maze | 4080402553e9a86e954c1d9b7d0bb059786f52aba4a179a5d00e219500c8f43d

General

Target

f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
Size

777KB
MD5

f5ecda7dd8bb1c514f93c09cea8ae00d
SHA1

f5e03c44b584367241cbd2152fbd99fcc9ccd43f
SHA256

4080402553e9a86e954c1d9b7d0bb059786f52aba4a179a5d00e219500c8f43d
SHA512

6ba2928825cced798d61cd1880525cbed4aeb79b04b4ec050e9657dfe06a95c7df3dc663dfc0f71c306af05a1dce1c764a27c4e0662719a7ba1f370af3aeb7d9
SSDEEP

12288:v4wMnyVrf59Kyh+exQk0wc5xQZkosR8uMS19dLz6f:v4dWmyh+jk1cHQZauxS19dLz6f

Score

10^/10

maze credential_access defense_evasion discovery execution impact ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\$Recycle.Bin\DECRYPT-FILES.txt

Family

maze

Ransom Note

Attention! ---------------------------- | What happened? ---------------------------- All your files, documents, photos, databases, and other important data are safely encrypted with reliable algorithms. You cannot access the files right now. But do not worry. You have a chance! It is easy to recover in a few steps. ---------------------------- | How to get my files back? ---------------------------- The only method to restore your files is to purchase a unique for you private key which is securely stored on our servers. To contact us and purchase the key you have to visit our website in a hidden TOR network. There are general 2 ways to reach us: 1) [Recommended] Using hidden TOR network. a) Download a special TOR browser: https://www.torproject.org/ b) Install the TOR Browser. c) Open the TOR Browser. d) Open our website in the TOR browser: http://aoacugmutagkwctu.onion/86d4096bfc4623b5 e) Follow the instructions on this page. 2) If you have any problems connecting or using TOR network a) Open our website: https://mazedecrypt.top/86d4096bfc4623b5 b) Follow the instructions on this page. Warning: the second (2) method can be blocked in some countries. That is why the first (1) method is recommended to use. On this page, you will see instructions on how to make a free decryption test and how to pay. Also it has a live chat with our operators and support team. ---------------------------- | What about guarantees? ---------------------------- We understand your stress and worry. So you have a FREE opportunity to test a service by instantly decrypting for free three files on your computer! If you have any problems our friendly support team is always here to assist you in a live chat! ------------------------------------------------------------------------------- THIS IS A SPECIAL BLOCK WITH A PERSONAL AND CONFIDENTIAL INFORMATION! DO NOT TOUCH IT WE NEED IT TO IDENTIFY AND AUTHORIZE YOU ---BEGIN MAZE KEY--- 1AeIRZpyA4/GyPETjW8t7I7V5ZdaePA3e44jwX5CcDFy2iwmvcaxdJY8gga3QD1GaNLrN80hmg+MhQ8IPVsyibWu0t2I1BvlKREPRi+8Nu9o0NWB4Wukj8dlvR1X/EH9UuBd/gSHs+Q59dhNEhQxxCVME5dPQs8bd2sbCpfrAHN2rlaUgtACaHLNBH3jjteQkgxZFxO+97uMB8iideCbFUyjv4KmW/VE8ruQFyza1iVSriyGGF5V6S/bBLgznYD8FyH0glzm9n8KKZAoQ9FGP2U1SjdpeEt8FWhkGVEhxfzlbepwP6Ydrmw0grAcyqyi3SaXvHYaCP2sdBkxG8S9Wiw++y8ppHTIRRII/gHqQ3Zzy6LG9twFTpNnWxPErgwIPPF4OwtVLBZLzHAcwW8RFUdZqYWIrp14h8fI6pYmBAYkwewP1EvmJvQ37nLD/iGO9ZpxdTB0YJLkWB1jPYEQ1NnXQmtv2g5yhgRnFUENSEIgu6DaQ4L0ZAyenn0texyILGKHg88a+7QT3r6hFF2aHRHDpEiPNe5wCno6B6wOmh/TRTpimBS1i2XlgQ4B+cVSWP/vY2AdYygt1cur8byyhapCJTt6VV9r2W6bVN/G5LZGMhPdg1k/shlyZf1TGWnEjqwtMXNXPL6dm2Pv6XQs9p3UZTpPhfJB02ISdHC6+TGrvHVGBZmxZlveWyBiwun8IA/hyhGphyKdQjEyp6mXVWRgP3vH3Gjk7AjJIRF78y6U4rBbIRqhqEm2T2bG2eMcqbdTNkEzf2mOSgzzXHj/jfY/C48DSAd1xLhbGG6lzh/yod66Cxnogoc248X4Tqqv/h+nXGtst3tdE8ckGrt6drOEpOVUgOFo6X49zOj2s9uyYg4JToUO+isoFzbiQP3I4vDBxREZtbHwFnt5pZBvjA5GW5D1rtkXu64ShHOSzkRUXDeVhHItaH/iXunsrCEkx6YmJ0LRhE5KbN/eQm8RS6z1KoOlG4aOvIjIvhJ6eKaMhP8J1/Sm6Kdy2pA1jpDgjogg4yJ7Zf2x/tbWDXzKBWNqeTQ9RuyqTBKXvXjtCF94bNBtlE+let+CErH5poVqPrQiFVTMEKU3aTParPE78LBwBUc1ZTJp2QTM+13vAorLW7ccz+Df0Dcr6rRfpZdcLTn3dsROr0SBUUkPX2gXokaXnTLWjlrt91S3PRotq7gzDBRmQ0U92+6v549AxrthtcqP8SSjO7U7YijhgzsHHqutUf4Zwr02uA5lRC656ZC2m6Ua3qRBjVMd76ckie9KpZA05KMtfhkqsObDCjc2Dn5C7nLPh9u1V8bNK7/V7eEbhYtvTWRpfEz7w9uvDb3F/a1YxyKR5dZdo352LV4nNo08U2gXQS/6Alc/uhS1g9wFo6BhtmUg7KfFSffTGu8eYj0MGPgBLo8wPwom7E0QG9hLtyrhY1X+WSg51OZATX01MsdmIyh5UcbJyFQEbAhHrhlisbVPVLTXg3gkjcvLeFQ2VGWhO0zL9wOAJgkVYDJlFhSYZC3yCCvJyh8lTURUX0Ib9m3I0ATedDyL7dZUEwKqeeQYrovS+ovimJG/nJ/VldVfRKFM+Ek0yCrkuwkgEzdYLRVVtK0MbA/Yr2FBHYdltosLszFBuRFa+gZldq4Xt0d2Ju5iihC2Js6GvULV1ZuCwudh69+hcOxpBaLePRT345uHReFFCZ+wkkPykSraHFV0yVIqEMgLr1mQUhQKNowhLvqNVlTDENsuZF/2rQaY3pTmqG0sWnT8qlF71TikwJmphuSFqGswu6K+V1rlGV3h8CLDL71OO1AZKEHRbYO/wnCGErmEFn36lbfleit7hkXC9DqV6WQZsnIb82CuuYqDPuGNX2x6YCdPbLqbNYZvQMLJcw6+rREA/iTcRWKE6Up880AfZDM+n68GOJIBVHf9QSjAvXA801r2oNVbTvEKztd9Hpl15ZiZJ74CvZ4HsNAjp/E9knRfkmHIE6R4PrK5TViiqG1megG2WwgZyuACt7LI66F5t0QNuF2Kjd98SRH72vDFD+1HARgqxmCPt9jLOY6PUq7eCV9I8Tt0QB3ENnYfa/P50DH06pMH8oasvhA6/FEYnNCFVTqh5Snp/m4RgefYPvb/Jw2NROPO7qNUsCm/GkbxVWP/RZEE6gXgfS5127mRftuR7vaxyFF6DqYPeti45XONn6ABgvIyaQpIk7tQxddWp861NaZbENq62DTxMlAMJgFCDzSFRB9R1N1DMwoiOAA2AGQANAAwADkANgBiAGYAYwA0ADYAMgAzAGIANQAAABCAYBoMQQBkAG0AaQBuAAAAIhJPAEEAUgBEAEgARwBEAE4AAAAqDG4AbwBuAGUAfAAAADIsVwBpAG4AZABvAHcAcwAgADEAMAAgAEUAbgB0AGUAcgBwAHIAaQBzAGUAAABCVnwAQwBfAEYAXwAyADAANAA3ADkALwAyADQAMQAzADYAMQB8AEQAXwBVAF8AMAAvADAAfABGAF8ARgBfADIAMAA0ADIAMQAvADIAMAA0ADcAOQB8AAAASABQQFiJCGCJCGiJCHCh8d5yeBCAAQGKAQUyLjEuMQ== ---END MAZE KEY---

URLs

http://aoacugmutagkwctu.onion/86d4096bfc4623b5

https://mazedecrypt.top/86d4096bfc4623b5

Signatures

Maze
Ransomware family also known as ChaCha.
trojan ransomware maze
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 4 IoCs

Processes:

f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\86d4096bfc4623b5.tmp	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\86d4096bfc4623b5.tmp	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\000.bmp"	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe

Drops file in Program Files directory 35 IoCs

Processes:

f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Program Files\ReadStart.hta	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\RenameFind.php	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\UnregisterCopy.dot	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\FormatCompress.m4a	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\MountMeasure.cab	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\EditOpen.edrwx	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\RepairOpen.pot	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\SuspendConvertTo.mp3	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\CompareStep.wav	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\DisconnectUnregister.snd	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WriteDebug.crw	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WriteWatch.html	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\MergeSubmit.mpeg	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\PingDisable.scf	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\ResetConvertTo.MOD	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\ClearEnable.odp	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\CopyNew.pptm	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\AssertUnlock.dib	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\CompareStop.vsw	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\EnableDebug.eps	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\FormatWait.xsl	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\ImportWrite.htm	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\RemoveGroup.ttf	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File created	C:\Program Files\DECRYPT-FILES.txt	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\ApproveMount.jpeg	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\86d4096bfc4623b5.tmp	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\ResetDeny.ADT	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\UpdateUnblock.ogg	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\MeasureAdd.avi	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\ReadHide.vstm	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File created	C:\Program Files (x86)\DECRYPT-FILES.txt	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\86d4096bfc4623b5.tmp	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\CompleteCheckpoint.ttc	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\DismountEnable.cfg	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
File opened for modification	C:\Program Files\RenameUnprotect.m3u	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe

pid process

3812 f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
3812 f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe

pid	process
3812	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
3812	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

Processes:

vssvc.exewmic.exeAUDIODG.EXE

description	pid	process
Token: SeBackupPrivilege	4304	vssvc.exe
Token: SeRestorePrivilege	4304	vssvc.exe
Token: SeAuditPrivilege	4304	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2360	wmic.exe
Token: SeSecurityPrivilege	2360	wmic.exe
Token: SeTakeOwnershipPrivilege	2360	wmic.exe
Token: SeLoadDriverPrivilege	2360	wmic.exe
Token: SeSystemProfilePrivilege	2360	wmic.exe
Token: SeSystemtimePrivilege	2360	wmic.exe
Token: SeProfSingleProcessPrivilege	2360	wmic.exe
Token: SeIncBasePriorityPrivilege	2360	wmic.exe
Token: SeCreatePagefilePrivilege	2360	wmic.exe
Token: SeBackupPrivilege	2360	wmic.exe
Token: SeRestorePrivilege	2360	wmic.exe
Token: SeShutdownPrivilege	2360	wmic.exe
Token: SeDebugPrivilege	2360	wmic.exe
Token: SeSystemEnvironmentPrivilege	2360	wmic.exe
Token: SeRemoteShutdownPrivilege	2360	wmic.exe
Token: SeUndockPrivilege	2360	wmic.exe
Token: SeManageVolumePrivilege	2360	wmic.exe
Token: 33	2360	wmic.exe
Token: 34	2360	wmic.exe
Token: 35	2360	wmic.exe
Token: 36	2360	wmic.exe
Token: SeIncreaseQuotaPrivilege	2360	wmic.exe
Token: SeSecurityPrivilege	2360	wmic.exe
Token: SeTakeOwnershipPrivilege	2360	wmic.exe
Token: SeLoadDriverPrivilege	2360	wmic.exe
Token: SeSystemProfilePrivilege	2360	wmic.exe
Token: SeSystemtimePrivilege	2360	wmic.exe
Token: SeProfSingleProcessPrivilege	2360	wmic.exe
Token: SeIncBasePriorityPrivilege	2360	wmic.exe
Token: SeCreatePagefilePrivilege	2360	wmic.exe
Token: SeBackupPrivilege	2360	wmic.exe
Token: SeRestorePrivilege	2360	wmic.exe
Token: SeShutdownPrivilege	2360	wmic.exe
Token: SeDebugPrivilege	2360	wmic.exe
Token: SeSystemEnvironmentPrivilege	2360	wmic.exe
Token: SeRemoteShutdownPrivilege	2360	wmic.exe
Token: SeUndockPrivilege	2360	wmic.exe
Token: SeManageVolumePrivilege	2360	wmic.exe
Token: 33	2360	wmic.exe
Token: 34	2360	wmic.exe
Token: 35	2360	wmic.exe
Token: 36	2360	wmic.exe
Token: 33	1680	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1680	AUDIODG.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe

description	pid	process	target process
PID 3812 wrote to memory of 2360	3812	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe	wmic.exe
PID 3812 wrote to memory of 2360	3812	f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe	wmic.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5ecda7dd8bb1c514f93c09cea8ae00d_JaffaCakes118.exe"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Windows\system32\wbem\wmic.exe
  "C:\n\qec\..\..\Windows\ub\..\system32\yjj\aj\..\..\wbem\foec\pw\l\..\..\..\wmic.exe" shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2360

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4304

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x410 0x504
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1

T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Credentials from Password Stores

2

T1555

Credentials from Web Browsers

1

T1555.003

Windows Credential Manager

1

T1555.004

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Inhibit System Recovery

1

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\DECRYPT-FILES.txt

Filesize
9KB

MD5
72b096e157f214b746180b946acd67e5

SHA1
d4fca9ed5435da7629a0bdfea187905d32009453

SHA256
28d19936f4f0defc509d3edd31f1e4559dc1d7e860d658dedb1f1bbfa5f81fa8

SHA512
f2c15e70916f92ce24310afce435e456ae62a723f5d61cbb2f224c5575df5dad8dcac5e2776ab02203498f5efd9be0dc389b20dbf9fd05cbb97fb54a6c356d63

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_F50B5EA05CEC48C6B7612754C4069F23.dat

Filesize
940B

MD5
9e2d08370ab323900e3c693f8d5518f4

SHA1
8d1880e4d2207a80cdf2dc5b25e8f743da00be57

SHA256
3718f2cbdb33b2fa43b7db512fd49e66d57355d976d7677ffd3d2c55fad9137f

SHA512
2091a54656d118531dd11f1311b8ab375aa19ea9ae68e85d90a1032fb912591050b9cc32a8e2b2c00f9c444b3e8f8fd9c02f6d2d860ed8b48e88529bbcf1d80c

Download Submit
memory/3812-0-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/3812-1-0x0000000002130000-0x00000000021B7000-memory.dmp

Filesize
540KB

Download
memory/3812-2-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/3812-3-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/3812-5-0x0000000002130000-0x00000000021B7000-memory.dmp

Filesize
540KB

Download
memory/3812-6-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/3812-850-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/3812-856-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads