d5f1e7b37d09e4b2e00bfb42eb15000455e8f9e2edcbe5bc37836e58613887a7

Analysis

max time kernel
118s
max time network
136s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 03:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0f2357e4fa18f649e3c5cbf2172e02f_JaffaCakes118.exe
Size

52KB
MD5

d0f2357e4fa18f649e3c5cbf2172e02f
SHA1

8d4686b7ca35a4fb1f30a4afa76036481606e22c
SHA256

d5f1e7b37d09e4b2e00bfb42eb15000455e8f9e2edcbe5bc37836e58613887a7
SHA512

0bd627f26ea8a9f61a17cc759faa1d0f9dfcf678265aaaae30b641c284966d43269b65eb40c88502f81becd1c9d5eb7ffac7ea027b72a850456517bc6da8e428
SSDEEP

768:Q6MDEOgk6guQrhO23k7/9sppE0iKFz89519yFSUKhJJ16c5QSkq6O1v8eYanFnF:gExDPQ9l3ky88x8vTJJ16mQ3Zq8FG1F

Score

10^/10

discovery evasion

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	d0f2357e4fa18f649e3c5cbf2172e02f_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\taoY.ico	d0f2357e4fa18f649e3c5cbf2172e02f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\popwen.vbs	d0f2357e4fa18f649e3c5cbf2172e02f_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Messenger\Messenger.kvh	d0f2357e4fa18f649e3c5cbf2172e02f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0f2357e4fa18f649e3c5cbf2172e02f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000006accc68092627302a619c5c4851fb4e31a813d42e056d750920e044d343bfa19000000000e8000000002000020000000e21c6c5a34fcc455c36840b440dd0579fdff5570888b41be810388691905c273200000002ed9b0136bc99a038492d4817c9b6af0a18efd3b3876cb5586cfd2a765a41477400000007a18f2c5d2a83ec9909fec5a963f2b3599c42a4f70e748a659281cafb933c35a9e85ecaa110bdb6302b257e2dc065086fb0b9fbba5c6980a2c12a9184a5f5947	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{23F93611-6CC6-11EF-9D33-D6FE44FD4752} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 106b96fcd200db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000e6267560db732ab2612831695ffd24a67cc8cd5d709d9b6c47352915cd8164cb000000000e8000000002000020000000c631ff360ff1c716a734596f13f0ee26c6a80c687a62ccb2e1533c11f08a23269000000023a04ad014fca7d9b023e9c15303bbae1b8c86c4cd98061b2a5a2e90a6772e1eba04122caaa1ca820caaf47338a3802a30d7642fae59dd3b6936c76ee33ff171110a34a87d3f72c99a2ba262792a32979b6188d283044fbbe27a79e38a89c331432be71cbc38d101eab34aa23579c8b5e2e40aec45d9db5ed26f34255fc612e1a3fab3770e3dca89590719ac426ce3e7400000003de1591c5d0b8f1e8e698817e3064830508c3822c2be23820cddfb6265518a8dbaa84eb2f49d329ee94f549f842f99d094bab06a44364862a68a15a87a72d79b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431840250"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.kvh	d0f2357e4fa18f649e3c5cbf2172e02f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.kvh\ = "JSEFile"	d0f2357e4fa18f649e3c5cbf2172e02f_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2844	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2844	iexplore.exe
2844	iexplore.exe
2588	IEXPLORE.EXE
2588	IEXPLORE.EXE
2588	IEXPLORE.EXE
2588	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2656	2364	d0f2357e4fa18f649e3c5cbf2172e02f_JaffaCakes118.exe	30
PID 2364 wrote to memory of 2656	2364	d0f2357e4fa18f649e3c5cbf2172e02f_JaffaCakes118.exe	30
PID 2364 wrote to memory of 2656	2364	d0f2357e4fa18f649e3c5cbf2172e02f_JaffaCakes118.exe	30
PID 2364 wrote to memory of 2656	2364	d0f2357e4fa18f649e3c5cbf2172e02f_JaffaCakes118.exe	30
PID 2364 wrote to memory of 2656	2364	d0f2357e4fa18f649e3c5cbf2172e02f_JaffaCakes118.exe	30
PID 2364 wrote to memory of 2656	2364	d0f2357e4fa18f649e3c5cbf2172e02f_JaffaCakes118.exe	30
PID 2364 wrote to memory of 2656	2364	d0f2357e4fa18f649e3c5cbf2172e02f_JaffaCakes118.exe	30
PID 2364 wrote to memory of 2680	2364	d0f2357e4fa18f649e3c5cbf2172e02f_JaffaCakes118.exe	31
PID 2364 wrote to memory of 2680	2364	d0f2357e4fa18f649e3c5cbf2172e02f_JaffaCakes118.exe	31
PID 2364 wrote to memory of 2680	2364	d0f2357e4fa18f649e3c5cbf2172e02f_JaffaCakes118.exe	31
PID 2364 wrote to memory of 2680	2364	d0f2357e4fa18f649e3c5cbf2172e02f_JaffaCakes118.exe	31
PID 2364 wrote to memory of 2680	2364	d0f2357e4fa18f649e3c5cbf2172e02f_JaffaCakes118.exe	31
PID 2364 wrote to memory of 2680	2364	d0f2357e4fa18f649e3c5cbf2172e02f_JaffaCakes118.exe	31
PID 2364 wrote to memory of 2680	2364	d0f2357e4fa18f649e3c5cbf2172e02f_JaffaCakes118.exe	31
PID 2680 wrote to memory of 2844	2680	wscript.exe	32
PID 2680 wrote to memory of 2844	2680	wscript.exe	32
PID 2680 wrote to memory of 2844	2680	wscript.exe	32
PID 2680 wrote to memory of 2844	2680	wscript.exe	32
PID 2844 wrote to memory of 2588	2844	iexplore.exe	33
PID 2844 wrote to memory of 2588	2844	iexplore.exe	33
PID 2844 wrote to memory of 2588	2844	iexplore.exe	33
PID 2844 wrote to memory of 2588	2844	iexplore.exe	33
PID 2844 wrote to memory of 2588	2844	iexplore.exe	33
PID 2844 wrote to memory of 2588	2844	iexplore.exe	33
PID 2844 wrote to memory of 2588	2844	iexplore.exe	33

C:\Users\Admin\AppData\Local\Temp\d0f2357e4fa18f649e3c5cbf2172e02f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d0f2357e4fa18f649e3c5cbf2172e02f_JaffaCakes118.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\system32\wscript.exe" "C:\Program Files (x86)\Messenger\messenger.kvh"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2656
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\system32\wscript.exe" "C:\Windows\system32\popwen.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://www.95081.net/tan.htm
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2844
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Messenger\messenger.kvh

Filesize
9KB

MD5
f6f0362d52bdd28f4facceb819c09f84

SHA1
c99ad0e83984d2d2343f55a064dfd82b166b0ce1

SHA256
831f7023f584b2f4325e2a42c141197bf343babb6612758ebe8b846d8eb589d4

SHA512
f418b1978707b0268d0496359c60c0c884ba75a200fa9ed57745cfea966d37146e791827657c3baf9d8c7a8098a98ae207e9679593113b2dedeb3ad66ffeb1f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b60017403be269e2423e3c21891d7a3a

SHA1
6746db25513e2bd8d6267e6d0ab4d458f3d4f356

SHA256
df3b6e9886f6bc263cfc73386c5615ec615c746ccf6dc979c8748ff2256083aa

SHA512
2380e9faec776b32a0bb16c411d3827f7d69af37c57e4d6156a0aa386aa1426fae054cad66f4cad19f19e3a4b9d034485faa1d4501ae47d8ad71df245ce31c50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a00657f9a652568274c3a2a78a5fb00

SHA1
1aeb2b1c7c023fca93f17d549e738c2a7b1a0f84

SHA256
a5ed5eb06a703f016d46d5812e38079f863679ff5c7fd898e621e0f7bbeb0f76

SHA512
95f9d1275490d63f41302171a3d91f7ac0dec9ab19f3cf02ba42baf099aad07b6f97332a29b131e5ecf2840a6df64107b60403ab15ab43b1c4d105495faf40d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64a478bbc49e2a13f861d0bd9eba1f7e

SHA1
240e7e58f8d9c0f6dbf41c0c8036e490d0bec8e7

SHA256
0c514d07b7d0e853875d1ba996237ac01deaea8624527c349279d7410944b1d8

SHA512
a9e6918477a5deae1ccad7bcdbbb30bbae227cf20a5ce14e718be5c6b71775334ad81673aebcd3bae7542b7c876794590910e7585ee7d14efb58173091d1d2b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfa2a135f4858668788996cb44735096

SHA1
47974da11b1bbca3b6c1225d78990b59665ada41

SHA256
10a5360e021be28826266f89ee0563702c867b50cb57290f6028c543772ed843

SHA512
5a99943372f52c607813e3bcd16e273f612134f0ea1366ac7e361ad180ed8e29ee0a560907f005fdad3716d4b031bf0dd5f3163853e0ba43efcbcc4cb0005aba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19feb2ab121de2437f2b8d62f21979ac

SHA1
feb8174f17c8904e646196e3a41b33bd8f3827b9

SHA256
146f72ab950e75c3dcdf879d8603bc1cdc2109371621a96aeb007f58fbffa562

SHA512
cbb76a9ae955206fcc6e7cb5c7c965119bed55266e84608a93e01bba7f611d0dbeb0cc2b66f19e168bb3a001be803a64f583b877078780311a4a8b1c436c740d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d4c07051f3cb202fe1fa95c34ecb5ce

SHA1
af4aed78df7b051f67e79ead1d6ea1950eb3747d

SHA256
333d18f169d5598f2d588aff9525baed940cbbbdc2eb22d103b5a503c6ca8a6b

SHA512
728f73bbfbbab84ad1f2fd73f7ecc60a053f40cb31a9665ee73d633159a4be06692a27dcf34987dc01eb2a024b84d0bb253d9d8dd010a89a9be6acae65afba60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4eaafaa202eb9ac0550e94d112cd909b

SHA1
38090ee8dd2ce1a0fc05ca89959b1a63c50a9707

SHA256
fe29cd2739a3d94bee0ce57b003051f452f7f29665dd55f74f98d66763c99339

SHA512
94bfd04ff032aa72f9904b862883c13d9e64535a59b342cf94845bd1887889277b32e21e35084f708be51c575dfd0d0ce1c066f4545f652b68a2ac9497ce4746

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8a64abec19bb7811c2ff095c965a78a

SHA1
21167f9572e87ac2d9d4be1f6e2f4eb8d2512ddb

SHA256
959e432d873345fb44fecb7223fbdc1d75123553a84eca547a0b6c55737b76b1

SHA512
83d5c30b6a4a56278cf053bca8ee1c19465f29cf0c90d8fc9faf30f0d47629ba05a821cd7568623599ec8d3f0c6642938770f220797434770c8c557858f6f870

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc189e3240da24ec65a7d91c9b9d6978

SHA1
45be526906b83fca9a1c8ce3c801debb54ea4ef7

SHA256
609a7d051c05d1e7c9e34a34979fa15140580024037ff0271b446a8744d93f66

SHA512
4069fa4a724101991ec3069e7dc8d8c5acc54be52b395214353f86a900334ed71977940b43c2524a6c610b7d86fdc18402b13fd83b4348bd0916d5957fcc6bc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63dac92d0f8e0748464befd6fc00136b

SHA1
48133847621f9d0550d9d806bdeae18be0286495

SHA256
8633e6c89d5baba49bad0117baaebdb51eac464d207790800a4d2ae7a944918e

SHA512
2eefc106b25f5f5f92eef311cb367bdddf099f685310bc0197d5a8dc0d9af769b4f52afedfbaac4b6391384ace88ebe666ff6f3b1680c0a292a944c5e7f837b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95ccb02823ad10ca39651f97cf13e046

SHA1
7a0c524ab0fe48f87ac8702d9aff7dc1936db261

SHA256
43d0de6437294cb17e6ed317c84720e01fb6b6d7d8e37a6c8da0377b388a3a37

SHA512
e74d4fbe273be5fcd7b6b9ab94cad530bab4b62bec9bd9d7187cd9806afb3127a81c34190d9534a6dce7ec941e349acc6d0f4bdc7f88ee44c46db764b839e601

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4534f46ca0b23493988054a4a8558e3d

SHA1
5f42b1a7aa85e9745bad3721872ab0a1ec22e220

SHA256
7f255ef30e23fb62f637b34cd0ea9b9b69842e6ecfd0ce659c416e8b36fb7af4

SHA512
c7abb5904bf73d8efa85e738b4269ca04d98f386061da9890e9e02ccd1b570f0ded4a213d07485017bb89324923885c2725c957e0837d90eb2f6bd77662406be

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFF28.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar267.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\SysWOW64\popwen.vbs

Filesize
218B

MD5
6938ddef8c3a70aa95a1f01c69f45ba4

SHA1
36cb5f5bea112e983587d0ddf5f7aaf3be3b4f4c

SHA256
bc677ccea9a040710ed88ed3fcefadd73a931ec6750d7366a330329f95f95c46

SHA512
0cac9e72295d2a23965f9c18b5ddd948df205e7babd704c77ce3b60bef6cecee5c1e3d5f76de00abc9ca029e58a493421c3e31f18f8d71d59c770e3e90c0b725

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads