Resubmissions
20-09-2024 18:03
240920-wmzxcszdrk 1020-09-2024 18:02
240920-wmjkdazdpr 1020-09-2024 17:57
240920-wjrrkszcql 1020-09-2024 17:50
240920-wexf9szbkj 10Analysis
-
max time kernel
53s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20-09-2024 17:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
25 signatures
150 seconds
General
-
Target
ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe
-
Size
323KB
-
MD5
ee1f66c363ea75c297724f7657991525
-
SHA1
687de3509051640d8e66b8c6499c8697fd0624d6
-
SHA256
7c65662229d65bd5b6c32a07fe74ab59bb6f45cdd5cc2cb195f9172527f37cc3
-
SHA512
b864282f1dc555313918df597d343837813d29dc91912f5b64b09add4be0f0951ae5e2eab115e103e5349c28489540485bd998839b052d4d16eaf68569b164aa
-
SSDEEP
6144:DBxeN/Tdx8YzL+4eBDgelLBL9C53TV5n+yNXavM:DBxe9dx8Yz6nhtL9C53TV5n+4av
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" GoldenGhost.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Kantuk.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 4K51K4.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" K0L4B0R451.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" GoldenGhost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe -
Disables RegEdit via registry modification 12 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 4K51K4.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" K0L4B0R451.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Kantuk.exe -
Disables Task Manager via registry modification
-
Disables cmd.exe use via registry modification 12 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" K0L4B0R451.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" Kantuk.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" 4K51K4.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" GoldenGhost.exe -
Disables use of System Restore points 1 TTPs
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avgnt.exe ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CClaw.exe winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup32.exe\Debugger = "notepad.exe" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CClaw.exe\Debugger = "cmd.exe /c del" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe\Debugger = "cmd.exe /c del" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe\Debugger = "cmd.exe /c del" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvccf.exe ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe\Debugger = "notepad.exe" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-SE.exe\Debugger = "cmd.exe /c del" GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV.exe winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe\Debugger = "cmd.exe /c del" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Niu.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nipsvc.exe GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CClaw.exe 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nipsvc.exe 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvccf.exe K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup32.exe\Debugger = "notepad.exe" GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nip.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zanda.exe 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe\Debugger = "cmd.exe /c del" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-SE.exe\Debugger = "cmd.exe /c del" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-SE.exe GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe\Debugger = "cmd.exe /c del" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avguard.exe 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avguard.exe\Debugger = "cmd.exe /c del" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup32.exe 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nipsvc.exe\Debugger = "cmd.exe /c del" GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avguard.exe Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Niu.exe 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup32.exe\Debugger = "notepad.exe" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvccf.exe\Debugger = "cmd.exe /c del" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe\Debugger = "cmd.exe /c del" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcoas.exe GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup32.exe\Debugger = "notepad.exe" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe\Debugger = "cmd.exe /c del" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Niu.exe K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-SE.exe K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avguard.exe\Debugger = "cmd.exe /c del" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CClaw.exe\Debugger = "cmd.exe /c del" Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV.exe\Debugger = "cmd.exe /c del" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nip.exe K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe\Debugger = "notepad.exe" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avgw.exe GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe\Debugger = "cmd.exe /c del" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avgnt.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe\Debugger = "cmd.exe /c del" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe\Debugger = "notepad.exe" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zanda.exe\Debugger = "cmd.exe /c del" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe\Debugger = "cmd.exe /c del" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nipsvc.exe\Debugger = "cmd.exe /c del" Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Niu.exe Kantuk.exe -
Executes dropped EXE 10 IoCs
pid Process 4568 winlogon.exe 4912 winlogon.exe 536 Kantuk.exe 4880 4K51K4.exe 2304 K0L4B0R451.exe 2876 GoldenGhost.exe 3428 Kantuk.exe 1176 4K51K4.exe 4564 K0L4B0R451.exe 2532 GoldenGhost.exe -
Modifies system executable filetype association 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command GoldenGhost.exe -
Adds Run key to start application 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" Kantuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" 4K51K4.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" K0L4B0R451.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" GoldenGhost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" GoldenGhost.exe -
Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: Kantuk.exe File opened (read-only) \??\G: K0L4B0R451.exe File opened (read-only) \??\O: K0L4B0R451.exe File opened (read-only) \??\Z: Kantuk.exe File opened (read-only) \??\I: K0L4B0R451.exe File opened (read-only) \??\M: K0L4B0R451.exe File opened (read-only) \??\S: K0L4B0R451.exe File opened (read-only) \??\J: Kantuk.exe File opened (read-only) \??\L: Kantuk.exe File opened (read-only) \??\N: Kantuk.exe File opened (read-only) \??\S: Kantuk.exe File opened (read-only) \??\Y: K0L4B0R451.exe File opened (read-only) \??\R: K0L4B0R451.exe File opened (read-only) \??\Z: K0L4B0R451.exe File opened (read-only) \??\I: Kantuk.exe File opened (read-only) \??\M: Kantuk.exe File opened (read-only) \??\O: Kantuk.exe File opened (read-only) \??\U: Kantuk.exe File opened (read-only) \??\X: Kantuk.exe File opened (read-only) \??\H: K0L4B0R451.exe File opened (read-only) \??\E: Kantuk.exe File opened (read-only) \??\P: Kantuk.exe File opened (read-only) \??\Q: Kantuk.exe File opened (read-only) \??\W: Kantuk.exe File opened (read-only) \??\K: K0L4B0R451.exe File opened (read-only) \??\L: K0L4B0R451.exe File opened (read-only) \??\N: K0L4B0R451.exe File opened (read-only) \??\Q: K0L4B0R451.exe File opened (read-only) \??\H: Kantuk.exe File opened (read-only) \??\R: Kantuk.exe File opened (read-only) \??\Y: Kantuk.exe File opened (read-only) \??\B: K0L4B0R451.exe File opened (read-only) \??\T: K0L4B0R451.exe File opened (read-only) \??\X: K0L4B0R451.exe File opened (read-only) \??\B: Kantuk.exe File opened (read-only) \??\T: Kantuk.exe File opened (read-only) \??\V: Kantuk.exe File opened (read-only) \??\V: K0L4B0R451.exe File opened (read-only) \??\U: K0L4B0R451.exe File opened (read-only) \??\W: K0L4B0R451.exe File opened (read-only) \??\K: Kantuk.exe File opened (read-only) \??\E: K0L4B0R451.exe File opened (read-only) \??\J: K0L4B0R451.exe File opened (read-only) \??\P: K0L4B0R451.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf Kantuk.exe File opened for modification C:\autorun.inf Kantuk.exe -
Drops file in System32 directory 47 IoCs
description ioc Process File created C:\Windows\SysWOW64\Kantuk.exe ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Shell32.com.tmp winlogon.exe File opened for modification C:\Windows\SysWOW64\Kantuk.exe.tmp winlogon.exe File created C:\Windows\SysWOW64\Asli.ico winlogon.exe File created C:\Windows\SysWOW64\Shell32.com ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\4K51K4.exe.tmp ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Shell32.com.tmp ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe File created C:\Windows\SysWOW64\Player.ico ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~ winlogon.exe File opened for modification C:\Windows\SysWOW64\Shell32.com winlogon.exe File opened for modification C:\Windows\SysWOW64\Kantuk.exe.tmp ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe File created C:\Windows\SysWOW64\Asli.ico ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\K0L4B0R451.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\4K51K4.exe winlogon.exe File created C:\Windows\SysWOW64\GoldenGhost.exe ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe File created C:\Windows\SysWOW64\K0L4B0R451.exe ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\4K51K4.exe.tmp winlogon.exe File created C:\Windows\SysWOW64\Rar.ico winlogon.exe File opened for modification C:\Windows\SysWOW64\Windows_3D.scr winlogon.exe File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Kantuk.exe ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Shell32.com ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\GoldenGhost.exe.tmp winlogon.exe File created C:\Windows\SysWOW64\Player.ico winlogon.exe File opened for modification C:\Windows\SysWOW64\K0L4B0R451.exe ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\GoldenGhost.exe ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe File created C:\Windows\SysWOW64\Folder.ico ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe File created C:\Windows\SysWOW64\Rar.ico ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Windows_3D.scr ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe File created C:\Windows\SysWOW64\Word.ico winlogon.exe File created C:\Windows\SysWOW64\Folder.ico winlogon.exe File created C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\JPG.ico ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe File created C:\Windows\SysWOW64\Word.ico ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\Kantuk.exe winlogon.exe File created C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\K0L4B0R451.exe.tmp winlogon.exe File opened for modification C:\Windows\SysWOW64\K0L4B0R451.exe.tmp ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\GoldenGhost.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~ ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\4K51K4.exe ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe File created C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe File created C:\Windows\SysWOW64\4K51K4.exe ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe.tmp ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\GoldenGhost.exe.tmp ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe.tmp winlogon.exe File created C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\JPG.ico winlogon.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\K0L4B0R451.jpg" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\K0L4B0R451.jpg ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language K0L4B0R451.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4K51K4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language K0L4B0R451.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4K51K4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoldenGhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kantuk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoldenGhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kantuk.exe -
Modifies Control Panel 45 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\ K0L4B0R451.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\s1159 = "K0L4B0R451" K0L4B0R451.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\s1159 = "K0L4B0R451" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" Kantuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" Kantuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" GoldenGhost.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\ GoldenGhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\ winlogon.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\ Kantuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\s1159 = "K0L4B0R451" Kantuk.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\s1159 = "K0L4B0R451" GoldenGhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" 4K51K4.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" 4K51K4.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\ Kantuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\s1159 = "K0L4B0R451" 4K51K4.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" K0L4B0R451.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" K0L4B0R451.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" GoldenGhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" Kantuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\ 4K51K4.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\ 4K51K4.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" K0L4B0R451.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\ K0L4B0R451.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\WallpaperStyle = "0" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\ ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\s2359 = "K0L4B0R451" 4K51K4.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\ GoldenGhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\s2359 = "K0L4B0R451" GoldenGhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\s2359 = "K0L4B0R451" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" 4K51K4.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\ ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\s1159 = "K0L4B0R451" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\ winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\s2359 = "K0L4B0R451" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\s2359 = "K0L4B0R451" Kantuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\s2359 = "K0L4B0R451" K0L4B0R451.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\TileWallpaper = "0" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" GoldenGhost.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Edit\Command\ = "logoff.exe" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "logoff.exe" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Edit\Command\ = "logoff.exe" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "logoff.exe" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\shell\Install\command K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\NeverShowExt = "1" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "logoff.exe" GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\edit\command\ = "logoff.exe" 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Edit\Command\ = "logoff.exe" Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "K0L4B0R451 File" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\edit\command\ = "logoff.exe" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Install\command ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\Install\command 4K51K4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\Install\command\ = "logoff.exe" 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\Shell\Edit\Command K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\shell ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "logoff.exe" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\Shell\Edit\Command winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\NeverShowExt = "1" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "logoff.exe" K0L4B0R451.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "logoff.exe" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Install\command\ = "logoff.exe" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "logoff.exe" GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\NeverShowExt = "1" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "K0L4B0R451 File" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\Shell ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command Kantuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\edit\command\ = "logoff.exe" GoldenGhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command winlogon.exe -
Suspicious behavior: GetForegroundWindowSpam 4 IoCs
pid Process 4880 4K51K4.exe 2876 GoldenGhost.exe 536 Kantuk.exe 2304 K0L4B0R451.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 2012 ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe 4568 winlogon.exe 4912 winlogon.exe 536 Kantuk.exe 4880 4K51K4.exe 2304 K0L4B0R451.exe 2876 GoldenGhost.exe 3428 Kantuk.exe 1176 4K51K4.exe 4564 K0L4B0R451.exe 2532 GoldenGhost.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2012 wrote to memory of 4568 2012 ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe 82 PID 2012 wrote to memory of 4568 2012 ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe 82 PID 2012 wrote to memory of 4568 2012 ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe 82 PID 4568 wrote to memory of 4912 4568 winlogon.exe 83 PID 4568 wrote to memory of 4912 4568 winlogon.exe 83 PID 4568 wrote to memory of 4912 4568 winlogon.exe 83 PID 4568 wrote to memory of 536 4568 winlogon.exe 84 PID 4568 wrote to memory of 536 4568 winlogon.exe 84 PID 4568 wrote to memory of 536 4568 winlogon.exe 84 PID 4568 wrote to memory of 4880 4568 winlogon.exe 85 PID 4568 wrote to memory of 4880 4568 winlogon.exe 85 PID 4568 wrote to memory of 4880 4568 winlogon.exe 85 PID 4568 wrote to memory of 2304 4568 winlogon.exe 86 PID 4568 wrote to memory of 2304 4568 winlogon.exe 86 PID 4568 wrote to memory of 2304 4568 winlogon.exe 86 PID 4568 wrote to memory of 2876 4568 winlogon.exe 87 PID 4568 wrote to memory of 2876 4568 winlogon.exe 87 PID 4568 wrote to memory of 2876 4568 winlogon.exe 87 PID 2012 wrote to memory of 3428 2012 ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe 88 PID 2012 wrote to memory of 3428 2012 ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe 88 PID 2012 wrote to memory of 3428 2012 ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe 88 PID 2012 wrote to memory of 1176 2012 ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe 89 PID 2012 wrote to memory of 1176 2012 ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe 89 PID 2012 wrote to memory of 1176 2012 ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe 89 PID 2012 wrote to memory of 4564 2012 ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe 90 PID 2012 wrote to memory of 4564 2012 ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe 90 PID 2012 wrote to memory of 4564 2012 ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe 90 PID 2012 wrote to memory of 2532 2012 ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe 91 PID 2012 wrote to memory of 2532 2012 ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe 91 PID 2012 wrote to memory of 2532 2012 ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe 91 -
System policy modification 1 TTPs 48 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" GoldenGhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer Kantuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" 4K51K4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" Kantuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 4K51K4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System K0L4B0R451.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" K0L4B0R451.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer GoldenGhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" 4K51K4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ee1f66c363ea75c297724f7657991525_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2012 -
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\system32\~A~m~B~u~R~a~D~u~L~\winlogon.exe2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4568 -
C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exeC:\Windows\system32\~A~m~B~u~R~a~D~u~L~\winlogon.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4912
-
-
C:\Windows\SysWOW64\Kantuk.exeC:\Windows\system32\Kantuk.exe3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:536
-
-
C:\Windows\SysWOW64\4K51K4.exeC:\Windows\system32\4K51K4.exe3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4880
-
-
C:\Windows\SysWOW64\K0L4B0R451.exeC:\Windows\system32\K0L4B0R451.exe3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2304
-
-
C:\Windows\SysWOW64\GoldenGhost.exeC:\Windows\system32\GoldenGhost.exe3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2876
-
-
-
C:\Windows\SysWOW64\Kantuk.exeC:\Windows\system32\Kantuk.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3428
-
-
C:\Windows\SysWOW64\4K51K4.exeC:\Windows\system32\4K51K4.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1176
-
-
C:\Windows\SysWOW64\K0L4B0R451.exeC:\Windows\system32\K0L4B0R451.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4564
-
-
C:\Windows\SysWOW64\GoldenGhost.exeC:\Windows\system32\GoldenGhost.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2532
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
323KB
MD5787ba4a644620e5f0bca84b8ec83a135
SHA17e20b2a8c633a6776cf2693fdcdc1301f4b5aa36
SHA25654e9a65bdf7956b74f7cb725e1f7c0ee12e37218edbd616fc793eb8f1f13ebc3
SHA5129375f3f85eda364aa1a86e8c6505fe3f9f91204f7273d076d0bfb2c2a3f9426a20a96d7dea89902d0a34e76d8d6ba0ef3fbfbce795e798ba999358cfeed2f421
-
Filesize
323KB
MD52fa4a3c220c28f1ad92e450714822c4f
SHA1fe7dbe7e6e5439127161fc188be0ac74ab41ec26
SHA2565c41d89eb050ad4ee51b40e48a08f02ec3724d9b4138340d49171dbdafeaa492
SHA51295360a327ddc65f74ffed021eb75b8f50820e097818ab9016e573d6996e6f6aa82a76e9a833b8bc75f59150f8f786130172630b3811821d92444bd6262e07384
-
Filesize
323KB
MD53178ba7728d7d86b27abef215d613ac6
SHA131958f4fb7bd7bc88e6fc22b46bbac5d7578972b
SHA256537c6f16ea836d5960528e0fc6682c148e06e73a5ea059830fe77ba4a995d01e
SHA5127e7df2bcb105e0510843f8d0317e3113044eec41ec93f37650b0d0f2819aa3c42667352b82c6cec6986383d39b62618ca67d7f274e46ebf1f6e6a24485e50368
-
Filesize
323KB
MD5751fe427aabc79688d198ffa33a03002
SHA1978482299c3a33c61c5b406faad13f996373cf6e
SHA256dc875657f9f9f86c29cc07bc0ac736e31c22fd5af8e237e334567d784967d9de
SHA512b4d65cf864dbbbb41b632e6f65e72054c2c29c7918377c4b21c42085de9bed6ce6b4194db574a5fd5177a045b5a246576581cef1887a274e219c3072258c875e
-
Filesize
323KB
MD5ec08fe4d62525304eeb2e72f36a49950
SHA181388fe464c3e495fb01dafc91037fb5aa7ce25e
SHA2563517726ff0789c509c20bd71faba489f822b1ff7abf6823b566c1f65e09aa6f6
SHA5125f3950511546f2d6813dfab97b1ff2d560842e9fdd4e2d8f9b0d5b98502248f4461fadcdf11f9d216afd4ef67744f9933a034d683b8c70b7975e92d509556fde
-
Filesize
323KB
MD564ba654c8c3ec7f258ae9d30ae7f55c0
SHA1ca8605e78f6d9803824e55d9ca8f4a8536e596f0
SHA256b9d3560dab4fec977b45b036f9c160257c1f825f8c843455ed426aef7eb1619a
SHA512cf91a98a276e8c72e75b16ca7f0ba558b240a2fd4b96699179cf7b553e751729c4f847bab393366720733d0025f802d6b31b2b6ab6eedeace9e4a5b421e10856
-
Filesize
323KB
MD5ea622f5ac87b4e2b4c5591edb8893f9f
SHA17697c7b7b270a47010d62af235977186e057ef76
SHA25673043921ae20a373e70dec9826f2c06caa657b9d2a8d053b45ac0c96f1fb082e
SHA512c7edce62f49429c5b6b82e193bbade0e40b327542d888d31877b4420cc66285695b93cb9bcdaa003a6ddc7d66c2208cfa54919688c9e707bc398be89f568468c
-
Filesize
323KB
MD52ed34d48caa740619f247a8a3e37d971
SHA111cd692c89d38cf8c458b0cdfa973901c1c12c99
SHA256d53eaa827a97cca158e13f79db15ecf10424a38dcd302a36cb1d31007de0561e
SHA5128c75f850e616a3e051b7c597677522cc3b133960e1c5751e75fd1dbef7769d2bf737617eb06a7982e7e36747403cf9d8b29dc1aa1cbe2b1b88d5924a097d3ad9
-
Filesize
323KB
MD5fb3a4035109eaeefc1a352c9bbe78e38
SHA1463add8242f4569bd43855058cbcee0ac467f99e
SHA256aa027e40611727c492601ebce736f0aafef253a8a515cc25f011549ee1961ad4
SHA512c878101fcde95af237f3ebd18b7836c83f18d235ada1adc1ba7845671589f0c39aaa47bcba04c201878bc834cbd1541e88567edb39458e50d94c7b7100c8397e
-
Filesize
323KB
MD5357f0bcf3951938f0e45eed58862185e
SHA153437483fb87dd1817540e2aa8a273ac125a1d02
SHA2560d4b1b005843ef298c2ac8d2139a55f27f00176eff2a6cb23edaebbb6ac9b7ed
SHA51277894b60ab79b46476caba8cab2909b1ecae667b6e063d5cce95140ac2260425a0cc5ac169f9b827bba77eb48fdd9f03739466e30f429ab34d56159ed9910605
-
Filesize
323KB
MD589b8cc24e015615658835eb0ef9f2508
SHA1fefce5d76999adf10e3fee29adf1ec890a6f5453
SHA256b978ed3862f836dac67a1f56b35f5382cab504356ff709cac6e220e96eabf38c
SHA512594b2cd8c024ccda78e675090ee6489735c2157a4beb7ba67ffa97b38bc008250b4ca1074294261e1046d1dd346bb8966748010ab488408694b76aaba8ea87a6
-
Filesize
323KB
MD5d333cd13da8c1d8aaa1b91338abf3864
SHA137b9d24e4b944748e10649445dd41767a47e8b56
SHA2561e18c708ecdb00685a57c590497940a2ad83adf44d2831fa0b98f8112745d338
SHA5126ee6974452ca109c9113858451b34783edf74014daba0e5e81e4c850319273ceb0f970fda0a586d4c05a2bac0672097bf30a5c01a71f1a905d51080e6d4cef44
-
Filesize
323KB
MD58705268975b1554695fad309946d4814
SHA144ac995e2d23225a26f6410922a01c2bb5fadc24
SHA25610f70b67317a1dd0db67fcd4eccb5b22c967a9b6598740e001b2ffbb50dd35ce
SHA51284f385a54d30ef394834252763876015474e2ff0d5fee8c39be648241b5c4d830a93137cb50cc023f80a2efb97d9d48f700103dea123bea40e22541aab4aafcd
-
Filesize
323KB
MD5a749badcc062064119ce83dd5ecf1744
SHA1253c411d467d8a4b8a98a6fafdaec96475331b70
SHA25699555d6877008c3247afae96253ae88109766808656ac189200db92eb8361c71
SHA512d7ac345fae018fe6c40da283710f10b0f82da42b350e1238e90cb29029c0cf4752a692cae535fc31e25787b8448a9883be01963e5c99a074ff095c9c25b40839
-
Filesize
7KB
MD5d7f9d9553c172cba8825fa161e8e9851
SHA1e45bdc6609d9d719e1cefa846f17d3d66332a3a0
SHA256cd2e513851d519098acef16d191188ac2586d2174dfd1a84f4db7f41a6970086
SHA512a03a806d9db86c0c4f6f8efc4b40008aa51f1625fc1c703a929bfa57a5caf962119b3c76044775af607d4ee1a8a671e1d0a2be66d19ee551717398f9ddc8ad24
-
Filesize
323KB
MD5e49d1b53710adb43bbdd4aa0df3a8ef3
SHA14653df127c6499ff0f1ee5e14386d7f4ffa318a0
SHA256531cb07a497f032db00fbc5de69942dbfd1c510fc572cf5d2344826463182432
SHA512117b3ebe52b2cc6ca3b5ed1c1f55f71ce343e75697835f0f740bbbfa0fa152f66ffd4ae097f1543798ed3ef495c7ac8a183bd1fc55199303985496804fe19512
-
Filesize
323KB
MD53ff97baeac9a15d328fd5de2ef73e424
SHA121c1cf808a6405a104ef9869e1e520225eb0d5e8
SHA2567ae0879c2e135d31be7aa05d8ed2e9ba028504403a6a366b2cef9894fd28a3fe
SHA512a56fbf62096963e40c30202b2e1d645bb8597d1c04cea1dc20c7edcfc898706457772b6e158053311c2ceee6b118f80c810744d23798c9bd6f86df0e0f218724
-
Filesize
323KB
MD5ee1f66c363ea75c297724f7657991525
SHA1687de3509051640d8e66b8c6499c8697fd0624d6
SHA2567c65662229d65bd5b6c32a07fe74ab59bb6f45cdd5cc2cb195f9172527f37cc3
SHA512b864282f1dc555313918df597d343837813d29dc91912f5b64b09add4be0f0951ae5e2eab115e103e5349c28489540485bd998839b052d4d16eaf68569b164aa
-
Filesize
323KB
MD5972768055134eca05290b9c260c7e978
SHA12a786091b6982eef18bffb6e5aefd892d254f976
SHA256ab6c5524e88a2cea540cbf479de5b965e4046da87dc33cb4102b98e41a25bb1f
SHA5122481ffc7960a7d38a062aea419f3b198b6809abb7869e4e1dadd269ad06148029370b44aef7190b7d1c1fb369b2b1b9dfec439b275b07e78ee49280cae13350a
-
Filesize
323KB
MD5daa4d57eb800abbb3047529d666b7d84
SHA1696d65856b40c31432deb56138cbe61ccb8e6bd1
SHA256e113f96a735ae438d9dfdb58f71942e388ff83f3cfcc34e0196d127d0f51dafd
SHA5125b15f6060aef7d774af9014a2748e90ec4c4ed3599e1bd31c3feb5f706b09c2945a784af54fd8339852d96953714ac08e1189ad93e46b533459764c1592a11c0
-
Filesize
323KB
MD51c6a0e0cb00a7e5caacc09b83410e149
SHA1a8d3aa2065c151bee5917169169c20d71eb2cc51
SHA256847ae91585a319ffec27b9edc2439f55e04ec5c7f4e33529261bdc3a09668cb6
SHA512042f63b35a919c9b51594a2a5b3443bd578fbeee1e73d8e8c6bcc73b222ab32edfb47c708738c656ecf4ad7166b5850c0ab4b14ea06b99cd8d9ace010110d1ce
-
Filesize
323KB
MD5e31666e1d58d432f1b40f5feb3927490
SHA1bc9bc015411160c68740f340854d3db37ea4ca54
SHA2566db943d27d79d2a3e6a869915e7d90d109957f47c6ffed7b3b8fb4997fa64dc3
SHA512d0110a3dad9df5ea304e533bac96be4fe1e19759a6294aa6f282ae3dde234859baafefb0fd39fea553c89778ea7e3d62c138531459fdc01d0e78ce47a7fa86d2
-
Filesize
323KB
MD5de4cd05a267d45953e29b8e43fee532a
SHA12b5e573f7bafaf551a1708cd36fdbcbdc05ea5d2
SHA256bc921d0defeeaa6d7903c06410bf965a1ae3c15d1fc4d77460fc6a76e51482c6
SHA5124411aeba1e1537346d716eb3d027c8ddc8634725f9cdf16c3ed1d5962f2c5c7344f21c1224943c87751cc17f7320a7b5e364e9507830953fedb28929bf63fda9
-
Filesize
323KB
MD54e3d322bf82613420139bdfe2b565a52
SHA1628d4f65b52a759b0c320111cd9b7d26f318f093
SHA256d827b9db0e6a1c47a9dfcad6728d125533a1dc511bcc1d9685994b9fb16ab5b1
SHA512a7592093c24fb0e9dbf896ee01cac51d4abd8f2b729f8a526e8fafa8068a2435fa585d658445be463c0b1bf3b251f5881a1dd5e7812f741dc1a533f57d6f8d02
-
Filesize
323KB
MD52c755ab6778c9150b918d0e46cce9808
SHA1cc1b223372fb14dcfc1d988ea8d2fdc9c0596305
SHA256e4243eff6d1460e629475aab7c8bff99597527b1f8cfcaae0963aca3e4f59290
SHA512b2d530aad3a4eca8b3f134910fb8a0d75116d3cd10b43d4fb9a12739589cb0412855c62065c90ad8981db7924f4525b332cd080ea26efd4dd3711327e80b1722
-
Filesize
323KB
MD54a99add8e1751d416ad75a4b6cd715c6
SHA1729debfbded07edee82d563ba1c7b92fc179ed17
SHA256c07e7d0a6fec53576ef36f11538d3f597e09946753dc6ce6ca757aaeb1960f39
SHA512bdb0af630d0682c868b049ab668ece20c5e27396389dc9a6fdec259c43951b98bf9d0444e765091df896b15a2a08f038461411714162389354c46708c0937970
-
Filesize
323KB
MD5fc31923f9e390297114bc1b48495c573
SHA11193eaf774806a66b412de94e5bfd3e2241e7493
SHA256a6d041d30be5b1b76e73edf3f1a285a0b960611de3df943e0fabcb70e71037c9
SHA51274c206c8d8a69fc3344b6df75fa4705dc0c361febbe8048396ab53fedb159b85be3117e31512973e485a4a6c8e3b1ef55ee3d2352b93e432e4b038dfa08a7c89
-
Filesize
323KB
MD5b2b4dc77a850b8c01e2efd7b6078df25
SHA17d64143bc0763997b22be1b3517577d8189c5081
SHA25630758884e0bccaf05c56d598493e41718ed0660c799dba4ace96e3ff2492c065
SHA512af0797bb400894816debfdab5abb5a225618b6da06bebd6ee12e9a283ccc6421216da2e22839e6afd03a407a0bbf04810ef5553850b3d2c02e8c951b95944190
-
Filesize
323KB
MD5ff81cb44dc72dc4fff542da3724d98d1
SHA1c80a5155a2cdc66b7458463bce49050a7e0a041f
SHA256da389ae8e8411557da8debb746fd95384f86b9b0c1b66ff67a34043164e4429a
SHA5121040f55547d25756d4337911205e838f1d300dafb8971154a54cede1498925dbee96a44efa9efb5056a899430630abd3a26d7bffbe1d32319aa9e9312da57d0f
-
Filesize
2KB
MD543be35d4fb3ebc6ca0970f05365440e3
SHA187bc28e5d9a6ab0c79a07118ca578726ce61b1bc
SHA2565a15c1aab77f132e7ce5928996919ed66564c6082a7f94d0a42229c480113fc5
SHA512b2e24ff3702805d2ff8ecf3ddde8a8e6258965f992f37104c2ed9b763e1448ab32c7609a607e1d90cfba281e7add1e839855656d6453433a42c0d6c8923c9395
-
Filesize
323KB
MD5282ff002814d7c51187a2d9d27e64636
SHA153c9e23155080aaa6fecde1d2ce3fc2b48cfdf61
SHA256dde602d69860c6a0818b8eee56e0499e05c81e55dcef944004cbedc4cf5a59f6
SHA512ee6baa196e91b2d9caa0238bb8c5607f3dc8d0a796210ae5276895e4434b34fc6c6412bc4bec70faedd88dfae1e82fc70f0790da8602fba157b77fcf079d1685
-
Filesize
323KB
MD57fd5368e2764369ec2d8797cc673063a
SHA1fb6470ced6e6482bf0274b744d830875b61853e8
SHA256b8c1dc1802f0184f1dc2e3cba41f99965a0b7b7e5f80436d86689636e79feba4
SHA512b9d125137677031a4a2819477a4b66e8ac87ee04ade0ea05aba85d53481e7f94e258379287374788fadc8e8e265fc0bbf943135f2157b774a2266e59b714a1f7
-
Filesize
323KB
MD5fe266a9e5a1ea0483c638ad5d2c631d2
SHA144ceccf2d50541c51ec28540a94e3e9dd72cb358
SHA25638453d98b3533194da8789d4b69a889bba6404d0ef735dfc1284f3e0fee0b870
SHA512e0f06e4fe2e88d30444ebf39c3c702614f471434e46209db5143632e1e94c45c1320618b2b21f57cd3cf796e21bf541803ed2fcf14cb1879fe49a25bb6e923b4
-
Filesize
3KB
MD58482935ff2fab6025b44b5a23c750480
SHA1d770c46d210c0fd302fa035a6054f5ac19f3bd13
SHA256dcbcdce04483e9d2d8a5d7779b18b7f64cfc06e758b07f671493e38dfb9ab33c
SHA51200c711d815815a88fc15f73c8cba6a81b2bfc505baff2cc67b456545151fe896029f11127e447c9bbc5a2d5dc561a06a52be9a9f9c0d28e98ea4e174cdd54398
-
Filesize
2KB
MD562b7610403ea3ac4776df9eb93bf4ba4
SHA1b4a6cd17516f8fba679f15eda654928dc44dc502
SHA256b0fd7ffb4c8f0e4566658a7284ca0652961648aaab44a53c5b9713664b122c29
SHA512fa1995a21ffe073a15fa00a3a8717492b0a67f3615abe4c7e6bce054bb23cf545e10e21cfe3625b665c8bb199577815dbeccc7c6107cdb49f673b8d53f23888d
-
Filesize
323KB
MD51ea9db9377033bf9732659990c0ce4a1
SHA19fadb703d8dcc8dacdd23f1b59bb4bf3a5a5bfad
SHA2562c182719c9e5e6f56c4a68c63633caddbd4fb2dbc2342c76d6e9bbec52140583
SHA512b3a1791a295409869893a59eb1dceeaeff1d6a6daca4f54ca16c7286bf1170d8da01bf3821ebfc8866a999305d24073ea83df4ed3f6a089e4b9ef5e35bc13332
-
Filesize
323KB
MD5ae4afac6f37c1ae1bdf455b6540b1929
SHA10509074fc27c6aa54dc1220d5c549b5e0714152a
SHA256611e2a21d51600b522602f2a50dca3fa7b7e6af00ff054f71c34fd790d6a326c
SHA512499eb0ea3f510a4a28e81be0fd30e714ff119b3e0ef39946c515e80f58b4e7bab70baa534b88c77e898ed3b83ea79396b638141a46b336d72ab7148a245f4d24