Analysis
-
max time kernel
76s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 06:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
25 signatures
150 seconds
General
-
Target
eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe
-
Size
323KB
-
MD5
eacc501779cdc2fda21e317648e08d0f
-
SHA1
d71ca3f7056b48cfa2492861f233e1f3bd507501
-
SHA256
16f7966200b4ba1364535b144ac53144f4f0e6cba24529a234b6c22f65fbc485
-
SHA512
b221044d1e68270b671e6844d7693a3e18af494d9cd6517c5c22dfbf78fb839a6a16b054bdf158b50e36a833cd05c125a270f0aaf970b98dd0e2b151d0e5748b
-
SSDEEP
6144:OBxeN/Tdx8YzL+4eBDgelLBL9C53TV5n+yNXavM:OBxe9dx8Yz6nhtL9C53TV5n+4av
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" GoldenGhost.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Kantuk.exe Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 4K51K4.exe Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" K0L4B0R451.exe Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" GoldenGhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" winlogon.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" winlogon.exe -
Disables RegEdit via registry modification 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Kantuk.exe Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 4K51K4.exe Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" GoldenGhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" GoldenGhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Kantuk.exe Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" K0L4B0R451.exe -
Disables Task Manager via registry modification
-
Disables cmd.exe use via registry modification 12 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" Kantuk.exe Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" 4K51K4.exe Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" K0L4B0R451.exe Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" GoldenGhost.exe -
Disables use of System Restore points 1 TTPs
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcoas.exe\Debugger = "cmd.exe /c del" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe\Debugger = "cmd.exe /c del" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avguard.exe\Debugger = "cmd.exe /c del" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CClaw.exe eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansav.exe\Debugger = "cmd.exe /c del" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV.exe\Debugger = "cmd.exe /c del" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcoas.exe 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CClaw.exe\Debugger = "cmd.exe /c del" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zanda.exe\Debugger = "cmd.exe /c del" GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansav.exe GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV.exe eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nip.exe Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Niu.exe\Debugger = "cmd.exe /c del" Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe\Debugger = "cmd.exe /c del" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avgw.exe\Debugger = "cmd.exe /c del" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe\Debugger = "cmd.exe /c del" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvccf.exe\Debugger = "cmd.exe /c del" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe\Debugger = "cmd.exe /c del" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe\Debugger = "cmd.exe /c del" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe\Debugger = "cmd.exe /c del" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup32.exe GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nip.exe eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nip.exe\Debugger = "cmd.exe /c del" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvccf.exe eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe\Debugger = "cmd.exe /c del" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe\Debugger = "cmd.exe /c del" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Niu.exe\Debugger = "cmd.exe /c del" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nip.exe GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Niu.exe Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CClaw.exe\Debugger = "cmd.exe /c del" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Niu.exe\Debugger = "cmd.exe /c del" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe\Debugger = "cmd.exe /c del" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avguard.exe\Debugger = "cmd.exe /c del" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvccf.exe\Debugger = "cmd.exe /c del" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup32.exe K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avguard.exe K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV.exe 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansav.exe 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Niu.exe K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avguard.exe\Debugger = "cmd.exe /c del" GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup32.exe eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansav.exe\Debugger = "cmd.exe /c del" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nipsvc.exe\Debugger = "cmd.exe /c del" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CClaw.exe K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-SE.exe\Debugger = "cmd.exe /c del" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe\Debugger = "cmd.exe /c del" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zanda.exe Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zanda.exe\Debugger = "cmd.exe /c del" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avgw.exe Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe\Debugger = "cmd.exe /c del" 4K51K4.exe -
Executes dropped EXE 10 IoCs
pid Process 4224 winlogon.exe 3916 winlogon.exe 548 Kantuk.exe 3628 4K51K4.exe 4564 K0L4B0R451.exe 4780 GoldenGhost.exe 800 Kantuk.exe 928 4K51K4.exe 1396 K0L4B0R451.exe 4328 GoldenGhost.exe -
Modifies system executable filetype association 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" Kantuk.exe -
Adds Run key to start application 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" K0L4B0R451.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" Kantuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" Kantuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" 4K51K4.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" GoldenGhost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" 4K51K4.exe -
Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: Kantuk.exe File opened (read-only) \??\U: Kantuk.exe File opened (read-only) \??\O: K0L4B0R451.exe File opened (read-only) \??\R: K0L4B0R451.exe File opened (read-only) \??\U: K0L4B0R451.exe File opened (read-only) \??\X: K0L4B0R451.exe File opened (read-only) \??\Z: K0L4B0R451.exe File opened (read-only) \??\E: Kantuk.exe File opened (read-only) \??\O: Kantuk.exe File opened (read-only) \??\K: Kantuk.exe File opened (read-only) \??\L: Kantuk.exe File opened (read-only) \??\B: K0L4B0R451.exe File opened (read-only) \??\S: K0L4B0R451.exe File opened (read-only) \??\T: K0L4B0R451.exe File opened (read-only) \??\W: K0L4B0R451.exe File opened (read-only) \??\E: K0L4B0R451.exe File opened (read-only) \??\G: K0L4B0R451.exe File opened (read-only) \??\J: K0L4B0R451.exe File opened (read-only) \??\N: K0L4B0R451.exe File opened (read-only) \??\V: K0L4B0R451.exe File opened (read-only) \??\G: Kantuk.exe File opened (read-only) \??\Q: Kantuk.exe File opened (read-only) \??\S: Kantuk.exe File opened (read-only) \??\W: Kantuk.exe File opened (read-only) \??\I: K0L4B0R451.exe File opened (read-only) \??\M: K0L4B0R451.exe File opened (read-only) \??\Y: K0L4B0R451.exe File opened (read-only) \??\I: Kantuk.exe File opened (read-only) \??\P: Kantuk.exe File opened (read-only) \??\X: Kantuk.exe File opened (read-only) \??\Y: Kantuk.exe File opened (read-only) \??\Z: Kantuk.exe File opened (read-only) \??\K: K0L4B0R451.exe File opened (read-only) \??\Q: K0L4B0R451.exe File opened (read-only) \??\M: Kantuk.exe File opened (read-only) \??\R: Kantuk.exe File opened (read-only) \??\V: Kantuk.exe File opened (read-only) \??\H: K0L4B0R451.exe File opened (read-only) \??\L: K0L4B0R451.exe File opened (read-only) \??\P: K0L4B0R451.exe File opened (read-only) \??\H: Kantuk.exe File opened (read-only) \??\J: Kantuk.exe File opened (read-only) \??\N: Kantuk.exe File opened (read-only) \??\T: Kantuk.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf Kantuk.exe File created C:\autorun.inf Kantuk.exe -
Drops file in System32 directory 47 IoCs
description ioc Process File created C:\Windows\SysWOW64\Kantuk.exe eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe File created C:\Windows\SysWOW64\Shell32.com eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe File created C:\Windows\SysWOW64\Folder.ico eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Windows_3D.scr eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\K0L4B0R451.exe eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\4K51K4.exe eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\K0L4B0R451.exe.tmp eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Kantuk.exe.tmp winlogon.exe File created C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\JPG.ico winlogon.exe File created C:\Windows\SysWOW64\Folder.ico winlogon.exe File created C:\Windows\SysWOW64\Player.ico winlogon.exe File created C:\Windows\SysWOW64\Asli.ico eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\GoldenGhost.exe.tmp winlogon.exe File opened for modification C:\Windows\SysWOW64\Shell32.com.tmp winlogon.exe File opened for modification C:\Windows\SysWOW64\K0L4B0R451.exe.tmp winlogon.exe File opened for modification C:\Windows\SysWOW64\Windows_3D.scr winlogon.exe File opened for modification C:\Windows\SysWOW64\Shell32.com eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe File created C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\4K51K4.exe.tmp eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\GoldenGhost.exe.tmp eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\K0L4B0R451.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\Kantuk.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\4K51K4.exe.tmp winlogon.exe File created C:\Windows\SysWOW64\Word.ico winlogon.exe File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~ eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\GoldenGhost.exe eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe File created C:\Windows\SysWOW64\4K51K4.exe eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Kantuk.exe.tmp eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Shell32.com.tmp eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe File created C:\Windows\SysWOW64\Rar.ico eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe File created C:\Windows\SysWOW64\Rar.ico winlogon.exe File created C:\Windows\SysWOW64\Asli.ico winlogon.exe File opened for modification C:\Windows\SysWOW64\Kantuk.exe eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe File created C:\Windows\SysWOW64\K0L4B0R451.exe eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe.tmp eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~ winlogon.exe File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\4K51K4.exe winlogon.exe File created C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe.tmp winlogon.exe File created C:\Windows\SysWOW64\GoldenGhost.exe eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe File created C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\JPG.ico eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe File created C:\Windows\SysWOW64\Word.ico eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe File created C:\Windows\SysWOW64\Player.ico eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\GoldenGhost.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\Shell32.com winlogon.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\K0L4B0R451.jpg" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\K0L4B0R451.jpg eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kantuk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoldenGhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language K0L4B0R451.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoldenGhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4K51K4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language K0L4B0R451.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kantuk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4K51K4.exe -
Modifies Control Panel 45 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\s2359 = "K0L4B0R451" K0L4B0R451.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\ GoldenGhost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\ 4K51K4.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" K0L4B0R451.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\s1159 = "K0L4B0R451" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\s2359 = "K0L4B0R451" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" 4K51K4.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" GoldenGhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" GoldenGhost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\s1159 = "K0L4B0R451" Kantuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" 4K51K4.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" 4K51K4.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\s1159 = "K0L4B0R451" 4K51K4.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\ K0L4B0R451.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\TileWallpaper = "0" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\ winlogon.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\ Kantuk.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\ K0L4B0R451.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\ eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\s2359 = "K0L4B0R451" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\s2359 = "K0L4B0R451" Kantuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\s2359 = "K0L4B0R451" 4K51K4.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\s1159 = "K0L4B0R451" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" Kantuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" Kantuk.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\ 4K51K4.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" K0L4B0R451.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\ GoldenGhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\ winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" Kantuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\s1159 = "K0L4B0R451" K0L4B0R451.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\WallpaperStyle = "0" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" winlogon.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\ Kantuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" K0L4B0R451.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" GoldenGhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\s1159 = "K0L4B0R451" GoldenGhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\s2359 = "K0L4B0R451" GoldenGhost.exe Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\ eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Install\command\ = "logoff.exe" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Edit\Command\ = "logoff.exe" 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "logoff.exe" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "K0L4B0R451 File" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Install\command\ = "logoff.exe" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "logoff.exe" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\NeverShowExt = "1" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "logoff.exe" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\Shell\Edit\Command winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\shell\Install\command K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\shell\Install\command eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\shell\Install\command Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\Install\command\ = "logoff.exe" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\Install\command 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\Shell eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Edit\Command\ = "logoff.exe" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\Install\command\ = "logoff.exe" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Edit\Command\ = "logoff.exe" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "K0L4B0R451 File" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\Install\command\ = "logoff.exe" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "K0L4B0R451 File" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\edit\command\ = "logoff.exe" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "logoff.exe" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\shell\Install\command GoldenGhost.exe -
Suspicious behavior: GetForegroundWindowSpam 4 IoCs
pid Process 3628 4K51K4.exe 4780 GoldenGhost.exe 548 Kantuk.exe 4564 K0L4B0R451.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 3348 eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe 4224 winlogon.exe 3916 winlogon.exe 548 Kantuk.exe 3628 4K51K4.exe 4564 K0L4B0R451.exe 4780 GoldenGhost.exe 800 Kantuk.exe 928 4K51K4.exe 1396 K0L4B0R451.exe 4328 GoldenGhost.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 3348 wrote to memory of 4224 3348 eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe 83 PID 3348 wrote to memory of 4224 3348 eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe 83 PID 3348 wrote to memory of 4224 3348 eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe 83 PID 4224 wrote to memory of 3916 4224 winlogon.exe 84 PID 4224 wrote to memory of 3916 4224 winlogon.exe 84 PID 4224 wrote to memory of 3916 4224 winlogon.exe 84 PID 4224 wrote to memory of 548 4224 winlogon.exe 85 PID 4224 wrote to memory of 548 4224 winlogon.exe 85 PID 4224 wrote to memory of 548 4224 winlogon.exe 85 PID 4224 wrote to memory of 3628 4224 winlogon.exe 86 PID 4224 wrote to memory of 3628 4224 winlogon.exe 86 PID 4224 wrote to memory of 3628 4224 winlogon.exe 86 PID 4224 wrote to memory of 4564 4224 winlogon.exe 87 PID 4224 wrote to memory of 4564 4224 winlogon.exe 87 PID 4224 wrote to memory of 4564 4224 winlogon.exe 87 PID 4224 wrote to memory of 4780 4224 winlogon.exe 88 PID 4224 wrote to memory of 4780 4224 winlogon.exe 88 PID 4224 wrote to memory of 4780 4224 winlogon.exe 88 PID 3348 wrote to memory of 800 3348 eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe 89 PID 3348 wrote to memory of 800 3348 eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe 89 PID 3348 wrote to memory of 800 3348 eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe 89 PID 3348 wrote to memory of 928 3348 eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe 90 PID 3348 wrote to memory of 928 3348 eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe 90 PID 3348 wrote to memory of 928 3348 eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe 90 PID 3348 wrote to memory of 1396 3348 eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe 91 PID 3348 wrote to memory of 1396 3348 eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe 91 PID 3348 wrote to memory of 1396 3348 eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe 91 PID 3348 wrote to memory of 4328 3348 eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe 92 PID 3348 wrote to memory of 4328 3348 eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe 92 PID 3348 wrote to memory of 4328 3348 eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe 92 -
System policy modification 1 TTPs 48 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" GoldenGhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eacc501779cdc2fda21e317648e08d0f_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3348 -
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\system32\~A~m~B~u~R~a~D~u~L~\winlogon.exe2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4224 -
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\system32\~A~m~B~u~R~a~D~u~L~\winlogon.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3916
-
-
C:\Windows\SysWOW64\Kantuk.exeC:\Windows\system32\Kantuk.exe3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:548
-
-
C:\Windows\SysWOW64\4K51K4.exeC:\Windows\system32\4K51K4.exe3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3628
-
-
C:\Windows\SysWOW64\K0L4B0R451.exeC:\Windows\system32\K0L4B0R451.exe3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4564
-
-
C:\Windows\SysWOW64\GoldenGhost.exeC:\Windows\system32\GoldenGhost.exe3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4780
-
-
-
C:\Windows\SysWOW64\Kantuk.exeC:\Windows\system32\Kantuk.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:800
-
-
C:\Windows\SysWOW64\4K51K4.exeC:\Windows\system32\4K51K4.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:928
-
-
C:\Windows\SysWOW64\K0L4B0R451.exeC:\Windows\system32\K0L4B0R451.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1396
-
-
C:\Windows\SysWOW64\GoldenGhost.exeC:\Windows\system32\GoldenGhost.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4328
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
323KB
MD56c6f4b5041801599c2ca26b5fe18cba0
SHA13b43e24fa818795f6336efa50c6b4401c22a934d
SHA2565ef642ad733f61dc46e1079623b0488e6572d3e29b0ee9411d00bfdb233e2d66
SHA51204a01837d5d446d1c0dd5728c0b0cc870cb5f00d5de3dda84bba9dca7df72e62434d807c63bbc6bec2190f2c766513f71041c58ab2de1f696ad178491e09bf17
-
Filesize
323KB
MD56a36d47fc7a23679cae0c478341bdd52
SHA14c1c5047f777e474abff65d842dc8bf1958c3e67
SHA256b1bcc175fae539f436a4539631faa1bd2dd7adf8746529047f788ded6eca3cca
SHA512c193793fa08566c5e4b44e64559e0c1a8b77bec3e9f6553b83aa3ea4342ffb590d699e83e87b174ce8798d12ab96b21ba3c01d22bb4e13b1246fa7594a6fa626
-
Filesize
323KB
MD5ba49b84305e24393e7d3605fb49ffece
SHA19385d459f0238cf47653d40a64d49dd59b0eac72
SHA2569508dc3e71210fe63e652e76b892fabad9f7b666d6492e0cbbaed7c1e297dce5
SHA5120acff9daa1ce1e804b0d80cfc390cc352c5dea28344704708a744ba4400ac4179310b47ae42faba7a512af2e800aab25c19e2a3b06f5cf7287748ef3f62c70bc
-
Filesize
323KB
MD512477a2c2b5198aa8a2f1848d6f4a45e
SHA1764d44b39b2fded40925411c75e1e7dfa5ba2959
SHA25634250bc554d21e7c2a10265ee5aa3d5b357245eb470c16711790f997792d685c
SHA512412ad24034d394f515332ec10f8fe81b4a15a8c2d733aba3885d2f1ede810e1c8c144af1c97e38949fe2da53b752fccf73a387c884866b5d13a84ba7ea731226
-
Filesize
323KB
MD55c0f69a5adac232f4a38d5d2f3e56844
SHA1ad584e726556fe6a6d2b414fe1512ac81ac627a9
SHA256bf520dbc2bdf02399fa466db72f2a64f6c6e9d3bfc6eda85fbd2c38d9e54b90b
SHA5123d99d04db377ee58cc422812a69310572b1dde6fdf87e522b5dc6c33370418ec897598aa6515cdd6606ec52eafae1c248d0416ee558b09a24a8b068d5f0a8549
-
Filesize
323KB
MD50b26b4b61ed5eab2751ef59b4b139e48
SHA19d3e97b988f35e778c7cd79ae3c419e5ebb763a1
SHA2569071db4d5aa88880a067fc3450355c611a81c1997cbd81eca86ece8a831faacf
SHA51283dde3acbf92ad0634d4166d338fedb4bffc199e0bf635857b0569fcb48be3b4b7aab0d11e0dae938b86067e3e32d117e19b5a8e9f5c99f34ba11884d7a4f467
-
Filesize
323KB
MD5b707efdad1c2af7f0d57cd61b065654e
SHA1981a89b351f6cb60f88c38e59b94316104f446fd
SHA2560ace7487c0e587802a43ccd8bcbb7889371cd278a835347a0c314c487496a88d
SHA512c56d8f55b8fd3a6b2f506b465988ca79c1dd1ecfc09b413bfc8909ee385218d22021269a0ebcf47d6cc3fd87786429f120f612a2089f8afbb64444eb2453cf82
-
Filesize
323KB
MD50f10b7276f7e1fc0afc733e901bb8bbb
SHA1d16e9c42a4fa5b50635177700d2f8eeff71c7400
SHA256607f5e6179d3b5cc7142c5ce8ca59ffae6ec9ad8a22b2aaadc116b14aad4e138
SHA51241aad45fc62e57705f1d35538e8a6f0feb4470d70617e8df2bb31209876de8f11bf68da0b9315468deff3ea861c71e76f6ddcc47136bc2daace6faf44983400d
-
Filesize
323KB
MD581e8df452781e21be16e78ef9f2dfd1a
SHA1d11d1c2889b0454b656fda37fb9761dd68cfceae
SHA256d2612be1e6b0537406fe8ffe831a554760377797b4d8a8f8ba3767350cea191c
SHA5128659262ef1ce08129b63610e36f0c057e4b7e06f874c329ec07923ad2068ffbcd0a44e5b23f3180173656ae573bf5a66503147d6316e9d03f7d3d5d87ec2f8f6
-
Filesize
323KB
MD5ecc82168b6a598179576373015edaab0
SHA1cf5eae93bb33fe5c6f14426d61f6567204fc0e59
SHA256a47655a8b914a3776855f0374677b374f6f152e20456a43a106e4435084c01ee
SHA51211cc1f03938b4b5a969564e1cda06a6b106259bc01df007939bf25a076036c41b7de2a5ac371ccb0d3036b6adb7e4368eb3510e6457c89a41f4accb6d98dda08
-
Filesize
323KB
MD5b6b436e98eaf1142be4150d4b00c65c9
SHA122316370dc71c0781fe066b3065d77b890f38503
SHA25696247e0e27ce8c7536dff43e3fa892f7ba495c535dccf2caacd1282563c21d81
SHA512d34ea094f2f8d4f5a88fc04713867fdb71ace494175eb95a462e895e5318c003de6531ee4574bb8fecb7060f53bb88059ae96633614349eef25f8fe091a5c680
-
Filesize
323KB
MD5720d963f1672076ef1100b7b3965b5f0
SHA1c1754a4ad08f5a0ef82f227ffc0c3f020d348409
SHA256892dcd0bde114d7272f89ad72ac5809fa41b665201881a3f05ac2ecf49874111
SHA512cbbb14fba34f2a9d8b91707f7a94f399a911824e8d2b46699baa4f4d67759e16de07b90cf6bda376ae19da86d8160c1003d5bd967b520db4c9bb8a4fd6ea3726
-
Filesize
323KB
MD5362fff4ef843d39f100f8d84e4921f97
SHA19b5b2a16eaf6a38da4d2ba702a5b4e21825ab86d
SHA2569635060d2e19669191d0045fd63c31525c28e50341999d08d059bb4605ade0b4
SHA5127fa2a6516bad1fe30c4d7bc932f696e0106e6a7362b2c6c0faed89435583e17b8b02a590053ab26766451dfb7e61fc66281931dcda273865d8c8aad9478620b2
-
Filesize
323KB
MD5f32525c7624bb4e5c3c45faccc05b186
SHA1ef0df48f2007b8a9df43804c74d9a81a3b62db09
SHA256e89dc2137753c1e3f8e0bc905ed715a14762d7697498eda95ee24bf904c86853
SHA5126d4d30469d15f697516ae85b11b794e18668de6eacc8db8f5c8ba5e5ee8333e2c28a9a2e3d45642177b65eebb5b83ccdda3189593d331a33a45b577a05eeb0c2
-
Filesize
7KB
MD5d7f9d9553c172cba8825fa161e8e9851
SHA1e45bdc6609d9d719e1cefa846f17d3d66332a3a0
SHA256cd2e513851d519098acef16d191188ac2586d2174dfd1a84f4db7f41a6970086
SHA512a03a806d9db86c0c4f6f8efc4b40008aa51f1625fc1c703a929bfa57a5caf962119b3c76044775af607d4ee1a8a671e1d0a2be66d19ee551717398f9ddc8ad24
-
Filesize
323KB
MD5fbfc939e54022eda796bb425c0f18b06
SHA1d8c453c6887227fa54c0e0eefee6cc65bb2b4371
SHA2568352259413fb03f1b43beb582f805e6970d43a88a6e028a9bdb52f0efdbcd84e
SHA512f087f45b9628a8c39af67382693aa498c411a08befd05871972c0e129399b375c5fb3b63c71ccfa4e3d9bad9cb0c27e7d66e72df53056b15bee1c40e98e4b922
-
Filesize
323KB
MD5534773ab70aed3aeb64a94482ea1a80a
SHA17bfc76e70d818822e31fc5d33c4b8436a48f8fcf
SHA256654b5df3a9a93b997ea84defe221165ff035a57d8837055b578e1ddec98bd00f
SHA512fc992c6e65ca122e26b0e22874684892486d6525c1887cc609340602c11b421db579ba6bebeecadb8a46c935bf26d9895c6d789ad1399464e04766f02d3391bf
-
Filesize
323KB
MD5eacc501779cdc2fda21e317648e08d0f
SHA1d71ca3f7056b48cfa2492861f233e1f3bd507501
SHA25616f7966200b4ba1364535b144ac53144f4f0e6cba24529a234b6c22f65fbc485
SHA512b221044d1e68270b671e6844d7693a3e18af494d9cd6517c5c22dfbf78fb839a6a16b054bdf158b50e36a833cd05c125a270f0aaf970b98dd0e2b151d0e5748b
-
Filesize
323KB
MD5dc2e19942a7648838a600aac967ad18e
SHA1a9f510f4573026b0006c1d147e04c8714927231e
SHA256086836134ef0e51635132536e0ed8f27c465574622518e8d8b3b170d89a402d5
SHA5124f6e6cc1f9dc5009ff97ac3d9dc5dc3012c48a526004a3e4217067eaf342b6034bd0cc0204f4588646e8be198d7e34e15de32eae49a3b571212a4bf6f9096604
-
Filesize
323KB
MD535e4b0cf3b584cf191f22c389ced1062
SHA19be535f568b1a73815eb4ed098203f72212b738b
SHA256c6685a89a3cf0ce6515a990513dcbf854f0b3987b82e5f01e61e03b68029beed
SHA512dafa735b811e5a1996bbf6d0fe21da667a507273d9e4dcd3ea9d2e6a0e85f92bc87753a37a93f59535a8b3a802a8f6fbe37ed080e3a9043c3c1b3ad185428daa
-
Filesize
323KB
MD5b1cad08dfff3b093cb98397b3636b4c4
SHA1042bbe0d4bac39c12e7c43e70acad34297e1ebdc
SHA256369c548f750d818b33b729214f60980200bced6a7fb4bdcf1cb5a81c54452e30
SHA512bb40d2b845302e7d457f5c31cb7830fe70643f8f99d68bbf1056955c2bcdb842a8d5cd064531fe61eb5fdbb93288eb942ef26b2c91e76a02e9f396ca8afe5644
-
Filesize
323KB
MD5dc5f59e19ec72eab1e55168d6193d43d
SHA1a49d8233f12bf8786b1351b4d88e27582284b515
SHA25684fc8761e3234979f83a33cf7f80b40354eab8ef3e053bf9e82c777a610a8717
SHA5127e5bc5a6289451ebbce256a55fea830279542041e77aec66a59f73bb37afdf4456037d38a2555b90d9a15d4b1ca045bc5e77daa3d30711bde24fef8975a409c8
-
Filesize
323KB
MD5935fef05a4e825c49e34cb2290d9a90a
SHA118e7782eb95284d37a2ded6973924a8a52e2ecd1
SHA256c27f798bc0fc27a870d1ad3f1b040a55f8c24544eff28bbed90c8810ca864f43
SHA51224b528eccb32cf14548e59cb9f997b634ad808cdebb0db25b23f45ce99c622338dfdea68fe8163803c26b6738c54ae5361ebc5dc8e802c723fb72e5496f2688d
-
Filesize
323KB
MD510430c651deda257eef8d6c4abedd376
SHA184fc413d717f7801be52bd3fbc0188e3a0c6024e
SHA256b2933f95b69cfb007d328ebcfc824ea84a10f1b6bc0848918a75560cbe98f9d4
SHA5124197607cfb9953be38e27b49eaccf412ca637836c1bde64c85a3f17cce18655341cc818e79a4c9ca2eadcb6f4c24c2384939d55a3b162b284d777256b9dabbe4
-
Filesize
323KB
MD53c009b5c863499650b05274d8a644ded
SHA1169b1572798c02691f09e73fc30bc2ff404c96b3
SHA256df6fac6ac4b070767316a6280eca4264b832f97632d7347efd0c5bf2ecb7695a
SHA512b79750fbd1bd0f8059eef2ed4d72659e354b95d34e7037e0dc4e02933934ef10764ff66ad7ec4e18fc47fd17466c0a572f20c664d596cfab753c426d94fe09d1
-
Filesize
323KB
MD5a6aeae4687eae0199f793dd68583bd2b
SHA1eaf039ce80b581ed0e23b770e370c7c9b6656f05
SHA2568dc3497957815b3411d47fb70b94eb8fd4a558cf0960c9d04098bfa0b6cf037b
SHA5129d653520286b5e6e9b9a2b8caff6272e09be027a233f8e71d6326e6808688bf61c96d46fa2f2f49d13d472e927e82b6174be02e9377574ea97ad4826b8053438
-
Filesize
323KB
MD5192e2ec84438f0ca077e0e51276cc400
SHA116cd94fd03fa8f76c1e21c19f30c0299c1a0c466
SHA2568e783153ebc026fd9798afce575000d623c796048d3017274ad7bc67aaa46ab4
SHA51245a66370b279e0b5446dfa35a69683b574f54d55d4d16d29d7a93a2590a275bd8b9fbf5d50d9ca81796479a64b2a8ba5b582bffb67509023d992aa47c6d2771f
-
Filesize
323KB
MD566aa4a8dd711b22c35d2706ac1fd7088
SHA175b62ee4691b9d84201c894ab04457cfcca99311
SHA256020b6125cbea99d8d36607c45d6151a8fa29087d170ec4f81a2ec4da63ee1106
SHA5129ad88a9e1c986427d64e03804db5c5ffdfd63db5651c5c4bca55cef9cf70cf571e53e64f26bdeee9dbaf3642be2f4d6bacfe824ebcaecf3ee2a8d77ece644c43
-
Filesize
323KB
MD50d6174197ad2e8c8453d13a1fa173cb6
SHA14e59d7bdb6db5f5d8ec500f67a8ebac69c22efa0
SHA256b38003e099f9edd0d0a06b853d451e2bdab1d45cbe00e4b3ecd32af5b4dbe7e0
SHA5124a9f870dbd0c13dad81a2be2fc6255efe3198ca80f2fccd1e11091bfdeea681c72e4b2a0e2ca47483d6d749ce6c853c8cb88a11ccdccf720385627f0d270224a
-
Filesize
2KB
MD543be35d4fb3ebc6ca0970f05365440e3
SHA187bc28e5d9a6ab0c79a07118ca578726ce61b1bc
SHA2565a15c1aab77f132e7ce5928996919ed66564c6082a7f94d0a42229c480113fc5
SHA512b2e24ff3702805d2ff8ecf3ddde8a8e6258965f992f37104c2ed9b763e1448ab32c7609a607e1d90cfba281e7add1e839855656d6453433a42c0d6c8923c9395
-
Filesize
323KB
MD505b79427151cc8b2f595436320bf1aae
SHA13ce019cfa1b58ab0c745f57c32caaffea309e949
SHA256956a7bbb0c7e2ab9a2713f1f039cc8c75b29e3ed3a750d356aacfda9d6275068
SHA512c26b3c214b46c0b4b9ac594e111bb0f3802e25a63c18e3110693dc5cec70a290de3a040a890568b2698a658073c961d886601c314a7e721d5cd3b3fa8336df16
-
Filesize
323KB
MD51f25dd0327cf8b538de9d3d152a3f6f5
SHA17555e898d4032cda1b915df03e1d382ee353f806
SHA256cdce6bc730802f4d3bfe2f69f1281b0dcedba2d57b41365fc27e272886da62b7
SHA512a1c6cef9ed15e97a0f0ccb38e01731591ed4d7ba9de82fb13b254cd707f432915881ad6dfb3d2439af63716304b69e3da94d9f48102c4b034e395ab207cd875c
-
Filesize
323KB
MD5c9e77c55c664567e0bbf17387119a6aa
SHA140a5c3a527ae80368d4259e7250a821ab3dca1ec
SHA25655fa6d0b9c48204c835aaf6e1167d39c25a80fd66a322321a0db40da159047df
SHA512acbd3a6cd9236af06f10839f228f875a03860d7e0b168c7b2f3fb9ae85629a2dab7878c2d0c44b21c5135f94cdd19443b74f0505052a4ddf1b9aeff6d55318ec
-
Filesize
3KB
MD58482935ff2fab6025b44b5a23c750480
SHA1d770c46d210c0fd302fa035a6054f5ac19f3bd13
SHA256dcbcdce04483e9d2d8a5d7779b18b7f64cfc06e758b07f671493e38dfb9ab33c
SHA51200c711d815815a88fc15f73c8cba6a81b2bfc505baff2cc67b456545151fe896029f11127e447c9bbc5a2d5dc561a06a52be9a9f9c0d28e98ea4e174cdd54398
-
Filesize
2KB
MD562b7610403ea3ac4776df9eb93bf4ba4
SHA1b4a6cd17516f8fba679f15eda654928dc44dc502
SHA256b0fd7ffb4c8f0e4566658a7284ca0652961648aaab44a53c5b9713664b122c29
SHA512fa1995a21ffe073a15fa00a3a8717492b0a67f3615abe4c7e6bce054bb23cf545e10e21cfe3625b665c8bb199577815dbeccc7c6107cdb49f673b8d53f23888d
-
Filesize
323KB
MD57dba8b25e27347bd5d8006525e123ae8
SHA155ed2469784db0524b72a8dde00412855bbcf45f
SHA256b1857974cc0503b0f3174d916477b07c01d31d3e1cb0517b382220929ca34d19
SHA512d9c647b0cdda065b112329b1864857580abc6c8468e3d612de89e4806ecde690d3fe5d17cdc5029e6773a94b3f7778ce392477fc48cc6366ef904c776ba020f0
-
Filesize
323KB
MD5d9d2510ba7ebe92f21ce10dc3614ad79
SHA143895bc2c48c0bf5567054cf3a3ef5738364182f
SHA25676de89770200ff1ad2cc49994aa22147ad307eb029b26c9da8fe143fb50205df
SHA51232b55fb905d21dac267f7dd64bf63fc418081444bbfce5cb53d17547a81e9bc0d55f12b46dbe81ba9de21c3c3c233ba920908d31bf138931f5df952e5c2eeda1