cerber | 3e478bb8de1bbbd2744d7c467220ba0373ce3f636eff55cab6c0c3b27ecd30a1

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26-08-2024 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe
Size

258KB
MD5

c24367dcd19f9d4a3f36fbd3cd1d8c11
SHA1

332541a2416b70cf23fbd02b82bf2c807dbcb3d7
SHA256

3e478bb8de1bbbd2744d7c467220ba0373ce3f636eff55cab6c0c3b27ecd30a1
SHA512

a4a8c48b49910c71619578ad9e58998bd236dffb396d29733c58078b659042f03729989fe4fa537078b6aa33b4025b4711e6f0e55cf3c0996911f70b86791411
SSDEEP

6144:BwHysO+NnMZ2INVorOnii05dapobD/OLJoMyk6zM:qO+NFYRYQyGNTykIM

Score

10^/10

cerber defense_evasion discovery evasion execution impact persistence ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\# DECRYPT MY FILES #.html

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Cerber Ransomware</title> <style> a { color: #47c; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #333; font-family: "Helvetica Neue", Helvetica, "Segoe UI", Arial, freesans, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; } hr { background-color: #e7e7e7; border: 0 none; border-bottom: 1px solid #c7c7c7; height: 5px; margin: 30px 0; } li { padding: 0 0 7px 7px; } ol { padding-left: 3em; } .container { background-color: #fff; border: 1px solid #c7c7c7; margin: 40px; padding: 40px 40px 20px 40px; } .info, .tor { background-color: #efe; border: 1px solid #bda; display: block; padding: 0px 20px; } .logo { font-size: 12px; font-weight: bold; line-height: 1; margin: 0; } .upd_on { color: red; display: block; } .upd_off { display: none; float: left; } .tor { padding: 10px 0; text-align: center; } .url { margin-right: 5px; } .warning { background-color: #f5e7e7; border: 1px solid #ebccd1; color: #a44; display: block; padding: 15px 10px; text-align: center; } </style> </head> <body> <div class="container"> <h3>C E R B E R   R A N S O M W A R E</h3> <hr> Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great! You have turned to be a part of a big community "#C3rber Ransomware". <hr> If you are reading this message it means the software "Cerber" has been removed from your computer. <hr> <h3>What is encryption?</h3> Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. <hr> <h3>Everything is clear for me but what should I do?</h3> The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !Any attempts to get back your files with the third-party tools can be fatal for your encrypted files! The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files! When you make a puzzle, but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. <hr> There are several plain steps to restore your files but if you do not follow them we will not be able to help you, and we will not try since you have read this warning already. <hr> For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: <ol> <li>decrypt all your files;</li> <li>work with your documents;</li> <li>view your photos and other media;</li> <li>continue your usual and comfortable work at the computer.</li> </ol> If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. <hr> <div class="info"> There is a list of temporary addresses to go on your personal page below: <ol> <li>Please wait...<a class="url" href="http://52uo5k3t73ypjije.o8hpwj.top/4D4D-20BF-998C-0046-1F55" id="url_1" target="_blank">http://52uo5k3t73ypjije.o8hpwj.top/4D4D-20BF-998C-0046-1F55</a>(<a href="#updateUrl" onClick="return updateUrl();" style="color: red;">Get a NEW address!</a>)</li> <li><a href="http://52uo5k3t73ypjije.uwckha.top/4D4D-20BF-998C-0046-1F55" target="_blank">http://52uo5k3t73ypjije.uwckha.top/4D4D-20BF-998C-0046-1F55</a></li> <li><a href="http://52uo5k3t73ypjije.5tb8hy.bid/4D4D-20BF-998C-0046-1F55" target="_blank">http://52uo5k3t73ypjije.5tb8hy.bid/4D4D-20BF-998C-0046-1F55</a></li> <li><a href="http://52uo5k3t73ypjije.hhc366.top/4D4D-20BF-998C-0046-1F55" target="_blank">http://52uo5k3t73ypjije.hhc366.top/4D4D-20BF-998C-0046-1F55</a></li> <li><a href="http://52uo5k3t73ypjije.onion.to/4D4D-20BF-998C-0046-1F55" target="_blank">http://52uo5k3t73ypjije.onion.to/4D4D-20BF-998C-0046-1F55</a></li> </ol> </div> <hr> <h3>What should you do with these addresses?</h3> If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): <ol> <li>take a look at the first address (in this case it is Please wait...<a class="url" href="http://52uo5k3t73ypjije.o8hpwj.top/4D4D-20BF-998C-0046-1F55" id="url_2" target="_blank">http://52uo5k3t73ypjije.o8hpwj.top/4D4D-20BF-998C-0046-1F55</a>);</li> <li>select it with the mouse cursor holding the left mouse button and moving the cursor to the right;</li> <li>release the left mouse button and press the right one;</li> <li>select "Copy" in the appeared menu;</li> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>move the mouse cursor to the address bar of the browser (this is the place where the site address is written);</li> <li>click the right mouse button in the field where the site address is written;</li> <li>select the button "Insert" in the appeared menu;</li> <li>then you will see the address Please wait...<a class="url" href="http://52uo5k3t73ypjije.o8hpwj.top/4D4D-20BF-998C-0046-1F55" id="url_3" target="_blank">http://52uo5k3t73ypjije.o8hpwj.top/4D4D-20BF-998C-0046-1F55</a> appeared there;</li> <li>press ENTER;</li> <li>the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: <ol> <li>click the left mouse button on the first address (in this case it is Please wait...<a class="url" href="http://52uo5k3t73ypjije.o8hpwj.top/4D4D-20BF-998C-0046-1F55" id="url_4" target="_blank">http://52uo5k3t73ypjije.o8hpwj.top/4D4D-20BF-998C-0046-1F55</a>);</li> <li>in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet. <hr> Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: <ol> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>enter or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loading;</li> <li>on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>run Tor Browser;</li> <li>connect with the button "Connect" (if you use the English version);</li> <li>a normal Internet browser window will be opened after the initialization;</li> <li>type or copy the address http://52uo5k3t73ypjije.onion/4D4D-20BF-998C-0046-1F55 in this browser address bar;</li> <li>press ENTER;</li> <li>the site should be loaded; if for some reason the site is not loading wait for a moment and try again.</li> </ol> If you have any problems during installation or operation of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=install+tor+browser+windows" target="_blank">https://www.youtube.com/</a> and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. <hr> <h3>Additional information:</h3> You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. <hr> Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. <hr> If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. <hr> Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files. </div> <script> function getXMLHttpRequest() { if (window.XMLHttpRequest) { return new window.XMLHttpRequest; } else { try { return new ActiveXObject("MSXML2.XMLHTTP.3.0"); } catch(error) { return null; } } } function getUrlContent(url, callback) { var xhttp = getXMLHttpRequest(); if (xhttp) { xhttp.onreadystatechange = function() { if (xhttp.readyState == 4) { if (xhttp.status == 200) { return callback(xhttp.responseText.replace(/[\s ]+/gm, ""), null); } else { return callback(null, true); } } }; xhttp.open("GET", url + '?_=' + new Date().getTime(), true); xhttp.send(); } else { return callback(null, true); } } function server1(address, callback) { getUrlContent("http://btc.blockr.io/api/v1/address/txs/" + address, function(result, error) { if (!error) { var tx = /"tx":"([\w]+)","time_utc":"[\w-:]+","confirmations":[\d]+,"amount":-/.exec(result); if (tx) { getUrlContent("http://btc.blockr.io/api/v1/tx/info/" + tx[1], function(result, error) { if (!error) { var address = /"vouts":\[{"address":"([\w]+)"/.exec(result); if (address) { return callback(address[1], null); } else { return callback(null, true); } } else { return callback(null, true); } }); } else { return callback(null, true); } } else { return callback(null, true); } }); } function server2(address, callback) { getUrlContent("http://api.blockcypher.com/v1/btc/main/addrs/" + address, function(result, error) { if (!error) { var tx = /"tx_hash":"([\w]+)","block_height":[\d]+,"tx_input_n":[\d-]+,"tx_output_n":-/.exec(result); if (tx) { getUrlContent("http://api.blockcypher.com/v1/btc/main/txs/" + tx[1], function(result, error) { if (!error) { var address = /"outputs":\[{"value":[\d]+,"script":"[\w]+","spent_by":"[\w]+","addresses":\["([\w]+)"/.exec(result); if (address) { return callback(address[1], null); } else { return callback(null, true); } } else { return callback(null, true); } }); } else { return callback(null, true); } } else { return callback(null, true);

Extracted

Path

C:\Users\Admin\Downloads\# DECRYPT MY FILES #.txt

Ransom Note

C_E_R_B_E_R R_A_N_S_O_M_W_A_R_E ######################################################################### Cannot you find the files you need? Is the content of the files that you looked for not readable??? It is normal because the files' names, as well as the data in your files have been encrypted. Great! You have turned to be a part of a big community "#Cerb3r Ransomware". ######################################################################### !!! If you are reading this message it means the software "Cerber" has !!! been removed from your computer. !!! HTML instruction ("# DECRYPT MY FILES #.html") always contains a !!! working domain of your personal page! ######################################################################### What is encryption? ------------------- Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. ######################################################################### Everything is clear for me but what should I do? ------------------------------------------------ The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !!! Any attempts to return your files with the third-party tools can !!! be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle, but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. ######################################################################### !!! There are several plain steps to restore your files but if you do !!! not follow them we will not be able to help you, and we will not try !!! since you have read this warning already. ######################################################################### For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: 1. decrypt all your files; 2. work with your documents; 3. view your photos and other media; 4. continue your usual and comfortable work at the computer. If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. ######################################################################### There is a list of temporary addresses to go on your personal page below: _______________________________________________________________________ | | 1. http://52uo5k3t73ypjije.o8hpwj.top/4D4D-20BF-998C-0046-1F55 | | 2. http://52uo5k3t73ypjije.uwckha.top/4D4D-20BF-998C-0046-1F55 | | 3. http://52uo5k3t73ypjije.5tb8hy.bid/4D4D-20BF-998C-0046-1F55 | | 4. http://52uo5k3t73ypjije.hhc366.top/4D4D-20BF-998C-0046-1F55 | | 5. http://52uo5k3t73ypjije.onion.to/4D4D-20BF-998C-0046-1F55 |_______________________________________________________________________ ######################################################################### What should you do with these addresses? ---------------------------------------- If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): 1. take a look at the first address (in this case it is http://52uo5k3t73ypjije.o8hpwj.top/4D4D-20BF-998C-0046-1F55); 2. select it with the mouse cursor holding the left mouse button and moving the cursor to the right; 3. release the left mouse button and press the right one; 4. select "Copy" in the appeared menu; 5. run your Internet browser (if you do not know what it is run the Internet Explorer); 6. move the mouse cursor to the address bar of the browser (this is the place where the site address is written); 7. click the right mouse button in the field where the site address is written; 8. select the button "Insert" in the appeared menu; 9. then you will see the address http://52uo5k3t73ypjije.o8hpwj.top/4D4D-20BF-998C-0046-1F55 appeared there; 10. press ENTER; 11. the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling. If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: 1. click the left mouse button on the first address (in this case it is http://52uo5k3t73ypjije.o8hpwj.top/4D4D-20BF-998C-0046-1F55); 2. in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address. If for some reason the site cannot be opened check the connection to the Internet. ######################################################################### Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: 1. run your Internet browser (if you do not know what it is run the Internet Explorer); 2. enter or copy the address https://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER; 3. wait for the site loading; 4. on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed; 5. run Tor Browser; 6. connect with the button "Connect" (if you use the English version); 7. a normal Internet browser window will be opened after the initialization; 8. type or copy the address ________________________________________________________ | | | http://52uo5k3t73ypjije.onion/4D4D-20BF-998C-0046-1F55 | |________________________________________________________| in this browser address bar; 9. press ENTER; 10. the site should be loaded; if for some reason the site is not loading wait for a moment and try again. If you have any problems during installation or operation of Tor Browser, please, visit https://www.youtube.com/ and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. ######################################################################### Additional information: You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. ######################################################################### Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. ######################################################################### If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. ######################################################################### Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files.

URLs

http://52uo5k3t73ypjije.o8hpwj.top/4D4D-20BF-998C-0046-1F55

http://52uo5k3t73ypjije.uwckha.top/4D4D-20BF-998C-0046-1F55

http://52uo5k3t73ypjije.5tb8hy.bid/4D4D-20BF-998C-0046-1F55

http://52uo5k3t73ypjije.hhc366.top/4D4D-20BF-998C-0046-1F55

http://52uo5k3t73ypjije.onion.to/4D4D-20BF-998C-0046-1F55

http://52uo5k3t73ypjije.onion/4D4D-20BF-998C-0046-1F55

Signatures

Cerber 2 IoCs

Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

ransomware cerber

description	ioc	Process
Mutant opened	shell.{7730090E-AB26-FD6E-A973-AD69CA559F2E}	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe
Mutant created	shell.{7730090E-AB26-FD6E-A973-AD69CA559F2E}	auditpol.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	auditpol.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2020	bcdedit.exe
1464	bcdedit.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7F19A57-C953-7B64-1413-296E95479BC0}\\auditpol.exe\""	auditpol.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7F19A57-C953-7B64-1413-296E95479BC0}\\auditpol.exe\""	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe

Contacts a large (524) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Deletes itself 1 IoCs

pid	Process
2604	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\auditpol.lnk	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\auditpol.lnk	auditpol.exe

Executes dropped EXE 2 IoCs

pid	Process
2772	auditpol.exe
2504	auditpol.exe

Loads dropped DLL 6 IoCs

pid	Process
2536	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe
2536	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe
1988	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe
2772	auditpol.exe
2772	auditpol.exe
2772	auditpol.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\auditpol = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7F19A57-C953-7B64-1413-296E95479BC0}\\auditpol.exe\""	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\auditpol = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7F19A57-C953-7B64-1413-296E95479BC0}\\auditpol.exe\""	auditpol.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\auditpol = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7F19A57-C953-7B64-1413-296E95479BC0}\\auditpol.exe\""	auditpol.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\auditpol = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7F19A57-C953-7B64-1413-296E95479BC0}\\auditpol.exe\""	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	auditpol.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpA110.bmp"	auditpol.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2536 set thread context of 1988	2536	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe	30
PID 2772 set thread context of 2504	2772	auditpol.exe	39

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BUSINESS.ONE	auditpol.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.url	auditpol.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.vbs	auditpol.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNote.ini	auditpol.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.txt	auditpol.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ACADEMIC.ONE	auditpol.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE	auditpol.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.html	auditpol.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.txt	auditpol.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.html	auditpol.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNote-PipelineConfig.xml	auditpol.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.vbs	auditpol.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\PLANNERS.ONE	auditpol.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.url	auditpol.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BLANK.ONE	auditpol.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe
File opened for modification	C:\Windows\	auditpol.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	auditpol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	auditpol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2604	cmd.exe
2708	PING.EXE
376	cmd.exe
1588	PING.EXE

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x000500000001871a-38.dat	nsis_installer_1
behavioral1/files/0x000500000001871a-38.dat	nsis_installer_2

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
768	vssadmin.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
1896	taskkill.exe
1468	taskkill.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7F19A57-C953-7B64-1413-296E95479BC0}\\auditpol.exe\""	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop	auditpol.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{E7F19A57-C953-7B64-1413-296E95479BC0}\\auditpol.exe\""	auditpol.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 61 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430807653"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b01c4cb86ef7da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000d4a5eea399b633814eaa3b82f3149458bad20bfe03965ea88e76d8f48c705c23000000000e80000000020000200000001310248db296afcfb794da247fddd3d7c8b7d0787d6c1b01a546d45f9e9bca732000000037fd67650fb4e70cac650d65222ae0bf59f6da18f2a0800052161c556b37369140000000bfe07b82f3412999b830b5849cfa02c455ba1d4659221d563620bb6b8f39ff243f2a7641a422781dd29f603e5c883cd0163bc1c976f633bcfae52e79d364493b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F5925C11-6361-11EF-838C-C20DC8CB8E9E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F5867531-6361-11EF-838C-C20DC8CB8E9E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000bd46319d6aba0187fdbb7fd3b0a0bd02545a7f886630f36f5a31a785dcf60e4d000000000e80000000020000200000002ec726d05bb2a9feb36a8d86f2589d4bb1bbeca469a87c61e5d730c9a0f93c2d90000000f56fd9c7ea7147fd28cfbb6091b57e50b332d352bfcb5f1b173ef0b01cbd94623b679ee393a402f56f7a378d91b66706dce32bcb5cd88c1ed4b1c85bb7a627dc580edd14300c95647a7758a50578d87255b31b34f17e84fd27d9ce18bb04dd0c5927563f00e3babe154ea645edc4d5e83977e9e8722d909ee618fd0dd359ab5e3b3c547b6b4e6a3219d1cb64b7d24af340000000fb8d7c02c5b832c232c27af0ff1275e9d4b024ad135bfd50ffe6aaf130259cedd8e5d6b890cdf7e3a438e3b11c4b61cc0c5b6ee26d68d2a86cc053e469475a3d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2708	PING.EXE
1588	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe
2504	auditpol.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe
Token: SeDebugPrivilege	1896	taskkill.exe
Token: SeDebugPrivilege	2504	auditpol.exe
Token: SeBackupPrivilege	1140	vssvc.exe
Token: SeRestorePrivilege	1140	vssvc.exe
Token: SeAuditPrivilege	1140	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2564	wmic.exe
Token: SeSecurityPrivilege	2564	wmic.exe
Token: SeTakeOwnershipPrivilege	2564	wmic.exe
Token: SeLoadDriverPrivilege	2564	wmic.exe
Token: SeSystemProfilePrivilege	2564	wmic.exe
Token: SeSystemtimePrivilege	2564	wmic.exe
Token: SeProfSingleProcessPrivilege	2564	wmic.exe
Token: SeIncBasePriorityPrivilege	2564	wmic.exe
Token: SeCreatePagefilePrivilege	2564	wmic.exe
Token: SeBackupPrivilege	2564	wmic.exe
Token: SeRestorePrivilege	2564	wmic.exe
Token: SeShutdownPrivilege	2564	wmic.exe
Token: SeDebugPrivilege	2564	wmic.exe
Token: SeSystemEnvironmentPrivilege	2564	wmic.exe
Token: SeRemoteShutdownPrivilege	2564	wmic.exe
Token: SeUndockPrivilege	2564	wmic.exe
Token: SeManageVolumePrivilege	2564	wmic.exe
Token: 33	2564	wmic.exe
Token: 34	2564	wmic.exe
Token: 35	2564	wmic.exe
Token: SeIncreaseQuotaPrivilege	2564	wmic.exe
Token: SeSecurityPrivilege	2564	wmic.exe
Token: SeTakeOwnershipPrivilege	2564	wmic.exe
Token: SeLoadDriverPrivilege	2564	wmic.exe
Token: SeSystemProfilePrivilege	2564	wmic.exe
Token: SeSystemtimePrivilege	2564	wmic.exe
Token: SeProfSingleProcessPrivilege	2564	wmic.exe
Token: SeIncBasePriorityPrivilege	2564	wmic.exe
Token: SeCreatePagefilePrivilege	2564	wmic.exe
Token: SeBackupPrivilege	2564	wmic.exe
Token: SeRestorePrivilege	2564	wmic.exe
Token: SeShutdownPrivilege	2564	wmic.exe
Token: SeDebugPrivilege	2564	wmic.exe
Token: SeSystemEnvironmentPrivilege	2564	wmic.exe
Token: SeRemoteShutdownPrivilege	2564	wmic.exe
Token: SeUndockPrivilege	2564	wmic.exe
Token: SeManageVolumePrivilege	2564	wmic.exe
Token: 33	2564	wmic.exe
Token: 34	2564	wmic.exe
Token: 35	2564	wmic.exe
Token: SeDebugPrivilege	1468	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2352	iexplore.exe
1364	iexplore.exe
2352	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
2352	iexplore.exe
2352	iexplore.exe
2352	iexplore.exe
2352	iexplore.exe
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
1364	iexplore.exe
1364	iexplore.exe
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 1988	2536	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe	30
PID 2536 wrote to memory of 1988	2536	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe	30
PID 2536 wrote to memory of 1988	2536	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe	30
PID 2536 wrote to memory of 1988	2536	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe	30
PID 2536 wrote to memory of 1988	2536	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe	30
PID 2536 wrote to memory of 1988	2536	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe	30
PID 2536 wrote to memory of 1988	2536	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe	30
PID 2536 wrote to memory of 1988	2536	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe	30
PID 2536 wrote to memory of 1988	2536	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe	30
PID 2536 wrote to memory of 1988	2536	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe	30
PID 2536 wrote to memory of 1988	2536	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe	30
PID 1988 wrote to memory of 2772	1988	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe	33
PID 1988 wrote to memory of 2772	1988	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe	33
PID 1988 wrote to memory of 2772	1988	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe	33
PID 1988 wrote to memory of 2772	1988	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe	33
PID 1988 wrote to memory of 2604	1988	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe	34
PID 1988 wrote to memory of 2604	1988	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe	34
PID 1988 wrote to memory of 2604	1988	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe	34
PID 1988 wrote to memory of 2604	1988	c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe	34
PID 2604 wrote to memory of 1896	2604	cmd.exe	36
PID 2604 wrote to memory of 1896	2604	cmd.exe	36
PID 2604 wrote to memory of 1896	2604	cmd.exe	36
PID 2604 wrote to memory of 1896	2604	cmd.exe	36
PID 2604 wrote to memory of 2708	2604	cmd.exe	38
PID 2604 wrote to memory of 2708	2604	cmd.exe	38
PID 2604 wrote to memory of 2708	2604	cmd.exe	38
PID 2604 wrote to memory of 2708	2604	cmd.exe	38
PID 2772 wrote to memory of 2504	2772	auditpol.exe	39
PID 2772 wrote to memory of 2504	2772	auditpol.exe	39
PID 2772 wrote to memory of 2504	2772	auditpol.exe	39
PID 2772 wrote to memory of 2504	2772	auditpol.exe	39
PID 2772 wrote to memory of 2504	2772	auditpol.exe	39
PID 2772 wrote to memory of 2504	2772	auditpol.exe	39
PID 2772 wrote to memory of 2504	2772	auditpol.exe	39
PID 2772 wrote to memory of 2504	2772	auditpol.exe	39
PID 2772 wrote to memory of 2504	2772	auditpol.exe	39
PID 2772 wrote to memory of 2504	2772	auditpol.exe	39
PID 2772 wrote to memory of 2504	2772	auditpol.exe	39
PID 2504 wrote to memory of 768	2504	auditpol.exe	40
PID 2504 wrote to memory of 768	2504	auditpol.exe	40
PID 2504 wrote to memory of 768	2504	auditpol.exe	40
PID 2504 wrote to memory of 768	2504	auditpol.exe	40
PID 2504 wrote to memory of 2564	2504	auditpol.exe	45
PID 2504 wrote to memory of 2564	2504	auditpol.exe	45
PID 2504 wrote to memory of 2564	2504	auditpol.exe	45
PID 2504 wrote to memory of 2564	2504	auditpol.exe	45
PID 2504 wrote to memory of 2020	2504	auditpol.exe	47
PID 2504 wrote to memory of 2020	2504	auditpol.exe	47
PID 2504 wrote to memory of 2020	2504	auditpol.exe	47
PID 2504 wrote to memory of 2020	2504	auditpol.exe	47
PID 2504 wrote to memory of 1464	2504	auditpol.exe	49
PID 2504 wrote to memory of 1464	2504	auditpol.exe	49
PID 2504 wrote to memory of 1464	2504	auditpol.exe	49
PID 2504 wrote to memory of 1464	2504	auditpol.exe	49
PID 2504 wrote to memory of 2352	2504	auditpol.exe	52
PID 2504 wrote to memory of 2352	2504	auditpol.exe	52
PID 2504 wrote to memory of 2352	2504	auditpol.exe	52
PID 2504 wrote to memory of 2352	2504	auditpol.exe	52
PID 2504 wrote to memory of 2668	2504	auditpol.exe	53
PID 2504 wrote to memory of 2668	2504	auditpol.exe	53
PID 2504 wrote to memory of 2668	2504	auditpol.exe	53
PID 2504 wrote to memory of 2668	2504	auditpol.exe	53
PID 2352 wrote to memory of 2972	2352	iexplore.exe	55
PID 2352 wrote to memory of 2972	2352	iexplore.exe	55

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Users\Admin\AppData\Local\Temp\c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe"
  2⤵
  - Cerber
  - Modifies visiblity of hidden/system files in Explorer
  - Adds policy Run key to start application
  - Drops startup file
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Users\Admin\AppData\Roaming\{E7F19A57-C953-7B64-1413-296E95479BC0}\auditpol.exe
    "C:\Users\Admin\AppData\Roaming\{E7F19A57-C953-7B64-1413-296E95479BC0}\auditpol.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Users\Admin\AppData\Roaming\{E7F19A57-C953-7B64-1413-296E95479BC0}\auditpol.exe
      "C:\Users\Admin\AppData\Roaming\{E7F19A57-C953-7B64-1413-296E95479BC0}\auditpol.exe"
      4⤵
      Cerber
      Modifies visiblity of hidden/system files in Explorer
      Adds policy Run key to start application
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Checks whether UAC is enabled
      Sets desktop wallpaper using registry
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies Control Panel
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2504
    - - C:\Windows\system32\vssadmin.exe
        
        "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:768
    - - C:\Windows\system32\wbem\wmic.exe
        
        "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2564
    - - C:\Windows\System32\bcdedit.exe
        
        "C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2020
    - - C:\Windows\System32\bcdedit.exe
        
        "C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1464
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2352
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2352 CREDAT:275457 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2972
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2352 CREDAT:406530 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2612
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt
        5⤵
        
        PID:2668
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"
        5⤵
        
        PID:224
    - - C:\Windows\system32\cmd.exe
        
        /d /c taskkill /f /im "auditpol.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{E7F19A57-C953-7B64-1413-296E95479BC0}\auditpol.exe" > NUL
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:376
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "auditpol.exe"
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1468
      - C:\Windows\system32\PING.EXE
        
        ping -n 1 127.0.0.1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1588
- - C:\Windows\SysWOW64\cmd.exe
    /d /c taskkill /f /im "c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe" > NUL
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "c24367dcd19f9d4a3f36fbd3cd1d8c11_JaffaCakes118.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1896
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2708

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1140

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1364
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1364 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2144

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
1⤵
- System Location Discovery: System Language Discovery
PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
91f0864e82a7daad5eb50ac7bc115f3c

SHA1
e49309ead7317bcde918a620cf12a49a2197888c

SHA256
571c8548b81834eaec677268f776ee1d2f1fb021a0a2e56ba434efcf9e70ff94

SHA512
fd07e6653ed82113b514bf36adab3bde9d94dd59b061daba5154167aea746749991872bcef919adeef0a369f22df2a45c6035cf82f0f46839b68280358267b08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67ce5adf25024a67ad65f5a8a2cd05ec

SHA1
26f15be383b35a16bacc9a95e174c40f86809ac8

SHA256
da087af57768d076598baf08e957124265764f6a16e9d68d6aa7d027da99259e

SHA512
11b7be53b5f85bd2654473529d050b3507dab1dbb2c0aa1cf42d5bfde6c517fce00c2b24f303e46b8206bfc28b0649770aea39b7e9260e54b9f4439eaf37b187

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6bfe9b6f939d48ed52ce0a7476296b73

SHA1
7edf28d96956fb5dc99cf5b6e9f6ead66e2145f8

SHA256
33b3583c85327f9484e520c39b05cfa6c6fb45f57fe5b2c92d9f6e745337be4f

SHA512
65cef2f48c66eb7adc792716b81e29095998720c8a5ddafe139a5bc9632be22d3b266b64e51c8e149d4df80c0fac04510fcda3535d5abd4c26f844daeddea4ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb429cc1b4efc16507b02224da1dd82c

SHA1
22779497f1e5249524a982489d4c5d692b0b9dbe

SHA256
f1c38dc88e12fd47744cf5b6729ef4f5c0baaa62e03ed4821a12781b4b66e0d2

SHA512
a207e024f503454680e835027b973862aa80ed19b93a6cbf62fcd57589d9fbd587376e265917b383647f64bf6d41fc11bb4fce884e1be4a15ecf1ffb47db741b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8bb99ca7b6df2288bc662d509136170

SHA1
6b142e407db0814bb5ea2649bfbea81d2bb6a0bb

SHA256
2f461e425674268846b9cda45852246484255b5cd01b81acb83898dce0d6635e

SHA512
3f37ba1ee38c42c650fdd7d9036c6860367057b3ec4e170932fa54cdec885d1592c31a7d2f56f153b8916fd8827b6849eb209405a5b2091a0b8cb69519c63e1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d5dced4e89ebf2bc1ece15de7d40def

SHA1
b863ab86f17f8b7f35a22244f756e4bf871adfa3

SHA256
d676f3427f48c5ebe9c466d728dba53dd8c16d8b40e758a0aafb9dbefd99d2f6

SHA512
099824af6ef5f6956f475c19953a16d77aaeef74d5917510d70ae8e74db9961668ad7598c1707bad32cdb825e5e93e5811ca63d023665668cf91c850632d2ddd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf0a7e4623315fe743e383b81dcf9e80

SHA1
19e9ab685e7460626cede563604dc79e1b9b571c

SHA256
1884d20f3f8b26a682a674aa2726810600038a9a6d4980697efc61f71f46c954

SHA512
8d97e27ce71fdbf973e45cfd7e83cbd9726587d681da254cb1b5d3c9032fcb0c56091717afeb32930aabe52597069184c187db4e73fc55dacff5489dbc62d5b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4f1ef12fec45475f48746694677b195

SHA1
75f01773a4bcf57d668c734551c21613379a5bc1

SHA256
d47baa860a1320ff2fa9c5af412e0ec0367cde17654198ecc71595bcb53a87e8

SHA512
74ae15652dc85c4f4eb0f747dce4bf2dad875214e4211054c4a83dc3efcd4edacfbfe1e69ff514672ff030681ae910dd3741494b11f22dc6f5bca56372127084

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e72d7d8085bbceebb6dbc6f5ab231ccc

SHA1
55ccfeb3534837dcb50458ea047cb7d9abb1fc7f

SHA256
514425df51db6856bf8ba368bfb731c533bd6b2a67cd6b708d001af19809a880

SHA512
a5c5a71a8986ca1dd80d0e1525f342e39a39a17dadfc0aca76c7e848d95e4da83440cb3b681f9275ae778acd07cf2224701eda2ff5a1ece9eed88a87078e37ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
639d2dfb092341dcde36bc472e1a9d99

SHA1
f19259a22ef15bef5e1355be30f9afd7fd760ad4

SHA256
b717e4a00d7a497d69e1f54cf847014613a844a36dd61f66a0db02e614eebd98

SHA512
196dc30253880df2b69fdaf98232d72ba8d81cfd6872c96080433598e47dd266dcb09e207aa82505d4c9fedf1c0e43a9df2a6086c0bf73e14e7bad9a899c8ca1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51dbc3ece6c9940d969ed02db4900b4f

SHA1
ba56af1995c45909ab6e80190ee8072a277da53a

SHA256
073bcd6a6c25c428a7461e9b970646280906b8596ef22a9768dffc4dca7d0ac4

SHA512
19cdb13c1e440b8af7e71404243e121db4120a79d3d6e78080a641c67a9cdf18fb3ddd924458bb8e75cdb9980ac8573017925f9ba41edd667eb03cfaff4c6b21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ba932acb01c938de10dd43e05c6ac64

SHA1
312deebbcf14b0755d5948d0c279312c8a1e16d0

SHA256
34efb6aaa575047e59f3f0799019f139a1842fb2ebc4027fc4c049d72966dbb2

SHA512
6d1c36934652aa617a72d43335d8e838629102a4313f30283284fcb41dc46fcd20ef3a2901f42f92122f30fb11c753dc555a6987d07a56db2b5b3fcf2322ad88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
efa5f29417733a54a07e066e37f603ac

SHA1
31b4bd09518c4b8fce928071fef667282e3c1fda

SHA256
58d77030d5afcf9bac29b045514cd9a7b220043bcef4473e1f45112c0ea93273

SHA512
1f099856106f34bd10fa5f3ebfed94278e74da38630f0b47636335690b16c32c9bc359d81f2219dd4d78f486c59a6543f184163d7330794cdd3b4ce2189e3d41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1cbba1dfc65a7298b2c8f0cccaf70d73

SHA1
7b305ff4b0bfbf7593800d5a954cbdce2c093487

SHA256
2164816a305520bb8c5c4c5ddc1ab251e24133833f2c67aef06d78b8ef17d153

SHA512
a2d2c6be6495a293131ca274be6f29529d685c66dd0706463c0f640b8c1ee396a47552b3b2c61d4ff901f95cf4e19e64e996118d2009288e128992fc4a7d1b93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff8fdb5827a66d7e80a415092473b690

SHA1
93b3dabde2b7b46d5fbeee88e70498f2e4b56b40

SHA256
85daf36a076c8a4e72eab6605359d18f109467824217e9c09a43d65f2f4f60b4

SHA512
9def888f6ea388f0cc0c13d592f6ada1a280e85372f3cfca797be41f5f13c69cca9128538f080bba3485f7f224cc45b1cfd0ec7af6c187f88ccb49f0d595d620

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6aab43f36dd3ffedfedc22e3ea97dc2

SHA1
7637f2b9af9b7c54c41d92328d0976d57fcbee5a

SHA256
f4261cfd89ff14cdb262569ae8556a6edb7abe4baabea4c3b6d6d3331c2f4c91

SHA512
e421a6a36922938b0bdd412a6a16c1ca982d5aadae52c38297a6d24e27172ad0f003113e59b429a0931c8a0d61713c034f2e64da245610a5ba017cb60013b5e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15fbf097c3aa1c46cf4ed9150e6ff10e

SHA1
cdb9ad7e41ede7731d7b7ac89cced49362478560

SHA256
63b19cbd9168e4b73258bc4da5d11d046450aa497975989f7b1dea64d1fc93ab

SHA512
222ef0f850f6d13c42c64023893276d11cee1a757f3bfbb3fc20333eaeffbbe86aac616d056e33442c870b2f361011e7fd8b708097ad2febe2024deeb4a6ac16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
7bfb81db7c049ff458bc5cdf255e2f8b

SHA1
60e953d0dbdeb77678d205c6849b1fa5310b1ed8

SHA256
e41f841f571ec44d618bb57ffd0e2fbbfc1b7cdb5b2011b0e51a0a8c5edf607f

SHA512
0e2e5f10956f4f90442fb6a229ca57d6ffd3ba60e4025217904a987b122eff378c405851844566e84a32ec3697b5b17839909b3256cf0b965c1dd1b296ccdfc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{F5867531-6361-11EF-838C-C20DC8CB8E9E}.dat

Filesize
5KB

MD5
0971026329732afc5f95ff5a56ee01b3

SHA1
11bad5822b162fcf68d416ae1d4a397b2c115909

SHA256
f0ae123db4617c7c3351f000fe22a1b87f6c83827d753a923f52837e71c9dbc4

SHA512
44ce142a394cd6f5c2d9de853162974bcf03f53fabdb673ae4352e7a8f65578091e1baebe591de1c025673e2faf3d7511f0d201c5de6e884bc7263f373165ae1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6XUZ2JLF\json[1].json

Filesize
311B

MD5
9105750f17d90587cfdb3073e3db4b41

SHA1
68299e57ccb94050710511c9fba7f144af55038d

SHA256
325bea9d40295cd711d613b7dcb0958e04a537f751b177573a9c40303a4879f9

SHA512
07fcd8e2811bc7d8a481694d32a8d220a03ec99dfd8b9f55de99ff8327d392c6afbd821358b5087e29120b5a6d706f258c723585d3c69a26c1b0c385722256de

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD1F2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD2D0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Dunnakin.Xtw

Filesize
3KB

MD5
6b6888981cf28ad6060bf74a6310d40c

SHA1
5eab9777cfcf3be44dd621eb3a7abf482df3e7f3

SHA256
d429f4b6cda0bc7014c10f05cb4d9a520cbabc6b297c4e8cd792b2b5e854d987

SHA512
64c6d6ea608e1c5d0c3a952caf5816a16d31212e1bb9e62b76710b4e9dd751023f3d8c58333c73cf79c7aff0fafb1143290b0666a7e20b798c3e52a563a61655

Download Submit
C:\Users\Admin\AppData\Roaming\Errlog.txt

Filesize
2KB

MD5
1b5c9ac81d0db16bdef65bb8ed4401a1

SHA1
b45a09049cdabcdaa104e284bb457aabf9e02909

SHA256
79f8f465d0ad808a0c2bc0bd79cad80d1f2ec0e92df2a7b9d79d764bb0308535

SHA512
c2d6146fad4289a9f6b502872f102dbe7678bab74f744810845ed80d137620b3ea45b8141f2600cc557df27f3e79523df6ce8bc9fc2947798f2171034149076c

Download Submit
C:\Users\Admin\AppData\Roaming\Fighter4 Flight Path.mesh

Filesize
3KB

MD5
c22dce2c95e3fbc8ac2f569b7fb8474a

SHA1
9e5b1c407424004fa5c0c1d96af96a9b0e10353e

SHA256
423cad4eca8206b5b3ef851278a749e5246042e32759abe6b2026d14ed2ba6d6

SHA512
f516531af2f75cb949ef6fbd2bd18e12aa07f94e2b7cb1398d0b13033f84c91f32ca28dc76c6e8caa8191c7b115a3cf59fddc241bfb3e244ae50247c6eee69f1

Download Submit
C:\Users\Admin\AppData\Roaming\Latency.aS9

Filesize
112KB

MD5
03aff3d71273e40c2cb0b95ffa39278d

SHA1
b9d324a5c304e83b8d24f03a3b8a4a12198ecd92

SHA256
a08a1ee90e5c4a89272981537d830eea08d34621c8949987327f82ddc91652aa

SHA512
490a9f351da6d12f8ead705f09946f62c53d0ecbfc9c62ee14f8e12642d9085fbf7b8b863ff5b7bc2fce8832d241483b2cb72b1171ba29224d64caadee9edea3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\auditpol.lnk

Filesize
1KB

MD5
407b34c27f3732b6ec944de5354b3650

SHA1
22bfd53284a3be713b28f91c8752e15de1cf8638

SHA256
329f831af84142943058101d70ec2de332fbeab61a8d67e9801f393838390744

SHA512
020768a1c811a59659c2784e3abf99d828439c568cc70d54c398a668a902023e0fff04cb6c726ffdb56a16eec929a5c593a0031ea9424472dc5f23f1df9a8a50

Download Submit
C:\Users\Admin\Downloads\# DECRYPT MY FILES #.html

Filesize
19KB

MD5
2fbdb4688ac9f7ac3670c5ef263f0ce2

SHA1
a16627a543e3bed845acda504550d4d753d701f0

SHA256
4bf627a906e16cdbd94a684d740c8eced968158900d718e2ecaec19a50b74eb5

SHA512
560ccdeccb97943657d369f41fcd6ca28cc0c1fd3d16ae074672ebab19d790c1afd0fb9c29b4bfe64fa8d29e1e1cc3936d350226096cca7befe31160f7bbfbe6

Download Submit
C:\Users\Admin\Downloads\# DECRYPT MY FILES #.txt

Filesize
10KB

MD5
7c9aac035b51098231c585894f84325c

SHA1
3254d00c79479f8fe67760cf9ed64da43132beb0

SHA256
cb84bc747216ea460101ec7b690cda0b6351c846e0b1fe25f9680d38d1c628f2

SHA512
466f23818ab9bba4c4525dad4fd01eb4f24f6acf8735eeb8214b6c03c7aada0d423be51bc1e64ed216d25f50eb081481766f5eb8186c4d70aa3aedac97028393

Download Submit
C:\Users\Admin\Downloads\# DECRYPT MY FILES #.url

Filesize
90B

MD5
973612ada94fcf3be2f25cad106268da

SHA1
1b30feb78e724bf51c05903b1d44d554a1b8e243

SHA256
6b79923cb50a8bfede8ebc839904122a0dda7554a0d5b1dbc325fc3158ed0e97

SHA512
686057d4438b38422fa9a9c6599582d3a5ff705ea37faa132d2ac1babe0d4598a9199e0d9a03ac375318e9a07e8cecedfe2b150b6367543e1c28716f756a56dc

Download Submit
C:\Users\Admin\Downloads\# DECRYPT MY FILES #.vbs

Filesize
252B

MD5
18d46f5d8ebd3c7d6df0c7a8fd1bd64d

SHA1
aeb8407457434aabce2a4c2f95fe305c5303f929

SHA256
ceb35b75d397b07c84dfab3a28189e9431bdf80ec99ab65f9ccf01986bd4a8e9

SHA512
35fc759be0dee77eb9e39350873c24d9693cf6f370f171814e2ce6250ea814fea8a0887442ebae9077d6e9ff81ae7034faa0afcb080401a7d4ac384d2ba42d65

Download Submit
\Users\Admin\AppData\Local\Temp\nsdA47A.tmp\System.dll

Filesize
11KB

MD5
6f5257c0b8c0ef4d440f4f4fce85fb1b

SHA1
b6ac111dfb0d1fc75ad09c56bde7830232395785

SHA256
b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1

SHA512
a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8

Download Submit
\Users\Admin\AppData\Roaming\Perl.dll

Filesize
72KB

MD5
9b35870798ea01e8e943091ec7a0bb80

SHA1
66650be447dceabd4ba938ccf1a9663f2eb99a91

SHA256
663aa24d2ef5cc3a0f0b8e8e575643c59a37b4c0fd7d7b2cf5217f14c9eb7309

SHA512
b9f297a2cc255a7aac51ff2b1e45f6985359968bfe88b8e7201f7ecb5b16bfd97323042a29ad87e149c7994d9e16b034ebe1b044bffc6e2a98ebef2997656279

Download Submit
\Users\Admin\AppData\Roaming\{E7F19A57-C953-7B64-1413-296E95479BC0}\auditpol.exe

Filesize
258KB

MD5
c24367dcd19f9d4a3f36fbd3cd1d8c11

SHA1
332541a2416b70cf23fbd02b82bf2c807dbcb3d7

SHA256
3e478bb8de1bbbd2744d7c467220ba0373ce3f636eff55cab6c0c3b27ecd30a1

SHA512
a4a8c48b49910c71619578ad9e58998bd236dffb396d29733c58078b659042f03729989fe4fa537078b6aa33b4025b4711e6f0e55cf3c0996911f70b86791411

Download Submit
memory/1988-43-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1988-13-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1988-20-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1988-26-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1988-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1988-22-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1988-18-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1988-16-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1988-15-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1988-28-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1988-30-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1988-29-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1988-33-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2504-92-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2504-102-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2504-81-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2504-82-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2504-85-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2504-88-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2504-90-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2504-513-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2504-91-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2504-105-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2504-520-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2504-516-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2536-11-0x0000000001DC0000-0x0000000001DD3000-memory.dmp

Filesize
76KB

Download
memory/2772-63-0x0000000000560000-0x0000000000573000-memory.dmp

Filesize
76KB

Download