d62485200a7488c19a480d7bb85a6bc47bbffe1730e999cec9a9fc9b0c72c377

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 08:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de1388a919744ce917e7f0103680fd5e_JaffaCakes118.exe
Size

276KB
MD5

de1388a919744ce917e7f0103680fd5e
SHA1

d6c6d43cd45dd9748937f9450107d38fa7ab5edf
SHA256

d62485200a7488c19a480d7bb85a6bc47bbffe1730e999cec9a9fc9b0c72c377
SHA512

c58952fe9fb596a26cc968a06e82c1a8643415de92652fd468570032bbf37e2171fdff86eb756cc6ade18199bb46fc06effe88d222bfac57279778ce1b5dff6b
SSDEEP

6144:Jn5gKKO3ShaY/ozXgWRscsBTf9ei14BuOvzWOY:15gKbS/oHmTfrMuOvzrY

Score

10^/10

discovery evasion upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 10 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\black.exe = "C:\\Users\\Admin\\AppData\\Roaming\\black.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe

Executes dropped EXE 1 IoCs

pid	Process
4172	svchost.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4172-20-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/4172-25-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/4172-26-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/4172-31-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/4172-34-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/4172-35-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/4172-39-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/4172-43-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/4172-46-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/4172-49-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/4172-52-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/4172-55-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/4172-61-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/4172-64-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/4172-67-0x0000000000400000-0x000000000045C000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1432 set thread context of 4172	1432	de1388a919744ce917e7f0103680fd5e_JaffaCakes118.exe	91

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	de1388a919744ce917e7f0103680fd5e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
3780	reg.exe
4544	reg.exe
2196	reg.exe
4360	reg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: 1	4172	svchost.exe
Token: SeCreateTokenPrivilege	4172	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	4172	svchost.exe
Token: SeLockMemoryPrivilege	4172	svchost.exe
Token: SeIncreaseQuotaPrivilege	4172	svchost.exe
Token: SeMachineAccountPrivilege	4172	svchost.exe
Token: SeTcbPrivilege	4172	svchost.exe
Token: SeSecurityPrivilege	4172	svchost.exe
Token: SeTakeOwnershipPrivilege	4172	svchost.exe
Token: SeLoadDriverPrivilege	4172	svchost.exe
Token: SeSystemProfilePrivilege	4172	svchost.exe
Token: SeSystemtimePrivilege	4172	svchost.exe
Token: SeProfSingleProcessPrivilege	4172	svchost.exe
Token: SeIncBasePriorityPrivilege	4172	svchost.exe
Token: SeCreatePagefilePrivilege	4172	svchost.exe
Token: SeCreatePermanentPrivilege	4172	svchost.exe
Token: SeBackupPrivilege	4172	svchost.exe
Token: SeRestorePrivilege	4172	svchost.exe
Token: SeShutdownPrivilege	4172	svchost.exe
Token: SeDebugPrivilege	4172	svchost.exe
Token: SeAuditPrivilege	4172	svchost.exe
Token: SeSystemEnvironmentPrivilege	4172	svchost.exe
Token: SeChangeNotifyPrivilege	4172	svchost.exe
Token: SeRemoteShutdownPrivilege	4172	svchost.exe
Token: SeUndockPrivilege	4172	svchost.exe
Token: SeSyncAgentPrivilege	4172	svchost.exe
Token: SeEnableDelegationPrivilege	4172	svchost.exe
Token: SeManageVolumePrivilege	4172	svchost.exe
Token: SeImpersonatePrivilege	4172	svchost.exe
Token: SeCreateGlobalPrivilege	4172	svchost.exe
Token: 31	4172	svchost.exe
Token: 32	4172	svchost.exe
Token: 33	4172	svchost.exe
Token: 34	4172	svchost.exe
Token: 35	4172	svchost.exe
Token: SeDebugPrivilege	4172	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4172	svchost.exe
4172	svchost.exe
4172	svchost.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 1272	1432	de1388a919744ce917e7f0103680fd5e_JaffaCakes118.exe	87
PID 1432 wrote to memory of 1272	1432	de1388a919744ce917e7f0103680fd5e_JaffaCakes118.exe	87
PID 1432 wrote to memory of 1272	1432	de1388a919744ce917e7f0103680fd5e_JaffaCakes118.exe	87
PID 1272 wrote to memory of 4148	1272	csc.exe	90
PID 1272 wrote to memory of 4148	1272	csc.exe	90
PID 1272 wrote to memory of 4148	1272	csc.exe	90
PID 1432 wrote to memory of 4172	1432	de1388a919744ce917e7f0103680fd5e_JaffaCakes118.exe	91
PID 1432 wrote to memory of 4172	1432	de1388a919744ce917e7f0103680fd5e_JaffaCakes118.exe	91
PID 1432 wrote to memory of 4172	1432	de1388a919744ce917e7f0103680fd5e_JaffaCakes118.exe	91
PID 1432 wrote to memory of 4172	1432	de1388a919744ce917e7f0103680fd5e_JaffaCakes118.exe	91
PID 1432 wrote to memory of 4172	1432	de1388a919744ce917e7f0103680fd5e_JaffaCakes118.exe	91
PID 1432 wrote to memory of 4172	1432	de1388a919744ce917e7f0103680fd5e_JaffaCakes118.exe	91
PID 1432 wrote to memory of 4172	1432	de1388a919744ce917e7f0103680fd5e_JaffaCakes118.exe	91
PID 1432 wrote to memory of 4172	1432	de1388a919744ce917e7f0103680fd5e_JaffaCakes118.exe	91
PID 4172 wrote to memory of 4816	4172	svchost.exe	92
PID 4172 wrote to memory of 4816	4172	svchost.exe	92
PID 4172 wrote to memory of 4816	4172	svchost.exe	92
PID 4172 wrote to memory of 452	4172	svchost.exe	93
PID 4172 wrote to memory of 452	4172	svchost.exe	93
PID 4172 wrote to memory of 452	4172	svchost.exe	93
PID 4172 wrote to memory of 2456	4172	svchost.exe	94
PID 4172 wrote to memory of 2456	4172	svchost.exe	94
PID 4172 wrote to memory of 2456	4172	svchost.exe	94
PID 4172 wrote to memory of 820	4172	svchost.exe	95
PID 4172 wrote to memory of 820	4172	svchost.exe	95
PID 4172 wrote to memory of 820	4172	svchost.exe	95
PID 452 wrote to memory of 3780	452	cmd.exe	100
PID 452 wrote to memory of 3780	452	cmd.exe	100
PID 452 wrote to memory of 3780	452	cmd.exe	100
PID 2456 wrote to memory of 4544	2456	cmd.exe	101
PID 2456 wrote to memory of 4544	2456	cmd.exe	101
PID 2456 wrote to memory of 4544	2456	cmd.exe	101
PID 4816 wrote to memory of 2196	4816	cmd.exe	102
PID 4816 wrote to memory of 2196	4816	cmd.exe	102
PID 4816 wrote to memory of 2196	4816	cmd.exe	102
PID 820 wrote to memory of 4360	820	cmd.exe	103
PID 820 wrote to memory of 4360	820	cmd.exe	103
PID 820 wrote to memory of 4360	820	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\de1388a919744ce917e7f0103680fd5e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\de1388a919744ce917e7f0103680fd5e_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aadziyvz.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES69F6.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC69F5.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4148
- C:\Users\Admin\AppData\Roaming\svchost.exe
  C:\Users\Admin\AppData\Roaming\svchost.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4816
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2196
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:452
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3780
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2456
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4544
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\black.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\black.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:820
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\black.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\black.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES69F6.tmp

