04d077f7045628852ebaf451e56c428b89e63a144c4fd9f87cc5cbe340748587

Analysis

max time kernel
148s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/09/2024, 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edc1812d0f584be4048a3a32da9c5fb9_JaffaCakes118.exe
Size

564KB
MD5

edc1812d0f584be4048a3a32da9c5fb9
SHA1

c71fc3e0ddfec85e7b09e87c85b28e44a0fc15f3
SHA256

04d077f7045628852ebaf451e56c428b89e63a144c4fd9f87cc5cbe340748587
SHA512

20df108c6014a7ecd6414a4408f51f828d2b2cedd9b968f649d37046b43be6b14381b83e7a3e2110a44b8ac9d2e2be78552971e4b3d73ff9aa9ca6aa7f828980
SSDEEP

12288:ikE0bH5xnrGpk9mfY0zK09iN5J9rrKq+AT7Jb2wc4isGQKmFjJQTjQFeWUaiBF/e:Zr2QJVFwVmFjJtRcm

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 8 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\test.exe = "C:\\Users\\Admin\\AppData\\Roaming\\test.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EA7BEF0B-9A5F-E86A-7041-FFCDBFDDE929}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EA7BEF0B-9A5F-E86A-7041-FFCDBFDDE929}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\test.exe"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{EA7BEF0B-9A5F-E86A-7041-FFCDBFDDE929}	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Active Setup\Installed Components\{EA7BEF0B-9A5F-E86A-7041-FFCDBFDDE929}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\test.exe"	svchost.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\edc1812d0f584be4048a3a32da9c5fb9_JaffaCakes118.exe	edc1812d0f584be4048a3a32da9c5fb9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\edc1812d0f584be4048a3a32da9c5fb9_JaffaCakes118.exe	edc1812d0f584be4048a3a32da9c5fb9_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2260	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
2696	edc1812d0f584be4048a3a32da9c5fb9_JaffaCakes118.exe
2696	edc1812d0f584be4048a3a32da9c5fb9_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2696 set thread context of 2260	2696	edc1812d0f584be4048a3a32da9c5fb9_JaffaCakes118.exe	33

