cerber | 6480fc69756f789c08636c4cc4a3a8456f9e037245f1001a8ce47be37b56ad03

Analysis

max time kernel
130s
max time network
131s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 04:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe
Size

209KB
MD5

fff2b25d6363f93276cd2f20e7e27578
SHA1

225fe2828be9b637da2d7621e9fae8f42f4ac4f8
SHA256

6480fc69756f789c08636c4cc4a3a8456f9e037245f1001a8ce47be37b56ad03
SHA512

4501f3fbdadf9cb737ed451e2f0003fbeace09b3830b2adab6a39483cdb41ae144b9ec924ded56e77ae96b1305b18cdfd262a6eb0563cfe0b8d706c651b93464
SSDEEP

6144:D/uTZqR/XgxURVls4nSYA3HK9LUGkII/3EINS:zR/XgxURVlDnmq9LgtEeS

Score

10^/10

cerber discovery evasion persistence ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.txt

Family

cerber

Ransom Note

C E R B E R R A N S O M W A R E ######################################################################### Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great! You have turned to be a part of a big community "#Cerber Ransomware". ######################################################################### !!! If you are reading this message it means the software "Cerber" has !!! been removed from your computer. !!! HTML instruction ("# DECRYPT MY FILES #.html") always contains a !!! working domain of your personal page! ######################################################################### What is encryption? ------------------- Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. ######################################################################### Everything is clear for me but what should I do? ------------------------------------------------ The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !!! Any attempts to get back your files with the third-party tools can !!! be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle, but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. ######################################################################### !!! There are several plain steps to restore your files but if you do !!! not follow them we will not be able to help you, and we will not try !!! since you have read this warning already. ######################################################################### For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: 1. decrypt all your files; 2. work with your documents; 3. view your photos and other media; 4. continue your usual and comfortable work at the computer. If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. ######################################################################### There is a list of temporary addresses to go on your personal page below: _______________________________________________________________________ | | 1. http://52uo5k3t73ypjije.0vgu64.top/AB39-FFB2-9A1B-0446-654A | | 2. http://52uo5k3t73ypjije.pap44w.top/AB39-FFB2-9A1B-0446-654A | | 3. http://52uo5k3t73ypjije.r21wmw.top/AB39-FFB2-9A1B-0446-654A | | 4. http://52uo5k3t73ypjije.y5j7e6.top/AB39-FFB2-9A1B-0446-654A | | 5. http://52uo5k3t73ypjije.onion.to/AB39-FFB2-9A1B-0446-654A |_______________________________________________________________________ ######################################################################### What should you do with these addresses? ---------------------------------------- If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): 1. take a look at the first address (in this case it is http://52uo5k3t73ypjije.0vgu64.top/AB39-FFB2-9A1B-0446-654A); 2. select it with the mouse cursor holding the left mouse button and moving the cursor to the right; 3. release the left mouse button and press the right one; 4. select "Copy" in the appeared menu; 5. run your Internet browser (if you do not know what it is run the Internet Explorer); 6. move the mouse cursor to the address bar of the browser (this is the place where the site address is written); 7. click the right mouse button in the field where the site address is written; 8. select the button "Insert" in the appeared menu; 9. then you will see the address http://52uo5k3t73ypjije.0vgu64.top/AB39-FFB2-9A1B-0446-654A appeared there; 10. press ENTER; 11. the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling. If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: 1. click the left mouse button on the first address (in this case it is http://52uo5k3t73ypjije.0vgu64.top/AB39-FFB2-9A1B-0446-654A); 2. in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address. If for some reason the site cannot be opened check the connection to the Internet. ######################################################################### Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: 1. run your Internet browser (if you do not know what it is run the Internet Explorer); 2. enter or copy the address https://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER; 3. wait for the site loading; 4. on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed; 5. run Tor Browser; 6. connect with the button "Connect" (if you use the English version); 7. a normal Internet browser window will be opened after the initialization; 8. type or copy the address ________________________________________________________ | | | http://52uo5k3t73ypjije.onion/AB39-FFB2-9A1B-0446-654A | |________________________________________________________| in this browser address bar; 9. press ENTER; 10. the site should be loaded; if for some reason the site is not loading wait for a moment and try again. If you have any problems during installation or operation of Tor Browser, please, visit https://www.youtube.com/ and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. ######################################################################### Additional information: You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. ######################################################################### Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. ######################################################################### If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. ######################################################################### Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files.

URLs

http://52uo5k3t73ypjije.0vgu64.top/AB39-FFB2-9A1B-0446-654A

http://52uo5k3t73ypjije.pap44w.top/AB39-FFB2-9A1B-0446-654A

http://52uo5k3t73ypjije.r21wmw.top/AB39-FFB2-9A1B-0446-654A

http://52uo5k3t73ypjije.y5j7e6.top/AB39-FFB2-9A1B-0446-654A

http://52uo5k3t73ypjije.onion.to/AB39-FFB2-9A1B-0446-654A

http://52uo5k3t73ypjije.onion/AB39-FFB2-9A1B-0446-654A

Extracted

Path

C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.html

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Cerber Ransomware</title> <style> a { color: #47c; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #333; font-family: "Helvetica Neue", Helvetica, "Segoe UI", Arial, freesans, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; } hr { background-color: #e7e7e7; border: 0 none; border-bottom: 1px solid #c7c7c7; height: 5px; margin: 30px 0; } li { padding: 0 0 7px 7px; } ol { padding-left: 3em; } .container { background-color: #fff; border: 1px solid #c7c7c7; margin: 40px; padding: 40px 40px 20px 40px; } .info, .tor { background-color: #efe; border: 1px solid #bda; display: block; padding: 0px 20px; } .logo { font-size: 12px; font-weight: bold; line-height: 1; margin: 0; } .upd_on { color: red; display: block; } .upd_off { display: none; float: left; } .tor { padding: 10px 0; text-align: center; } .url { margin-right: 5px; } .warning { background-color: #f5e7e7; border: 1px solid #ebccd1; color: #a44; display: block; padding: 15px 10px; text-align: center; } </style> </head> <body> <div class="container"> <h3>C E R B E R   R A N S O M W A R E</h3> <hr> Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great! You have turned to be a part of a big community "#Cerber Ransomware". <hr> If you are reading this message it means the software "Cerber" has been removed from your computer. <hr> <h3>What is encryption?</h3> Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. <hr> <h3>Everything is clear for me but what should I do?</h3> The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. Any attempts to get back your files with the third-party tools can be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle, but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. <hr> There are several plain steps to restore your files but if you do not follow them we will not be able to help you, and we will not try since you have read this warning already. <hr> For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: <ol> <li>decrypt all your files;</li> <li>work with your documents;</li> <li>view your photos and other media;</li> <li>continue your usual and comfortable work at the computer.</li> </ol> If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. <hr> <div class="info"> There is a list of temporary addresses to go on your personal page below: <ol> <li>Please wait...<a class="url" href="http://52uo5k3t73ypjije.0vgu64.top/AB39-FFB2-9A1B-0446-654A" id="url_1" target="_blank">http://52uo5k3t73ypjije.0vgu64.top/AB39-FFB2-9A1B-0446-654A</a>(<a href="#updateUrl" onClick="return updateUrl();" style="color: red;">Get a NEW address!</a>)</li> <li><a href="http://52uo5k3t73ypjije.pap44w.top/AB39-FFB2-9A1B-0446-654A" target="_blank">http://52uo5k3t73ypjije.pap44w.top/AB39-FFB2-9A1B-0446-654A</a></li> <li><a href="http://52uo5k3t73ypjije.r21wmw.top/AB39-FFB2-9A1B-0446-654A" target="_blank">http://52uo5k3t73ypjije.r21wmw.top/AB39-FFB2-9A1B-0446-654A</a></li> <li><a href="http://52uo5k3t73ypjije.y5j7e6.top/AB39-FFB2-9A1B-0446-654A" target="_blank">http://52uo5k3t73ypjije.y5j7e6.top/AB39-FFB2-9A1B-0446-654A</a></li> <li><a href="http://52uo5k3t73ypjije.onion.to/AB39-FFB2-9A1B-0446-654A" target="_blank">http://52uo5k3t73ypjije.onion.to/AB39-FFB2-9A1B-0446-654A</a></li> </ol> </div> <hr> <h3>What should you do with these addresses?</h3> If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): <ol> <li>take a look at the first address (in this case it is Please wait...<a class="url" href="http://52uo5k3t73ypjije.0vgu64.top/AB39-FFB2-9A1B-0446-654A" id="url_2" target="_blank">http://52uo5k3t73ypjije.0vgu64.top/AB39-FFB2-9A1B-0446-654A</a>);</li> <li>select it with the mouse cursor holding the left mouse button and moving the cursor to the right;</li> <li>release the left mouse button and press the right one;</li> <li>select "Copy" in the appeared menu;</li> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>move the mouse cursor to the address bar of the browser (this is the place where the site address is written);</li> <li>click the right mouse button in the field where the site address is written;</li> <li>select the button "Insert" in the appeared menu;</li> <li>then you will see the address Please wait...<a class="url" href="http://52uo5k3t73ypjije.0vgu64.top/AB39-FFB2-9A1B-0446-654A" id="url_3" target="_blank">http://52uo5k3t73ypjije.0vgu64.top/AB39-FFB2-9A1B-0446-654A</a> appeared there;</li> <li>press ENTER;</li> <li>the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: <ol> <li>click the left mouse button on the first address (in this case it is Please wait...<a class="url" href="http://52uo5k3t73ypjije.0vgu64.top/AB39-FFB2-9A1B-0446-654A" id="url_4" target="_blank">http://52uo5k3t73ypjije.0vgu64.top/AB39-FFB2-9A1B-0446-654A</a>);</li> <li>in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet. <hr> Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: <ol> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>enter or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loading;</li> <li>on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>run Tor Browser;</li> <li>connect with the button "Connect" (if you use the English version);</li> <li>a normal Internet browser window will be opened after the initialization;</li> <li>type or copy the address http://52uo5k3t73ypjije.onion/AB39-FFB2-9A1B-0446-654A in this browser address bar;</li> <li>press ENTER;</li> <li>the site should be loaded; if for some reason the site is not loading wait for a moment and try again.</li> </ol> If you have any problems during installation or operation of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=install+tor+browser+windows" target="_blank">https://www.youtube.com/</a> and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. <hr> <h3>Additional information:</h3> You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. <hr> Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. <hr> If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. <hr> Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files. </div> <script> function getXMLHttpRequest() { if (window.XMLHttpRequest) { return new window.XMLHttpRequest; } else { try { return new ActiveXObject("MSXML2.XMLHTTP.3.0"); } catch(error) { return null; } } } function getUrlContent(url, callback) { var xhttp = getXMLHttpRequest(); if (xhttp) { xhttp.onreadystatechange = function() { if (xhttp.readyState == 4) { if (xhttp.status == 200) { return callback(xhttp.responseText.replace(/[\s ]+/gm, ""), null); } else { return callback(null, true); } } }; xhttp.open("GET", url + '?_=' + new Date().getTime(), true); xhttp.send(); } else { return callback(null, true); } } function server1(address, callback) { getUrlContent("http://btc.blockr.io/api/v1/address/txs/" + address, function(result, error) { if (!error) { var tx = /"tx":"([\w]+)","time_utc":"[\w-:]+","confirmations":[\d]+,"amount":-/.exec(result); if (tx) { getUrlContent("http://btc.blockr.io/api/v1/tx/info/" + tx[1], function(result, error) { if (!error) { var address = /"vouts":\[{"address":"([\w]+)"/.exec(result); if (address) { return callback(address[1], null); } else { return callback(null, true); } } else { return callback(null, true); } }); } else { return callback(null, true); } } else { return callback(null, true); } }); } function server2(address, callback) { getUrlContent("http://api.blockcypher.com/v1/btc/main/addrs/" + address, function(result, error) { if (!error) { var tx = /"tx_hash":"([\w]+)","block_height":[\d]+,"tx_input_n":[\d-]+,"tx_output_n":-/.exec(result); if (tx) { getUrlContent("http://api.blockcypher.com/v1/btc/main/txs/" + tx[1], function(result, error) { if (!error) { var address = /"outputs":\[{"value":[\d]+,"script":"[\w]+","spent_by":"[\w]+","addresses":\["([\w]+)"/.exec(result); if (address) { return callback(address[1], null); } else { return callback(null, true); } } else { return callback(null, true); } }); } else { return callback(null, true); } } else { return callback(null, true);

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{33D7A01A-D90D-3DE7-A628-AFB91CA5B4EB}\\certreq.exe\""	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{33D7A01A-D90D-3DE7-A628-AFB91CA5B4EB}\\certreq.exe\""	certreq.exe

Contacts a large (522) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Deletes itself 1 IoCs

pid	Process
2288	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\certreq.lnk	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\certreq.lnk	certreq.exe

Executes dropped EXE 2 IoCs

pid	Process
2624	certreq.exe
2764	certreq.exe

Loads dropped DLL 6 IoCs

pid	Process
2316	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe
2316	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe
2996	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe
2624	certreq.exe
2624	certreq.exe
2764	certreq.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\certreq = "\"C:\\Users\\Admin\\AppData\\Roaming\\{33D7A01A-D90D-3DE7-A628-AFB91CA5B4EB}\\certreq.exe\""	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\certreq = "\"C:\\Users\\Admin\\AppData\\Roaming\\{33D7A01A-D90D-3DE7-A628-AFB91CA5B4EB}\\certreq.exe\""	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\certreq = "\"C:\\Users\\Admin\\AppData\\Roaming\\{33D7A01A-D90D-3DE7-A628-AFB91CA5B4EB}\\certreq.exe\""	certreq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\certreq = "\"C:\\Users\\Admin\\AppData\\Roaming\\{33D7A01A-D90D-3DE7-A628-AFB91CA5B4EB}\\certreq.exe\""	certreq.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	certreq.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp6F08.bmp"	certreq.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2316 set thread context of 2996	2316	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe	30
PID 2624 set thread context of 2764	2624	certreq.exe	37

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNote.ini	certreq.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.html	certreq.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE	certreq.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.txt	certreq.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.url	certreq.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.vbs	certreq.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BLANK.ONE	certreq.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.txt	certreq.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.url	certreq.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\PLANNERS.ONE	certreq.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BUSINESS.ONE	certreq.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ACADEMIC.ONE	certreq.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.html	certreq.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.vbs	certreq.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNote-PipelineConfig.xml	certreq.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\scorches	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe
File opened for modification	C:\Windows\scorches	certreq.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certreq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certreq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2288	cmd.exe
2676	PING.EXE
1820	cmd.exe
2244	PING.EXE

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0006000000016b86-46.dat	nsis_installer_1
behavioral1/files/0x0006000000016b86-46.dat	nsis_installer_2

Kills process with taskkill 2 IoCs

evasion

pid	Process
1784	taskkill.exe
992	taskkill.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{33D7A01A-D90D-3DE7-A628-AFB91CA5B4EB}\\certreq.exe\""	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop	certreq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{33D7A01A-D90D-3DE7-A628-AFB91CA5B4EB}\\certreq.exe\""	certreq.exe