Filesize
1KB

MD5
9c9be747cb6bd3b79b19253a8ddf4d95

SHA1
f820155e102b45f2a02e88b4d8c1669891466c7c

SHA256
09d1378a8c0222988f63a069072af5ffa4a4a468dc74cd61794ec6ecf12acebe

SHA512
02be1f885174c76b627e2f6ff334c42dccb32f0eb1062682d926673bee7525903491fed343c9edd81793d4c0f63d3f806ca42223c03697e866601438cbd12fb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\aadziyvz.dll

Filesize
5KB

MD5
c8cc6523eac4c791562dc58e04143a03

SHA1
1e4f1d253f69108e6310050b5215704d5b1c2e09

SHA256
78a568597d25962916ad2210a1b71a273a63a3df25dbb68319425d2adbe57b78

SHA512
ebd80b1cddd60e30dc4c87a1106b3517f2560aecf44cc0e30755ef538761b8c4781e7a82d50f3cab2b9804964ac5496a671433933a23da9aa004aee96042202f

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
12KB

MD5
bb5b2961567e68995464801d3bb2a964

SHA1
5d82ae2b8d24208418bfb09cbb3074c056e790dc

SHA256
a2d3d892c68a84208a9887cb34ecae820e59c4aa25c22db5c23379df344df004

SHA512
050550640a7bf2b65b3cd537f252b64465ec451555ff1831a9d799922e8c3382e83a52bc46015c5ed1ac79ebb233616f72aa8ed72f01e8be578ca383a304ff7a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC69F5.tmp

Filesize
652B

MD5
1465e8b43f210620d8ade0189f4617d8

SHA1
3889726fe1e15246e007bedbe2d3a2fcf1a3e307

SHA256
179c37882f192a786f5c66b5085e304d6544449707c8f3ecfbec497cd47ff404

SHA512
f2608492555f01e17825f83a94da29b3550411f912047ca4705a2b7c6d9369e2523f8bc0ece35b451cc7fafc589181b0edc251775596724a774ec4e8938d0f16

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\aadziyvz.0.cs

Filesize
4KB

MD5
2216d197bc442e875016eba15c07a937

SHA1
37528e21ea3271b85d276c6bd003e6c60c81545d

SHA256
2e9e3da7bfa1334706550bb4d6269bf3e64cbbc09fa349af52eb22f32aebb4af

SHA512
7d7bdc3bf83ac0a29e917ead899dcaa1b47ee2660f405fe4883ca2a2546f7924265e1d75a2ea02c0e34fac4d2bb82bbaaa88d06c240afad4e9fd49337cd04d3f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\aadziyvz.cmdline

Filesize
206B

MD5
d9f4a156876f2ede0b32811fd7dda37d

SHA1
9f37e59e4bfc060d6ece87d00bfa0932ec107fe3

SHA256
da4e327745a28900dff2a9459538d93c41816389783799fe4bc3cbfddb5fb862

SHA512
fa7da19a08a281e07091d05e92f8025afe77416c265adfe6a928634146164aca846d2f467f6c325730a33942bfbe7cd291a8b9a7d5faffe4c5e02be6fa27b1bf

Download Submit
memory/1272-11-0x0000000074FF0000-0x00000000755A1000-memory.dmp

Filesize
5.7MB

Download
memory/1272-16-0x0000000074FF0000-0x00000000755A1000-memory.dmp

Filesize
5.7MB

Download
memory/1432-0-0x0000000074FF2000-0x0000000074FF3000-memory.dmp

Filesize
4KB

Download
memory/1432-1-0x0000000074FF0000-0x00000000755A1000-memory.dmp

Filesize
5.7MB

Download
memory/1432-2-0x0000000074FF0000-0x00000000755A1000-memory.dmp

Filesize
5.7MB

Download
memory/1432-28-0x0000000074FF0000-0x00000000755A1000-memory.dmp

Filesize
5.7MB

Download
memory/4172-25-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4172-43-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4172-20-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4172-31-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4172-34-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4172-35-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4172-39-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4172-26-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4172-46-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4172-49-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4172-52-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4172-55-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4172-61-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4172-64-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4172-67-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads