Overview

overview

10

Static

static

3

ed20ab7529...18.exe

windows7-x64

10

ed20ab7529...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/09/2024, 07:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ed20ab7529bfbc3acc36961a2aeedbbe_JaffaCakes118.exe

  • Size

    196KB

  • MD5

    ed20ab7529bfbc3acc36961a2aeedbbe

  • SHA1

    da455cac68b180fd9af7b28f272a65a6b828764a

  • SHA256

    8d4f9938192f1c00817343c150f9042e6463e34c90c1f58c4c5aeafd9e4fe995

  • SHA512

    7e18e93977079c7658f681b70c4cf593edc6d49691ef0732af86393fda8cae86b19ec7d27275bb3172f514366288de0a28fee11937437c1b5cad77c902347f5a

  • SSDEEP

    3072:ZGBT753Q+RgWgMlIx1ZiXjb6aEF6D0NM9voeLNZ3mEl0:Y753RgWg4aAXjb6aEFfooeLNZo

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 14 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 7 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 7 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 36 IoCs
  • Loads dropped DLL 6 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 28 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 21 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 41 IoCs
  • Drops file in Windows directory 28 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 63 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 21 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 7 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 37 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 14 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed20ab7529bfbc3acc36961a2aeedbbe_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ed20ab7529bfbc3acc36961a2aeedbbe_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4516
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:2208
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 732
        3⤵
        • Program crash
        PID:244
        • C:\Windows\SysWOW64\Shell.exe
          "C:\Windows\system32\Shell.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • Disables RegEdit via registry modification
          • Disables cmd.exe use via registry modification
          • Executes dropped EXE
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Enumerates connected drives
          • Modifies WinLogon
          • Drops autorun.inf file
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Modifies Control Panel
          • Modifies Internet Explorer settings
          • Modifies Internet Explorer start page
          • Modifies registry class
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:5112
          • C:\Windows\Tiwi.exe
            C:\Windows\Tiwi.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2660
          • C:\Windows\SysWOW64\IExplorer.exe
            C:\Windows\system32\IExplorer.exe
            5⤵
            • Modifies WinLogon for persistence
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • Disables RegEdit via registry modification
            • Disables cmd.exe use via registry modification
            • Executes dropped EXE
            • Modifies system executable filetype association
            • Adds Run key to start application
            • Enumerates connected drives
            • Modifies WinLogon
            • Drops file in System32 directory
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Modifies Control Panel
            • Modifies Internet Explorer settings
            • Modifies Internet Explorer start page
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:4220
            • C:\Windows\Tiwi.exe
              C:\Windows\Tiwi.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:1300
            • C:\Windows\SysWOW64\IExplorer.exe
              C:\Windows\system32\IExplorer.exe
              6⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:972
            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:1348
            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:2896
            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:1684
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
            5⤵
            • Modifies WinLogon for persistence
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • Disables RegEdit via registry modification
            • Disables cmd.exe use via registry modification
            • Executes dropped EXE
            • Modifies system executable filetype association
            • Adds Run key to start application
            • Enumerates connected drives
            • Modifies WinLogon
            • Drops file in System32 directory
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Modifies Control Panel
            • Modifies Internet Explorer settings
            • Modifies Internet Explorer start page
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:460
            • C:\Windows\Tiwi.exe
              C:\Windows\Tiwi.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:2540
            • C:\Windows\SysWOW64\IExplorer.exe
              C:\Windows\system32\IExplorer.exe
              6⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:3812
            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:4924
            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:4464
            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:4444
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
            5⤵
            • Modifies WinLogon for persistence
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • Disables RegEdit via registry modification
            • Disables cmd.exe use via registry modification
            • Executes dropped EXE
            • Modifies system executable filetype association
            • Adds Run key to start application
            • Enumerates connected drives
            • Modifies WinLogon
            • Drops file in System32 directory
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Modifies Control Panel
            • Modifies Internet Explorer settings
            • Modifies Internet Explorer start page
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:3224
            • C:\Windows\Tiwi.exe
              C:\Windows\Tiwi.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:4380
            • C:\Windows\SysWOW64\IExplorer.exe
              C:\Windows\system32\IExplorer.exe
              6⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:4412
            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:1984
            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:4132
            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:3480
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
            5⤵
            • Modifies WinLogon for persistence
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • Disables RegEdit via registry modification
            • Disables cmd.exe use via registry modification
            • Executes dropped EXE
            • Modifies system executable filetype association
            • Adds Run key to start application
            • Enumerates connected drives
            • Modifies WinLogon
            • Drops file in System32 directory
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Modifies Control Panel
            • Modifies Internet Explorer settings
            • Modifies Internet Explorer start page
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:2072
            • C:\Windows\Tiwi.exe
              C:\Windows\Tiwi.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:3292
            • C:\Windows\SysWOW64\IExplorer.exe
              C:\Windows\system32\IExplorer.exe
              6⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:4520
            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:4024
            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:2292
            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:3324
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5000
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:816
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4884
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2388
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1204
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2676
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4632
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1932
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5044
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2208 -ip 2208
    1⤵
      PID:4988

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Replication Through Removable Media

    1
    T1091

    Execution

    Persistence

    Boot or Logon Autostart Execution

    3
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    2
    T1547.004

    Event Triggered Execution

    1
    T1546

    Change Default File Association

    1
    T1546.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    3
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    2
    T1547.004

    Event Triggered Execution

    1
    T1546

    Change Default File Association

    1
    T1546.001

    Defense Evasion

    Hide Artifacts

    2
    T1564

    Hidden Files and Directories

    2
    T1564.001

    Modify Registry

    9
    T1112

    Credential Access

    Discovery

    Peripheral Device Discovery

    1
    T1120

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    Lateral Movement

    Replication Through Removable Media

    1
    T1091

    Collection

    Command and Control

    Exfiltration

    Impact

    Inhibit System Recovery

    1
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Tiwi.exe
      Filesize

      196KB

      MD5

      170ce472b9ff5e1745bca805b2df2944

      SHA1

      240a5613baa1a7b1fa8fec96d3d4a783ee3fbad3

      SHA256

      1aa670e28318d939dbe9fe9c40c6ebe1139642dafc711f0cfd5412c5299fdbba

      SHA512

      a3181b246e48f272b4fdd0e2ce5af8db649b5b1d10e09eb0ba1362fa678914800cc07a6cb36a13a8d174f89b5af754b8a2ffecf7511b987e3d1b415c9945a2d4

      Download Submit

    • C:\Users\Admin\AppData\Local\WINDOWS\cute.exe
      Filesize

      196KB

      MD5

      d7a3fda6bd967ccbefb6ba5bcb582787

      SHA1

      1093d9e86824ddb831871efd72c39b0bbb56fec4

      SHA256

      38cfb36c8e3e88e53b429318840b25207fe06c01a006507421f0fa17a544ca35

      SHA512

      3388594bb3ed923906852c2e2ed761c50015d1524df5ec129248b86f6f75208a7bd210ec4ade965f27ff7809750a10dc869fb4bdff548085e95e61b3303cffa9

      Download Submit

    • C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe
      Filesize

      196KB

      MD5

      a64398c27988727f46d639df40308dfb

      SHA1

      8c29cbc06120a8c48e99bebb85eecf56b3de9901

      SHA256

      82bbad736a0fc35ea0303bcb554c056be1673fb11a9a48750775551b73388bde

      SHA512

      8cf4dd75d861d42348a4584a26a62dbfcacf43d6cfd1df8f23f9b890a327c0c08dacaa0fafd34d33f0062362d249ed276e3cc8695a61a25690671ff2688fcac7

      Download Submit

    • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
      Filesize

      45KB

      MD5

      12720ac07f6e38dcd48b53350f001e4c

      SHA1

      38caa6de33d7b0f4851243a535c34d2926bf5fcb

      SHA256

      138a6270a374061721bf33e32c7f9bca7dc57ee1bb004ec7140cf0cdd380f49a

      SHA512

      33e181fbac7f75ff8827700e0aba1079acee29406f14959aafd419a24262abcd20f0fb0b947866d60a0a258af9298d58c3f5af50eb9d5f98db61b4d85a63a87c

      Download Submit

    • C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe
      Filesize

      196KB

      MD5

      69f69d6325f9cf94ae4e3f21337043f1

      SHA1

      1f3b2d6178992bee0195549fd459ede098d7f2f1

      SHA256

      e43f0a6372480cc421f4a28e6a46e7c84e82bcbee008141e8d5b62f74da04ce8

      SHA512

      9628febb006879b00f8b185a7b73a82265f063552efc68a34cad1d1ef9197ce1828d745bf4de5857ae39c873a91ca1318694a4ff66a5e17bb54fe3971340dea8

      Download Submit

    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      Filesize

      196KB

      MD5

      e43fc92b53202e67d10df61596189920

      SHA1

      13793dc524d52d17bd004f5972e7385f88fa7f67

      SHA256

      c54a7dda380dd090ad93cc01c880ce57155ed62cf95fc1695af50d5e60cc1310

      SHA512

      c9314c05a4499afe3f1f6655c47ff89dc9c420ac1b7972b5177978826d818e7abd751465df56c3b9abac0747aaecf51af7a1e243c14a9f2203f1b7a0207209c9

      Download Submit

    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
      Filesize

      45KB

      MD5

      daec7c92aa9bb7ceb2b0156c7e870870

      SHA1

      0b0559d8550503a66b0aaf9741ad8d1c8baccf81

      SHA256

      3a9da22866d10bbb7dace4837c1f89f8eefda80155c1f545555e6938667d9e45

      SHA512

      a31f393b39b886d6fa9c8ac3282f4e1c353e0a7c26ff0727f4bcf317ad53d195253d3cc92faa5e4606004a33f1da4af35bb2bebbda613f941c19aa5c508abc4c

      Download Submit

    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
      Filesize

      45KB

      MD5

      8276afe73281d472847fc2ecfe4378c2

      SHA1

      bf9db9c95bf4c11517a6bc58c4ad610bdd537671

      SHA256

      cbed44b370e8a6041b1859cac608efb536f86a414cb46d50629284cd21218d43

      SHA512

      5715c05242cdab7792ac7d54a87b0c3fbf2ff02533ac5a51ea33fe355825f3936aca2b518898fc1c0d81988159cec27eb1854b76f2077edbbd9054360b391e3d

      Download Submit

    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
      Filesize

      45KB

      MD5

      9730664310278ddc6b2875448721f43a

      SHA1

      b4dc1d7d8a60bf55f9fd58d38e40a788fedbf718

      SHA256

      f2dd2305b8527aabdde27f34b4904b50c808c16b40d108c35c8875f4e75e9a03

      SHA512

      440ce6c86df4c69abecb39aec69e4bcd82a511fde1fd0ee73cc7c2ed7b12cb9acccff1c3ab83c0f93c2e4f3769d24c786c0776875394c3cbfb0a787ad9af887e

      Download Submit

    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
      Filesize

      45KB

      MD5

      7040c657d364f4073b0e079507c77a44

      SHA1

      94f8c6c1d4e3825e919c8a9b5516556f74937e02

      SHA256

      d2360d2fb5ed4445f7b7b2b4cbfaf35eb671cbca13f3f0d92544f33960fe561e

      SHA512

      fc48dc234c9e793b6c37b693f0d032255bf84043ada2649c639de69f8750e4a82810d4ab736aa7a727f1a13b7d43ee7fec8cde7fe4caba2dafd4dfead4ae9e4a

      Download Submit

    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      Filesize

      196KB

      MD5

      a39f947c35e62da31fab70e5d7d35d84

      SHA1

      48036a1d53497518b585244434c887edad0fcd00

      SHA256

      0bb143e13c4b0286fd415b9e8192099a4a92dcb9eaf0e890d4799d5960d1951e

      SHA512

      f27c544273cd2d61b5ec4fc91f2b43ba9fd76b66bf386267a6c412f284aa3e8c70af5d64abc2714cc3613868e95efbe692fc9f4fc24d12dae3a2d47583b90c75

      Download Submit

    • C:\Windows\MSVBVM60.DLL
      Filesize

      1.4MB

      MD5

      25f62c02619174b35851b0e0455b3d94

      SHA1

      4e8ee85157f1769f6e3f61c0acbe59072209da71

      SHA256

      898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

      SHA512

      f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

      Download Submit

    • C:\Windows\SysWOW64\IExplorer.exe
      Filesize

      196KB

      MD5

      399a8957b119e54a75aefbf2938c0799

      SHA1

      2eae491cd28e3589b2cf8adf4f5f34de15713f44

      SHA256

      f9f0d031ea3c11479a4aeece83e56d05d9859335b2365af6237c4e1997d612d7

      SHA512

      f346efb4598a0886355c3a2c25c8e17424f782f1112e877cc26b9cadfe97d34422e8e57e9ebebd8124d1a969571b24b75dc3831d7ed1b98531ce6a0752ec1dea

      Download Submit

    • C:\Windows\SysWOW64\shell.exe
      Filesize

      196KB

      MD5

      ed20ab7529bfbc3acc36961a2aeedbbe

      SHA1

      da455cac68b180fd9af7b28f272a65a6b828764a

      SHA256

      8d4f9938192f1c00817343c150f9042e6463e34c90c1f58c4c5aeafd9e4fe995

      SHA512

      7e18e93977079c7658f681b70c4cf593edc6d49691ef0732af86393fda8cae86b19ec7d27275bb3172f514366288de0a28fee11937437c1b5cad77c902347f5a

      Download Submit

    • C:\Windows\SysWOW64\shell.exe
      Filesize

      196KB

      MD5

      ea150b180d6103c26a3ecd102a7429e8

      SHA1

      b5776df66a7af2adb376262620d464b4f8ce4ba4

      SHA256

      516a41f572fdccc138ffa8779aee10b12e8cf9e6ba8c6fb262ae7b90b0019449

      SHA512

      14ef7625bfb9a63b576c4294bb36957333fd4a5f3ca770d5c78a3956e60c0a405687d906557a29870446d5a720a21553be50248fc992bd4cd445a42cde512175

      Download Submit

    • C:\Windows\tiwi.exe
      Filesize

      196KB

      MD5

      ec4aaefcc7972b36861e0a3c212c52e9

      SHA1

      4cb44371aeaa7a701d7e578aec88d2824e63594d

      SHA256

      c0149660a25e84b8aa8dc1aa302b48c10a214c9839ee33b410e4c0e5e0fb8c3d

      SHA512

      6708a5a0307524e93438a0772b6d11614f4620531e2c094224e521ba19618e0ae1997951212ff3b3358718ce0fbd163a5526406bd1b1a935c41a772f1dc8b825

      Download Submit

    • C:\present.txt
      Filesize

      729B

      MD5

      8e3c734e8dd87d639fb51500d42694b5

      SHA1

      f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

      SHA256

      574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

      SHA512

      06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

      Download Submit

    • C:\tiwi.exe
      Filesize

      196KB

      MD5

      69abe316b45c23527941b8f110368755

      SHA1

      73f2c0628fcdd6aae8dcf1d5c950ed25457f07c7

      SHA256

      fd618c7eab7947a27c8842351b6e633bdfd245dedb32534cafa09eecadd7cc81

      SHA512

      1368e065aef865f42b9f70864b6ba2f8544983ddc53364a0d6b48f202aacc40a6d0fb0093cdad1f7002fdc431799ede90eb0fa95d9509565aba91e7d7a59bf63

      Download Submit

    • F:\autorun.inf
      Filesize

      39B

      MD5

      415c421ba7ae46e77bdee3a681ecc156

      SHA1

      b0db5782b7688716d6fc83f7e650ffe1143201b7

      SHA256

      e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

      SHA512

      dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

      Download Submit

    • memory/460-151-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

      Download

    • memory/2072-163-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

      Download

    • memory/2208-96-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

      Download

    • memory/2660-139-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

      Download

    • memory/3224-157-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

      Download

    • memory/4220-145-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

      Download

    • memory/4516-0-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

      Download

    • memory/5112-101-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

      Download