Modifies Internet Explorer settings 1 TTPs 61 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433831799"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70be51dcef12db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{196D2CE1-7EE3-11EF-8318-F2DF7204BD4F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf60000000002000000000010660000000100002000000000b1067bf72d82921810cac6fa45310014ec58cb49d2b56001b7dfbb10d35d9e000000000e800000000200002000000041c8b712da5b1b71d4d192d56ce084f23ce8324113bce1ede0c9ad08afa082cc90000000fba3dc86a53af88d8bda3cb8d51e3588b1bfe5c66e1a91ca15a820539b059a9559d0b15644f2d5ab9319c84371ae291f1795e029e4e36b522fd5cc99405d83959ca517cdfbd141a7a72f26c71a4467e2c736e321408d1926726689435555f91daa4b9e22594edaf68f27c5ab216f2b05a76e6707b5f80c0b7ac8173e744ffa071685768878d534b4df5b402deba0645340000000a4d831009591761fd14dfb073cab37d1fbf2c3e605c4ffd13a152ced78ad04484ce7c90939cf82ab9d6777d08bcaec7f94005e285d4c47171846b95869259e2a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{197DD681-7EE3-11EF-8318-F2DF7204BD4F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000614d42b7e35a425f650b735002caca7f452c84136f34deadce11edb30077d945000000000e8000000002000020000000ee5378a24835418334c33e1786e83561c01d074a419727420f5847263813636d200000009c01c13d2f7796897ab7527f845412ff9ec3b3344cac0a2304c53a0b90f4e9df40000000ac01939d5b1652932561fbc4d8da8dcf4effc098ad99d4ca90c8a1f92d8b5345936cfb70d56977827d379cb513bd095991db32aff47c9639e02909b58809b457	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2676	PING.EXE
2244	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe
2764	certreq.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2996	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe
Token: SeDebugPrivilege	1784	taskkill.exe
Token: SeDebugPrivilege	2764	certreq.exe
Token: SeDebugPrivilege	992	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2836	iexplore.exe
2836	iexplore.exe
1992	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
2836	iexplore.exe
2836	iexplore.exe
2836	iexplore.exe
2836	iexplore.exe
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
1992	iexplore.exe
1992	iexplore.exe
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2596	IEXPLORE.EXE
2596	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2996	2316	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe	30
PID 2316 wrote to memory of 2996	2316	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe	30
PID 2316 wrote to memory of 2996	2316	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe	30
PID 2316 wrote to memory of 2996	2316	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe	30
PID 2316 wrote to memory of 2996	2316	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe	30
PID 2316 wrote to memory of 2996	2316	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe	30
PID 2316 wrote to memory of 2996	2316	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe	30
PID 2316 wrote to memory of 2996	2316	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe	30
PID 2316 wrote to memory of 2996	2316	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe	30
PID 2316 wrote to memory of 2996	2316	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe	30
PID 2316 wrote to memory of 2996	2316	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe	30
PID 2996 wrote to memory of 2624	2996	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe	31
PID 2996 wrote to memory of 2624	2996	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe	31
PID 2996 wrote to memory of 2624	2996	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe	31
PID 2996 wrote to memory of 2624	2996	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe	31
PID 2996 wrote to memory of 2288	2996	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe	32
PID 2996 wrote to memory of 2288	2996	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe	32
PID 2996 wrote to memory of 2288	2996	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe	32
PID 2996 wrote to memory of 2288	2996	fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe	32
PID 2288 wrote to memory of 1784	2288	cmd.exe	34
PID 2288 wrote to memory of 1784	2288	cmd.exe	34
PID 2288 wrote to memory of 1784	2288	cmd.exe	34
PID 2288 wrote to memory of 1784	2288	cmd.exe	34
PID 2288 wrote to memory of 2676	2288	cmd.exe	36
PID 2288 wrote to memory of 2676	2288	cmd.exe	36
PID 2288 wrote to memory of 2676	2288	cmd.exe	36
PID 2288 wrote to memory of 2676	2288	cmd.exe	36
PID 2624 wrote to memory of 2764	2624	certreq.exe	37
PID 2624 wrote to memory of 2764	2624	certreq.exe	37
PID 2624 wrote to memory of 2764	2624	certreq.exe	37
PID 2624 wrote to memory of 2764	2624	certreq.exe	37
PID 2624 wrote to memory of 2764	2624	certreq.exe	37
PID 2624 wrote to memory of 2764	2624	certreq.exe	37
PID 2624 wrote to memory of 2764	2624	certreq.exe	37
PID 2624 wrote to memory of 2764	2624	certreq.exe	37
PID 2624 wrote to memory of 2764	2624	certreq.exe	37
PID 2624 wrote to memory of 2764	2624	certreq.exe	37
PID 2624 wrote to memory of 2764	2624	certreq.exe	37
PID 2764 wrote to memory of 2836	2764	certreq.exe	40
PID 2764 wrote to memory of 2836	2764	certreq.exe	40
PID 2764 wrote to memory of 2836	2764	certreq.exe	40
PID 2764 wrote to memory of 2836	2764	certreq.exe	40
PID 2764 wrote to memory of 2832	2764	certreq.exe	41
PID 2764 wrote to memory of 2832	2764	certreq.exe	41
PID 2764 wrote to memory of 2832	2764	certreq.exe	41
PID 2764 wrote to memory of 2832	2764	certreq.exe	41
PID 2836 wrote to memory of 2148	2836	iexplore.exe	42
PID 2836 wrote to memory of 2148	2836	iexplore.exe	42
PID 2836 wrote to memory of 2148	2836	iexplore.exe	42
PID 2836 wrote to memory of 2148	2836	iexplore.exe	42
PID 2836 wrote to memory of 2612	2836	iexplore.exe	44
PID 2836 wrote to memory of 2612	2836	iexplore.exe	44
PID 2836 wrote to memory of 2612	2836	iexplore.exe	44
PID 2836 wrote to memory of 2612	2836	iexplore.exe	44
PID 1992 wrote to memory of 2596	1992	iexplore.exe	45
PID 1992 wrote to memory of 2596	1992	iexplore.exe	45
PID 1992 wrote to memory of 2596	1992	iexplore.exe	45
PID 1992 wrote to memory of 2596	1992	iexplore.exe	45
PID 2764 wrote to memory of 776	2764	certreq.exe	46
PID 2764 wrote to memory of 776	2764	certreq.exe	46
PID 2764 wrote to memory of 776	2764	certreq.exe	46
PID 2764 wrote to memory of 776	2764	certreq.exe	46
PID 2764 wrote to memory of 1820	2764	certreq.exe	48
PID 2764 wrote to memory of 1820	2764	certreq.exe	48

C:\Users\Admin\AppData\Local\Temp\fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Users\Admin\AppData\Local\Temp\fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe"
  2⤵
  - Adds policy Run key to start application
  - Drops startup file
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Users\Admin\AppData\Roaming\{33D7A01A-D90D-3DE7-A628-AFB91CA5B4EB}\certreq.exe
    "C:\Users\Admin\AppData\Roaming\{33D7A01A-D90D-3DE7-A628-AFB91CA5B4EB}\certreq.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\Users\Admin\AppData\Roaming\{33D7A01A-D90D-3DE7-A628-AFB91CA5B4EB}\certreq.exe
      "C:\Users\Admin\AppData\Roaming\{33D7A01A-D90D-3DE7-A628-AFB91CA5B4EB}\certreq.exe"
      4⤵
      Adds policy Run key to start application
      Drops startup file
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks whether UAC is enabled
      Sets desktop wallpaper using registry
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies Control Panel
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2764
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2836
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2836 CREDAT:275457 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2148
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2836 CREDAT:537601 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2612
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt
        5⤵
        
        PID:2832
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"
        5⤵
        
        PID:776
    - - C:\Windows\system32\cmd.exe
        
        /d /c taskkill /t /f /im "certreq.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{33D7A01A-D90D-3DE7-A628-AFB91CA5B4EB}\certreq.exe" > NUL
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1820
      - C:\Windows\system32\taskkill.exe
        
        taskkill /t /f /im "certreq.exe"
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:992
      - C:\Windows\system32\PING.EXE
        
        ping -n 1 127.0.0.1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2244
- - C:\Windows\SysWOW64\cmd.exe
    /d /c taskkill /t /f /im "fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe" > NUL
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2288
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /t /f /im "fff2b25d6363f93276cd2f20e7e27578_JaffaCakes118.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1784
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2676

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2596

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
1⤵
- System Location Discovery: System Language Discovery
PID:2648

C:\Windows\system32\taskeng.exe
taskeng.exe {77DEF8D3-CA34-4A7F-853F-FFC28EDBB318} S-1-5-21-3063565911-2056067323-3330884624-1000:KHBTHJFA\Admin:Interactive:[1]
1⤵
PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.html

Filesize
19KB

MD5
ee2341524e973c9535a201341584a8d7

SHA1
72451b2b3177257517776561b2f5ad735dde34a6

SHA256
8df46bf62e4baa2d59412af7bad6da04055b83c951154b984557f15da7b8ad1a

SHA512
8d074ccae7cd13cd4ab8b91e21b39ca98da1be58e9c55be6afba16f55692598c4cfc22f2eb0bb3c8ae54105e5fc8db3dbfb5ae86501c2815faad1f508357e2d4

Download Submit
C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.txt

Filesize
10KB

MD5
55a960d99cf1a40a64072ddbdef08769

SHA1
c67d4fd57850a5169d04c4d2e92a2da3a27ff560

SHA256
27676d9e9a528ddb14adf3eb934cc0f0d360e7f4e5791e872b8fdc9a87b6ead3

SHA512
672e34ec32be4cfcc1abc21301202c25f971255e3642ec76708d889a677281307b5a22265433d4784dda617464277b676ea38e3981f014c7ff843ea4ac3d8cff

Download Submit
C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.url

Filesize
90B

MD5
c4d267ba04808b4d906339cec9ec1b04

SHA1
0b9589c04926594affe979e02de52c1511728866

SHA256
eaa294a68f14fcb4af9b69be4af5053c99752251c1296fb14c595971650e0db7

SHA512
ab5803f9fbb48c822f9d49576971c4c5ed05b197c55eca8c9ac6aac4d20258250b086bad07558f7a30a1ca5492bc3654cd90b3803411d73e48ae75559ebc18a2

Download Submit
C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.vbs

Filesize
213B

MD5
1c2a24505278e661eca32666d4311ce5

SHA1
d1deb57023bbe38a33f0894b6a9a7bbffbfdeeee

SHA256
3f0dc6126cf33e7aa725df926a1b7d434eaf62a69f42e1b8ae4c110fd3572628

SHA512
ce866f2c4b96c6c7c090f4bf1708bfebdfcd58ce65a23bdc124a13402ef4941377c7e286e6156a28bd229e422685454052382f1f532545bc2edf07be4861b36c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b8bf2a520928c1d3110f596d6953988

SHA1
66c1cd307161011adfe93e887204edcfadb73d1a

SHA256
1a36738c133d883563462533ed8e2229749ef3b0ad920712e7a50e89fcd02814

SHA512
ce96211c0b86d97fa8a73ec08d087ec8aa5c419f1ecf9c8102fd4d2aa580f77c480785da33554edc19ced95432bf88d4b9b1fab3e5e5e5e7718ca7353231a015

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
618eae6ab34661477e2d6888ab72f763

SHA1
cce8ae78ac7a5caf9694b96d375769f2dcd73672

SHA256
05c5a41e8abeb5850ae9a54ddb4ba09a6f88f6b53a122d2b08d52e3fe9b5755b

SHA512
29914de53b8c123f9d3faf2b0de5f45fb443e852d7deb9a17b7ca9b58a1994480d702457097c25a32534adc5c780aa7ab4640745f7491e00aa1346448b600e7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b91ee80b421334382d435b190d68727f

SHA1
79b010729ea369382003e3be335282209de31e34

SHA256
8d673ca4e89312c43941c8fbff2af4b24a9a9db3564b4d5fdfa7b71eb5d14bdc

SHA512
4d27a12a809de437d74e1ba81fa42759eb45050352ef95280c0dfeff3119b21adc2fb8b14c8d24b16d89eedde589ac2247eaa4b66fedce64d0510f695d0a59cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d854fc18fd09536ff023e8d94ab81db

SHA1
214532fda7a8ecde038c3d5a174b8a810f9702ed

SHA256
34fe16f4e9a5defddbe60a1e9d93b1e900221523081a37b87cd3b13b54a313e1

SHA512
9fbbead4120d614fcf247f3f24c2c585f89b6a20441cc5874c1b314acc12cc068900724057dbc227404358a96e4e3f498c2847c35f42867b0daf7f1c9f84b328

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d39f0a7529629cdf94f33c2a21784c95

SHA1
ff67ed2e65d143524d6f68da9aa43bd2489ec931

SHA256
8eff7c7f72fd5dcc549d731e551bcb138f52b4552509fd3b790c8b921eaab6c1

SHA512
e3da73cf1c11250057e560031353bf7b00029f24fa007eb669fd25ac1481eed174f1bcba028ed05a3275987b92813bf3063bb9cae8c056315e77830f413e6743

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06220e5a96b71f27df2aeb6826c3fc3e

SHA1
9d144290f3dc21d37ee72493f8ffb8c72b31f4b1

SHA256
e3aa20b5d72adda0599bc1be01bdddc019577bbc6c1633735ffa6d257d3c67fc

SHA512
918ebdc4f5d271a07d7bb6ed06881861533f6e4bf5a12929d2b36c88b3f9354cd9efc352930a2c608462aceeeccde2ea1a204dbe5600ad8403b73dcb8fb101a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5b4b384ec06611791ce2271e902ea98

SHA1
43d1d67bfec4e434f490d85fd9628ec9608050ac

SHA256
5d50da758ac5bccd7f9a08e2bc702a9c3c900a8c2a2c0238e2f672f0fadc5017

SHA512
2048b809c7ce108fd51ea39094314e41e2ceab0ea38db7f7bede64d002f06150d3e0f5ef4f9bb4ad06c1964ff9db73b2545cf95d636c04751c776d4c875d1c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f9f80bac9e6fc09fccb485caaa4f1f3

SHA1
eca8ce00c47b75c97038f13bb717c32d0324bbd0

SHA256
9f006095ce6f8d8ec27d6d3ab0997106061ca82723c3ada44ed42529078c9455

SHA512
91111ddf72917bf891b976bee4374d0e203d99e1e76348810b379c8ae14b6aff3a21fb45a901ee8fdbfcc5c6358483e236d878559e3d75ded92d5f8dc80cefa0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
adc1dcaefe45420b7f271214c1a8fa94

SHA1
d7da8d3f0d318e5b7272353591a1ea89191c3a65

SHA256
9a92cec6b9b4dbb0244619d6f9f826a9cd6f532f5de7ad332527993abf9c37f5

SHA512
772fd6e2ba03bb9c36cb6d15a60a421432455699c00d8c071995a2855e98c34c01926578eabd62f9c588277959ce1bc3e598dc3b26f2a614ce02078da6e9b2e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
948ef1e606a2c0f95ad1de964bd5ccac

SHA1
2fdafffb23692a99c332217e93d9b4d95dfb28d1

SHA256
6370a74bdd237c6d08a1f3146168488f30a6f866db2a75e94b9ca324fe15e8d9

SHA512
3dac3d146f5d2db15e6d79b5a33fa8a846af94c9e6fa24eca70d193b8d04d123243b4a2d62142f914827b55ea66bc02454517aad1f215c4ca56464b73380af77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf338f76eab0c41e0c0aefac42634485

SHA1
38925db07ec1321ca7feb69a9446653c5c767987

SHA256
1613119d791908fc490d7be232a9cac46ff8f1decb2a37145f16eef585c5631d

SHA512
0b428f341d9c43e8be5feb449d5c781c5a82a638f46a5686e68f6ec89e0ed578d909aa335d9364e164cabcf6a8a214a6a8ae491d7f2e0059e10a8da21f01577c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cf3345a3cdd74461f5c703a8ac68da3

SHA1
df65ad65774870a0be25d1c9b7babb4cf90b15b0

SHA256
aca9a305e2f016fb1c22cf49b6f4ce46118e807bd1e2952abbddb16e1b867e47

SHA512
c95446f496f966d98e9f573078d0df4eef5cf04e44bdd8b89640ed22e23cef60595eb6ffe090498470c1bf2baeef0e19e9ae3b6d75c88577e867ffe894fed3c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e27313d01f0f778bf54c7d7fe4f9b087

SHA1
f490223d3c09b423b946812010297de7f4b94cf3

SHA256
6850c4c60eab5a973abbae8bf8f3d48683b6ddf06f7c96acf5350ad05d4dbcf7

SHA512
7dfdb8e4cdfa0d6dbcce72967918dbaea5e4b5e13e4200207fce134af1671896d5025a0a196f43b6138a6a11267c92e77edba864530f04ea77b76d7d50b1435b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d56e3d3c9181266cd9760c100b637ac

SHA1
d089ade1c5e48c5b67d1ead35c9d11a58b8f1dcc

SHA256
83c64d7a9c3662c0702102656a19a4ceaa618b8ab48e3888c60be0753b51849a

SHA512
1657e9e0ec598b358d5c9be509f56e55285598a320526e3512c28cad21cbfa84e65e40621bc56a15ce2eb32c3e30f6ae99192b89339e2ff1045cf3238568814a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1fd753561fbac3301b7919ebd3f37b07

SHA1
8c77af2a2fd5b977a9f25e027ab8be9e6249c91b

SHA256
91efedd0f9477231b4954f2259122c6a7da2fd5cb1bcce0fadd23b0a5e6296c3

SHA512
96835c235b2fa601297f9423bfa508dd12e48da157b31ba5ffd3b0fbab394f7c77394bf47f0290fe277f85611e17ac711da30089ca90b84f7b7472a44778a695

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
054aadf72957012dedd6729b11c2a1b3

SHA1
38d6b4b6046bdcfe9c732ea5ad3b0c2b895985db

SHA256
1c1371f82389f7de8ccdf79630e98647e0f71db5746bf8ea974c0268ab166030

SHA512
08a1b125c4e360fb11fd6e4fa47fc68e632ce855ebe748407a4a20ba6e6ca43ce81f43afc0dce079feed69c939a484118831a04fec6583ac6245ec79221340dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
221b2852f1d9d509a244fac56afa0114

SHA1
9ab331dd4da3d45cdc478d2d872404cc3111987c

SHA256
45b39700ef58ea76cf16c6c7fb49cc12a1adab7f012eb8d76ecb27e63b78b381

SHA512
abcbe291782b7925e7c40e84f6cb466fe48d58d60414c32101a37ad5a1371676cd8ccb02816593d39992d8d6344cad2d1bc4fe1cdc3e0ab2b1b6f487af778892

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdadcea87eca71ee081e36ef31db7113

SHA1
b017992594715d0906e07d20868588ef6d3a5a7d

SHA256
8c6ca6564077d29f80a2fe3b1a0ae31607f974d05536d6de0385d6046c87fc71

SHA512
c2cd501f32248d2b3a29418472ae39b8a6f0193f708125452ee1b360e7974e32d96688cf9d5c49bbd8cc4d8a2deed9bcedc3ba770edbb9ecaa411fae0db55053

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d08097379b50dbc6a8bf40396beb86f

SHA1
c1af3934474b3f4d9443bbaefffec1d1bcc916fb

SHA256
03a9bc09b685c1316ffa8a9a1cbc1e7fbe7fab4f263bee1e544e8161702d9f00

SHA512
297e70a656a52e3765396d176fa60c1f1964e44bab978fc4858d2e09416036a7c20eb4d96e13eded7ffaae67b4a87cc15eb53682bfee746dd1a81e74b3b5830f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd80a027ef2e014b7349c51784c0356a

SHA1
0a513666a5f8c66253ed9c19f231eeb56ed6502b

SHA256
f6a59fe7e2d0606c2c71e42c84e689dde0c382b7464d1c46fcd632cbc07de28d

SHA512
905e0dd3010d46fa9a0ffedd2351ca26425a08fe5a301033527183e7d10b925fc4367b835dbcca1b3f746a4cd5b6a6fd82330b907eeeb70d5167426311b2a2d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{196D2CE1-7EE3-11EF-8318-F2DF7204BD4F}.dat

Filesize
6KB

MD5
1797624e91cc74fe8137205d1cbe9a97

SHA1
6ad956a927ad8630175c982673c1194bc1a2fe4d

SHA256
502c77597d7fab4e9fdd425f46c523b330b92e9aa6785699210e2886964ae698

SHA512
0e3ad1caaa88fa0e9eb70b255a53c823cefa0d25242d17811685535f86f0665068e779ce96c4c81fc450b203fb6bf1cc03bfebe2ceeab9b1f0eb2d8a3e93a8a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Anchorage

Filesize
1KB

MD5
68796f196b22db99a53addbea06fb015

SHA1
15fd11610f51aaff87fb813deb9072aef89a968f

SHA256
db903b41e04034de2ee5271bd31960d155fdac9dcfee289687c911da5c328557

SHA512
f4628f88e26cd383ddd75b32b4b505cf216d797cd24fc795ef82cde9a28126cb0433a6d9323dc11eaf8733b6760020ca68013d434b5ae0faadd922f71138f298

Download Submit
C:\Users\Admin\AppData\Local\Temp\C_Enabled.png

Filesize
2KB

MD5
20f118b48a744553f6a5d2075ef1f114

SHA1
3905c8b23e04a589b64060b1226f29955625e127

SHA256
af3ea190ec3ae5330f2289aea799c3f7d87ebe9d57bc96d9646b8a59f24903b0

SHA512
15743ff18c5b0ffadac1fe4b4662e29e2ed81c4da7c1050b81a6e65178a868d01fbfae6c66555d6fba10005010843efecc7ff7a6896077e664794cb713bc6314

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8577.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ConflictingProcesses

Filesize
33B

MD5
1f3bc75daaf847977f7cf3529e4c48df

SHA1
f4dc15cada37c0eb4277dfb13f054c0c4e26f381

SHA256
d4368f7873c76dc461ffbcea9c96ec52db4de2e97f0c02762b78b5af1d1b4678

SHA512
01fee9822070f4413f7125e94a82794861da82f5d77dec0e3a1b6db90f605fc25f07926ef0fb4792e8e910cc90b868a89a50b16d5119084fe7c8ad8fa89df87d

Download Submit
C:\Users\Admin\AppData\Local\Temp\GIF 32 No Dither.irs

Filesize
1KB

MD5
b37db354d10a73ba88288164bb13182c

SHA1
3649f45a56cf71a0cb551315372546700cd96a0d

SHA256
9840c3e72436433614eab701e18e61f0ce0ab924a9491629463c949186dace4b

SHA512
8afe3071ba61ed20c2034c7501d8953a5a7d313bf4acc1a69f50f369296ad4e34df895c039eadf97afd543b4c4dc27e2d0532705121158ceb2a186725ba76bca

Download Submit
C:\Users\Admin\AppData\Local\Temp\PanadaCousinage.NqW

Filesize
4KB

MD5
af8d5781966c6e1986ae1f468200dc9c

SHA1
ce14ace59a7282e7ebc3b48a101712262c248dd4

SHA256
6054571883bf20eab6213eb0c41d7778e97dafe769e18624e995ece2e67794aa

SHA512
2b887d28a7bcdb4a61fc2b1bc07a195384a59a9b8cc2c4f639f2afb79b24fbacd4da61e188cd06cf6d27f3af8ff7b0119a709589bf2ea6c585316569673c0bd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar85C9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\changelog.txt

Filesize
762B

MD5
d11e598eb6c13a60f7e90199e2494fbc

SHA1
83b217b64256c18466c65b82db94915263452bf5

SHA256
7e092d72dd7f39541054e6f3c8de572ea385d49b9e1269f09cb7b98a185944f2

SHA512
9352d14c008933ee11434129191cdaec45919fad313397b73f64b8bc5dbeaef08b10a0198829c7a47ba6c944adb6a0120100caefa5aa6c4eec30e1b7a3e328a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\env.bat

Filesize
69B

MD5
0b30fdcd40962a14e305287fd65226d2

SHA1
bf274efac3559e73a27eae2b321b24796c2b2b91

SHA256
2ba947f88ea44d148e026ff20bcb43e8adb8981bb9d94b001c4a16d0fb0b98a0

SHA512
67dc3efff810a26684c0579861c3091d69b92ef84b693afc30ba7625ba5932c03463822904b6c3d89d9e214e608436f0a4c3f531e449f267dd2208e2479fb454

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\certreq.lnk

Filesize
1KB

MD5
9514273c5c6189778208280620a71fa2

SHA1
a2049d3256ee67b1b0d28fc22ba3137ecb3da9f4

SHA256
bbd16882a6d33855c82443105e04e956a48adf244e1d211d79aee192e56536fe

SHA512
b2187e83a252d9194ac8232b7b74885bb079391300567af46d30f9c7a3c57be357b450f1ea6f05f63a144f00fd2e97b3b78b46a202e5a07592033ae26d7978dd

Download Submit
\Users\Admin\AppData\Local\Temp\ProxySettings.dll

Filesize
36KB

MD5
159cd36e2bd6b1f8caba5ee02df51ed7

SHA1
7fa99130376af9ab813e66a2abc3e949b27ac7f5

SHA256
66348180266a0a8aacf6a87be7797adf9932f70ce0c5e461d02f7f4477940009

SHA512
835f6b146edfd1b51672b3e5815cb0274a8323cf17a59236a2b838a4f3464cd774f1e57a6bb01f5e52ef75ea5fe0ccd1b41e0d351029abac7adf6ccbf8183c41

Download Submit
\Users\Admin\AppData\Local\Temp\nsj7DE9.tmp\System.dll

Filesize
11KB

MD5
6f5257c0b8c0ef4d440f4f4fce85fb1b

SHA1
b6ac111dfb0d1fc75ad09c56bde7830232395785

SHA256
b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1

SHA512
a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8

Download Submit
\Users\Admin\AppData\Roaming\{33D7A01A-D90D-3DE7-A628-AFB91CA5B4EB}\certreq.exe

Filesize
209KB

MD5
fff2b25d6363f93276cd2f20e7e27578

SHA1
225fe2828be9b637da2d7621e9fae8f42f4ac4f8

SHA256
6480fc69756f789c08636c4cc4a3a8456f9e037245f1001a8ce47be37b56ad03

SHA512
4501f3fbdadf9cb737ed451e2f0003fbeace09b3830b2adab6a39483cdb41ae144b9ec924ded56e77ae96b1305b18cdfd262a6eb0563cfe0b8d706c651b93464

Download Submit
memory/2316-21-0x00000000003E0000-0x00000000003E9000-memory.dmp

Filesize
36KB

Download
memory/2624-90-0x0000000000340000-0x0000000000349000-memory.dmp

Filesize
36KB

Download
memory/2764-536-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2764-531-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2764-116-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2764-117-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2764-115-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2764-113-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2764-112-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2764-110-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download
memory/2764-108-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2764-107-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2996-42-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2996-41-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2996-39-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2996-25-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2996-27-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2996-31-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2996-33-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2996-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2996-37-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2996-29-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2996-23-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2996-55-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download