 wrote to memory of 1484 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 33 PID 2908 wrote to memory of 1484 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 33 PID 2908 wrote to memory of 1484 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 33 PID 2908 wrote to memory of 1484 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 33 PID 2108 wrote to memory of 2956 2108 pqjqlpubzz.exe 34 PID 2108 wrote to memory of 2956 2108 pqjqlpubzz.exe 34 PID 2108 wrote to memory of 2956 2108 pqjqlpubzz.exe 34 PID 2108 wrote to memory of 2956 2108 pqjqlpubzz.exe 34 PID 2908 wrote to memory of 2824 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 35 PID 2908 wrote to memory of 2824 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 35 PID 2908 wrote to memory of 2824 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 35 PID 2908 wrote to memory of 2824 2908 c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe 35 PID 2824 wrote to memory of 2748 2824 WINWORD.EXE 37 PID 2824 wrote to memory of 2748 2824 WINWORD.EXE 37 PID 2824 wrote to memory of 2748 2824 WINWORD.EXE 37 PID 2824 wrote to memory of 2748 2824 WINWORD.EXE 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c0ab976b462dcd16f10ad7bc2dc538da_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\pqjqlpubzz.exepqjqlpubzz.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\eappgvwn.exeC:\Windows\system32\eappgvwn.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2956
-
-
-
C:\Windows\SysWOW64\izqyzoxtsizlvdj.exeizqyzoxtsizlvdj.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2180
-
-
C:\Windows\SysWOW64\eappgvwn.exeeappgvwn.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2904
-
-
C:\Windows\SysWOW64\mgtcyywxbbooc.exemgtcyywxbbooc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1484
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:2748
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
- Size 255KB
- SHA256 ac1ec81bf51fddc667cbb380659b3fcacfcc8a60141d30a3e1e42e7eb0a54e4d
- MD5 c0091236d6850b7b6753ec839b13f627
- SHA1 cd4504bfc2265a0946e87c7288b6f6c9b98ff192
- SHA512 6bea5e919f23fa831b5e8fde5deeb325d3e929957616730c58bd1866a2a19cad15bfe076053c245954faf932edf747dd18858ed25716961f4d0a0c82d6250945
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJF:1xlZam+akqx6YQJXcNlEHUIQeE3mmBII
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
- Size 255KB
- SHA256 0316670a57d2a137e721d4f625a54228174db2412a497b645cbe816591dc3e48
- MD5 f7c23bfb47b613a9810805d477eb9498
- SHA1 543b696565d261bc85bdc6f14a1a86cb5d9eb3c9
- SHA512 4553bb7f55304e50a10552587d9721e57a458d6341163eade35090aed9add59b8351041718a6a4d7050869b95af89fd7273d5cfe4ad9d66d90d475a52c11e889
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ7:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
- Size 19KB
- SHA256 db88cc9ffed568aab98979e301ab72579c2f8863e2e344611199ad39644e7f27
- MD5 cf1079c90c39e5c69d47403872bb3bab
- SHA1 39d9fc8a967cc7f194ba734e93f7e66ab8eb5cbe
- SHA512 d4d9deb1979ff598cdafbbf2672ff2adcf91b1a85d5018e2675ba1502656b3184717f2f9e61df768145907565204933539f5af1ae20c0c59dae38e4bdfb47e2d
- SSDEEP 384:Pjl/SU5tl+V+pySUG6F7//osa2oX4EP8am2pLXMAPBB:hOZSqaJX4ZmIAH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\izqyzoxtsizlvdj.exe
- Size 255KB
- SHA256 06c0028fb463ba3cf9f2e47dd77248d83e29ee43398fa29b685c4a3432eb08d2
- MD5 f30372649c325c84dbba3078444a1b80
- SHA1 4e2f4c274b7a142786badacae4b6680c5ffab49b
- SHA512 c0989ad70eae9d5dc3bfbd870fd5574f56e210f98c67ade2f392b172516b25e85f6becb23a7f85f0c8cb577ffb0f055da4c0aa83b3006ee30315b3b79a9710da
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJC:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\mgtcyywxbbooc.exe
- Size 255KB
- SHA256 b045d8e17a972611f1991174101595dc6ea0f90def9ea97469c866a3c21f1fd1
- MD5 0c8fc14c255cc6791506394ef072c4e5
- SHA1 5aa389cc747212649aff88b061ced36c0198657e
- SHA512 5d32c0570fc5132a2ec2e9efc01eb1f952ce61a9ce890dcb13638c18d88117594c20f54f5f57c5aeb295c6b686595c0f2bf3cb9700a7d9bb853c040f6c56d798
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJn:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \Windows\SysWOW64\eappgvwn.exe
- Size 255KB
- SHA256 ac7780481801a0dd3abe4ea030d3461f082ac6ae4f3d2dace072f4fbcec145c3
- MD5 88f62b2dd91a95b4886151aefef6df86
- SHA1 e3f7f3039896fafa74e6d15d362b9695bcb32ac9
- SHA512 a4d62ac77af1d630d46daa09f72ffe690a9a7aced8dfb31f44762cf48be0454d36a6e39119bb95f3921ca9b9107d1dd831c1092a61daf103a5b2f1537b02520b
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJI:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIH
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\SysWOW64\pqjqlpubzz.exe
- Size 255KB
- SHA256 d89c880baee7208cd837a5cc10b5b15eeb59b333c20f1719b5bc407e129ffed1
- MD5 2f11c506d9ad1bdacb77860ab8cf35e7
- SHA1 1f597f7ae769d430e8c836e6cb64041039c39590
- SHA512 e7f9d360c6ac965082912e17f06d0a0b52911b54c722178423436cf1db2d7d1d7e8de91580b4546c4cc209d2525c456d629fd87c709d7f1605f728fafefa9c09
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJj:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIO
- MD5 SHA1 SHA512 SSDEEP