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	edc1812d0f584be4048a3a32da9c5fb9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
2616	reg.exe
2632	reg.exe
2664	reg.exe
2624	reg.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: 1	2260	svchost.exe
Token: SeCreateTokenPrivilege	2260	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2260	svchost.exe
Token: SeLockMemoryPrivilege	2260	svchost.exe
Token: SeIncreaseQuotaPrivilege	2260	svchost.exe
Token: SeMachineAccountPrivilege	2260	svchost.exe
Token: SeTcbPrivilege	2260	svchost.exe
Token: SeSecurityPrivilege	2260	svchost.exe
Token: SeTakeOwnershipPrivilege	2260	svchost.exe
Token: SeLoadDriverPrivilege	2260	svchost.exe
Token: SeSystemProfilePrivilege	2260	svchost.exe
Token: SeSystemtimePrivilege	2260	svchost.exe
Token: SeProfSingleProcessPrivilege	2260	svchost.exe
Token: SeIncBasePriorityPrivilege	2260	svchost.exe
Token: SeCreatePagefilePrivilege	2260	svchost.exe
Token: SeCreatePermanentPrivilege	2260	svchost.exe
Token: SeBackupPrivilege	2260	svchost.exe
Token: SeRestorePrivilege	2260	svchost.exe
Token: SeShutdownPrivilege	2260	svchost.exe
Token: SeDebugPrivilege	2260	svchost.exe
Token: SeAuditPrivilege	2260	svchost.exe
Token: SeSystemEnvironmentPrivilege	2260	svchost.exe
Token: SeChangeNotifyPrivilege	2260	svchost.exe
Token: SeRemoteShutdownPrivilege	2260	svchost.exe
Token: SeUndockPrivilege	2260	svchost.exe
Token: SeSyncAgentPrivilege	2260	svchost.exe
Token: SeEnableDelegationPrivilege	2260	svchost.exe
Token: SeManageVolumePrivilege	2260	svchost.exe
Token: SeImpersonatePrivilege	2260	svchost.exe
Token: SeCreateGlobalPrivilege	2260	svchost.exe
Token: 31	2260	svchost.exe
Token: 32	2260	svchost.exe
Token: 33	2260	svchost.exe
Token: 34	2260	svchost.exe
Token: 35	2260	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2260	svchost.exe
2260	svchost.exe
2260	svchost.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2412	2696	edc1812d0f584be4048a3a32da9c5fb9_JaffaCakes118.exe	30
PID 2696 wrote to memory of 2412	2696	edc1812d0f584be4048a3a32da9c5fb9_JaffaCakes118.exe	30
PID 2696 wrote to memory of 2412	2696	edc1812d0f584be4048a3a32da9c5fb9_JaffaCakes118.exe	30
PID 2696 wrote to memory of 2412	2696	edc1812d0f584be4048a3a32da9c5fb9_JaffaCakes118.exe	30
PID 2412 wrote to memory of 2936	2412	csc.exe	32
PID 2412 wrote to memory of 2936	2412	csc.exe	32
PID 2412 wrote to memory of 2936	2412	csc.exe	32
PID 2412 wrote to memory of 2936	2412	csc.exe	32
PID 2696 wrote to memory of 2260	2696	edc1812d0f584be4048a3a32da9c5fb9_JaffaCakes118.exe	33
PID 2696 wrote to memory of 2260	2696	edc1812d0f584be4048a3a32da9c5fb9_JaffaCakes118.exe	33
PID 2696 wrote to memory of 2260	2696	edc1812d0f584be4048a3a32da9c5fb9_JaffaCakes118.exe	33
PID 2696 wrote to memory of 2260	2696	edc1812d0f584be4048a3a32da9c5fb9_JaffaCakes118.exe	33
PID 2696 wrote to memory of 2260	2696	edc1812d0f584be4048a3a32da9c5fb9_JaffaCakes118.exe	33
PID 2696 wrote to memory of 2260	2696	edc1812d0f584be4048a3a32da9c5fb9_JaffaCakes118.exe	33
PID 2696 wrote to memory of 2260	2696	edc1812d0f584be4048a3a32da9c5fb9_JaffaCakes118.exe	33
PID 2696 wrote to memory of 2260	2696	edc1812d0f584be4048a3a32da9c5fb9_JaffaCakes118.exe	33
PID 2260 wrote to memory of 2980	2260	svchost.exe	34
PID 2260 wrote to memory of 2980	2260	svchost.exe	34
PID 2260 wrote to memory of 2980	2260	svchost.exe	34
PID 2260 wrote to memory of 2980	2260	svchost.exe	34
PID 2260 wrote to memory of 2728	2260	svchost.exe	35
PID 2260 wrote to memory of 2728	2260	svchost.exe	35
PID 2260 wrote to memory of 2728	2260	svchost.exe	35
PID 2260 wrote to memory of 2728	2260	svchost.exe	35
PID 2260 wrote to memory of 2928	2260	svchost.exe	36
PID 2260 wrote to memory of 2928	2260	svchost.exe	36
PID 2260 wrote to memory of 2928	2260	svchost.exe	36
PID 2260 wrote to memory of 2928	2260	svchost.exe	36
PID 2260 wrote to memory of 2112	2260	svchost.exe	37
PID 2260 wrote to memory of 2112	2260	svchost.exe	37
PID 2260 wrote to memory of 2112	2260	svchost.exe	37
PID 2260 wrote to memory of 2112	2260	svchost.exe	37
PID 2928 wrote to memory of 2624	2928	cmd.exe	43
PID 2928 wrote to memory of 2624	2928	cmd.exe	43
PID 2928 wrote to memory of 2624	2928	cmd.exe	43
PID 2928 wrote to memory of 2624	2928	cmd.exe	43
PID 2728 wrote to memory of 2616	2728	cmd.exe	42
PID 2728 wrote to memory of 2616	2728	cmd.exe	42
PID 2728 wrote to memory of 2616	2728	cmd.exe	42
PID 2728 wrote to memory of 2616	2728	cmd.exe	42
PID 2112 wrote to memory of 2632	2112	cmd.exe	44
PID 2112 wrote to memory of 2632	2112	cmd.exe	44
PID 2112 wrote to memory of 2632	2112	cmd.exe	44
PID 2112 wrote to memory of 2632	2112	cmd.exe	44
PID 2980 wrote to memory of 2664	2980	cmd.exe	45
PID 2980 wrote to memory of 2664	2980	cmd.exe	45
PID 2980 wrote to memory of 2664	2980	cmd.exe	45
PID 2980 wrote to memory of 2664	2980	cmd.exe	45

C:\Users\Admin\AppData\Local\Temp\edc1812d0f584be4048a3a32da9c5fb9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\edc1812d0f584be4048a3a32da9c5fb9_JaffaCakes118.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\b7udgz8l.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES87C7.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC87C6.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2936
- C:\Users\Admin\AppData\Roaming\svchost.exe
  C:\Users\Admin\AppData\Roaming\svchost.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2980
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2664
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2616
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2624
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\test.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\test.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\test.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\test.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES87C7.tmp

Filesize
1KB

MD5
dfb685f8e978f63eee391ceda1ad0eaa

SHA1
ecb0870307319e979b5c99cf37e4fe7682687c1b

SHA256
3067da62c6bc12b0a6db15f7adffc94c95d7ef1d740679a547ac946ec500c821

SHA512
59ba1a712173df38155e738ecd928ee25f826dc253b59147dbbd52248802b0683be1103d36e660d4f434a7021c729f406ad20656154cb2666ae07f4116a1d171

Download Submit
C:\Users\Admin\AppData\Local\Temp\b7udgz8l.dll

Filesize
5KB

MD5
777625170a3d992a6e75d8ec844a6d90

SHA1
41bc4ee6cd91f96eddecd9a7c1cea28181e87b92

SHA256
704cd03f04e2fe42abf28fdca5ee212f4c5e895c15b519e268e0f0e6d7378f67

SHA512
03491f1dd8c20b6439355c77521d37d5aa652711ec34242a971361ae013e27d0087fd5951ea1aa41d7f942c87c44b8e351db4f1e525234934ec55db9309d04ba

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
12KB

MD5
bb5b2961567e68995464801d3bb2a964

SHA1
5d82ae2b8d24208418bfb09cbb3074c056e790dc

SHA256
a2d3d892c68a84208a9887cb34ecae820e59c4aa25c22db5c23379df344df004

SHA512
050550640a7bf2b65b3cd537f252b64465ec451555ff1831a9d799922e8c3382e83a52bc46015c5ed1ac79ebb233616f72aa8ed72f01e8be578ca383a304ff7a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC87C6.tmp

Filesize
652B

MD5
ec6a75a03417c0f7a1af1a80afff9c41

SHA1
6cc58cc386a696d8f072afed66f935b2c7941abc

SHA256
6ddf6c8750f37e75da03ca6bea785095f6ea9c339001c68c54a5f304fad658b3

SHA512
a10e72adee1265b3c3f4abf897cc63c8b36eafc901978a6fac32f795aa1facf4b264f8f3fbd7869e6f032e1f7217bc63aa073edfba1e7ff0e10f91f3e240f2ec

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\b7udgz8l.0.cs

Filesize
4KB

MD5
2216d197bc442e875016eba15c07a937

SHA1
37528e21ea3271b85d276c6bd003e6c60c81545d

SHA256
2e9e3da7bfa1334706550bb4d6269bf3e64cbbc09fa349af52eb22f32aebb4af

SHA512
7d7bdc3bf83ac0a29e917ead899dcaa1b47ee2660f405fe4883ca2a2546f7924265e1d75a2ea02c0e34fac4d2bb82bbaaa88d06c240afad4e9fd49337cd04d3f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\b7udgz8l.cmdline

Filesize
206B

MD5
60084e1a1d9fd9c9c078d9c1b99fa1a8

SHA1
04e2a807ae309474a8c42751f2035d14ae060857

SHA256
18883566e03fecee6c95657cf2e51d0b3b02e6be3fb59b038683cb15fc2cf422

SHA512
8eff00c0c7b8316b248e656a0b3d9f8cb6cceb1622f55005af65487bab2e525ff03e3e9b76508df0abb4c9995696b8195a0ce38b26fefa4053c7cc29dcc2decb

Download Submit
memory/2260-26-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2260-38-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2260-59-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2260-58-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2260-55-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2260-30-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2260-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2260-27-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2260-53-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2260-35-0x0000000000230000-0x000000000028F000-memory.dmp

Filesize
380KB

Download
memory/2260-25-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2260-51-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2260-50-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2260-45-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2260-46-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2260-48-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2260-49-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2412-11-0x00000000747D0000-0x0000000074D7B000-memory.dmp

Filesize
5.7MB

Download
memory/2412-16-0x00000000747D0000-0x0000000074D7B000-memory.dmp

Filesize
5.7MB

Download
memory/2696-44-0x00000000747D0000-0x0000000074D7B000-memory.dmp

Filesize
5.7MB

Download
memory/2696-0-0x00000000747D1000-0x00000000747D2000-memory.dmp

Filesize
4KB

Download
memory/2696-1-0x00000000747D0000-0x0000000074D7B000-memory.dmp

Filesize
5.7MB

Download
memory/2696-6-0x00000000747D0000-0x0000000074D7B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads