7b0deff51daba0c2967e71799ad43f2b7a53c36703051eb8e95bbe06df85c450

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2024 00:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03cae9ca903d0d948fd144ba9315a1a8_JaffaCakes118.exe
Size

207KB
MD5

03cae9ca903d0d948fd144ba9315a1a8
SHA1

c3929908918990100f1930c36509b37219aa1b85
SHA256

7b0deff51daba0c2967e71799ad43f2b7a53c36703051eb8e95bbe06df85c450
SHA512

385691a678941ad3bd116cb80d79c7daf55c36a097ed019392fceb2e884de7178d1a1eb2e5631b45fb5d3689c3a8056914541eed810d211c69780cb46d02e424
SSDEEP

3072:iNu9h3eiLZT2UTOyU2qTq/yecrqyEIlyny4iio1t1oBM9/AC99kLNh11GJ+UEtEj:lh3eeTXFUnq/yesLEoynn7BMJSXtt34

Score

10^/10

discovery evasion

Malware Config

Signatures

Modifies security service 2 TTPs 22 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe

Executes dropped EXE 10 IoCs

pid	Process
2216	Tilecomgm.com
1288	Tilecomgm.com
2256	Tilecomgm.com
2172	Tilecomgm.com
4460	Tilecomgm.com
2480	Tilecomgm.com
3152	Tilecomgm.com
1620	Tilecomgm.com
1176	Tilecomgm.com
2288	Tilecomgm.com

Drops file in System32 directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Tilecomgm.com	03cae9ca903d0d948fd144ba9315a1a8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File opened for modification	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File opened for modification	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File created	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File opened for modification	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File created	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File opened for modification	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File created	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File opened for modification	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File opened for modification	C:\Windows\SysWOW64\Tilecomgm.com	03cae9ca903d0d948fd144ba9315a1a8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File created	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File created	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File created	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File opened for modification	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File opened for modification	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File created	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File opened for modification	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File created	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File opened for modification	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com
File opened for modification	C:\Windows\SysWOW64\Tilecomgm.com	Tilecomgm.com

System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tilecomgm.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tilecomgm.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tilecomgm.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	03cae9ca903d0d948fd144ba9315a1a8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tilecomgm.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tilecomgm.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tilecomgm.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tilecomgm.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tilecomgm.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tilecomgm.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tilecomgm.com

Modifies registry class 33 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	03cae9ca903d0d948fd144ba9315a1a8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	Tilecomgm.com
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	03cae9ca903d0d948fd144ba9315a1a8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	Tilecomgm.com
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	Tilecomgm.com
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	Tilecomgm.com
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	Tilecomgm.com
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	03cae9ca903d0d948fd144ba9315a1a8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	Tilecomgm.com
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	Tilecomgm.com
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	Tilecomgm.com
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	Tilecomgm.com
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	Tilecomgm.com
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	Tilecomgm.com

Runs .reg file with regedit 11 IoCs

pid	Process
2488	regedit.exe
2904	regedit.exe
2500	regedit.exe
1100	regedit.exe
2804	regedit.exe
416	regedit.exe
1856	regedit.exe
3476	regedit.exe
4988	regedit.exe
2944	regedit.exe
2788	regedit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 2916	4952	03cae9ca903d0d948fd144ba9315a1a8_JaffaCakes118.exe	82
PID 4952 wrote to memory of 2916	4952	03cae9ca903d0d948fd144ba9315a1a8_JaffaCakes118.exe	82
PID 4952 wrote to memory of 2916	4952	03cae9ca903d0d948fd144ba9315a1a8_JaffaCakes118.exe	82
PID 2916 wrote to memory of 2788	2916	cmd.exe	83
PID 2916 wrote to memory of 2788	2916	cmd.exe	83
PID 2916 wrote to memory of 2788	2916	cmd.exe	83
PID 4952 wrote to memory of 2216	4952	03cae9ca903d0d948fd144ba9315a1a8_JaffaCakes118.exe	84
PID 4952 wrote to memory of 2216	4952	03cae9ca903d0d948fd144ba9315a1a8_JaffaCakes118.exe	84
PID 4952 wrote to memory of 2216	4952	03cae9ca903d0d948fd144ba9315a1a8_JaffaCakes118.exe	84
PID 2216 wrote to memory of 5004	2216	Tilecomgm.com	85
PID 2216 wrote to memory of 5004	2216	Tilecomgm.com	85
PID 2216 wrote to memory of 5004	2216	Tilecomgm.com	85
PID 5004 wrote to memory of 2804	5004	cmd.exe	86
PID 5004 wrote to memory of 2804	5004	cmd.exe	86
PID 5004 wrote to memory of 2804	5004	cmd.exe	86
PID 2216 wrote to memory of 1288	2216	Tilecomgm.com	92
PID 2216 wrote to memory of 1288	2216	Tilecomgm.com	92
PID 2216 wrote to memory of 1288	2216	Tilecomgm.com	92
PID 1288 wrote to memory of 636	1288	Tilecomgm.com	93
PID 1288 wrote to memory of 636	1288	Tilecomgm.com	93
PID 1288 wrote to memory of 636	1288	Tilecomgm.com	93
PID 636 wrote to memory of 416	636	cmd.exe	94
PID 636 wrote to memory of 416	636	cmd.exe	94
PID 636 wrote to memory of 416	636	cmd.exe	94
PID 1288 wrote to memory of 2256	1288	Tilecomgm.com	98
PID 1288 wrote to memory of 2256	1288	Tilecomgm.com	98
PID 1288 wrote to memory of 2256	1288	Tilecomgm.com	98
PID 2256 wrote to memory of 928	2256	Tilecomgm.com	99
PID 2256 wrote to memory of 928	2256	Tilecomgm.com	99
PID 2256 wrote to memory of 928	2256	Tilecomgm.com	99
PID 928 wrote to memory of 1856	928	cmd.exe	100
PID 928 wrote to memory of 1856	928	cmd.exe	100
PID 928 wrote to memory of 1856	928	cmd.exe	100
PID 2256 wrote to memory of 2172	2256	Tilecomgm.com	102
PID 2256 wrote to memory of 2172	2256	Tilecomgm.com	102
PID 2256 wrote to memory of 2172	2256	Tilecomgm.com	102
PID 2172 wrote to memory of 3932	2172	Tilecomgm.com	103
PID 2172 wrote to memory of 3932	2172	Tilecomgm.com	103
PID 2172 wrote to memory of 3932	2172	Tilecomgm.com	103
PID 3932 wrote to memory of 3476	3932	cmd.exe	104
PID 3932 wrote to memory of 3476	3932	cmd.exe	104
PID 3932 wrote to memory of 3476	3932	cmd.exe	104
PID 2172 wrote to memory of 4460	2172	Tilecomgm.com	105
PID 2172 wrote to memory of 4460	2172	Tilecomgm.com	105
PID 2172 wrote to memory of 4460	2172	Tilecomgm.com	105
PID 4460 wrote to memory of 2592	4460	Tilecomgm.com	106
PID 4460 wrote to memory of 2592	4460	Tilecomgm.com	106
PID 4460 wrote to memory of 2592	4460	Tilecomgm.com	106
PID 2592 wrote to memory of 2488	2592	cmd.exe	107
PID 2592 wrote to memory of 2488	2592	cmd.exe	107
PID 2592 wrote to memory of 2488	2592	cmd.exe	107
PID 4460 wrote to memory of 2480	4460	Tilecomgm.com	108
PID 4460 wrote to memory of 2480	4460	Tilecomgm.com	108
PID 4460 wrote to memory of 2480	4460	Tilecomgm.com	108
PID 2480 wrote to memory of 1148	2480	Tilecomgm.com	109
PID 2480 wrote to memory of 1148	2480	Tilecomgm.com	109
PID 2480 wrote to memory of 1148	2480	Tilecomgm.com	109
PID 1148 wrote to memory of 4988	1148	cmd.exe	110
PID 1148 wrote to memory of 4988	1148	cmd.exe	110
PID 1148 wrote to memory of 4988	1148	cmd.exe	110
PID 2480 wrote to memory of 3152	2480	Tilecomgm.com	111
PID 2480 wrote to memory of 3152	2480	Tilecomgm.com	111
PID 2480 wrote to memory of 3152	2480	Tilecomgm.com	111
PID 3152 wrote to memory of 2868	3152	Tilecomgm.com	112

C:\Users\Admin\AppData\Local\Temp\03cae9ca903d0d948fd144ba9315a1a8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03cae9ca903d0d948fd144ba9315a1a8_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\AcD.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\SysWOW64\regedit.exe
    REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
    3⤵
    - Modifies security service
    - System Location Discovery: System Language Discovery
    - Runs .reg file with regedit
    PID:2788
- C:\Windows\SysWOW64\Tilecomgm.com
  C:\Windows\system32\Tilecomgm.com 1204 "C:\Users\Admin\AppData\Local\Temp\03cae9ca903d0d948fd144ba9315a1a8_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\AcD.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5004
  - - C:\Windows\SysWOW64\regedit.exe
      REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
      4⤵
      Modifies security service
      System Location Discovery: System Language Discovery
      Runs .reg file with regedit
      PID:2804
- - C:\Windows\SysWOW64\Tilecomgm.com
    C:\Windows\system32\Tilecomgm.com 1212 "C:\Windows\SysWOW64\Tilecomgm.com"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\AcD.bat
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:636
    - - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        5⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:416
  - - C:\Windows\SysWOW64\Tilecomgm.com
      C:\Windows\system32\Tilecomgm.com 1180 "C:\Windows\SysWOW64\Tilecomgm.com"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2256
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\AcD.bat
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:928
      - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        6⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:1856
    - - C:\Windows\SysWOW64\Tilecomgm.com
        
        C:\Windows\system32\Tilecomgm.com 1176 "C:\Windows\SysWOW64\Tilecomgm.com"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2172
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\AcD.bat
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3932
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        7⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:3476
      - C:\Windows\SysWOW64\Tilecomgm.com
        
        C:\Windows\system32\Tilecomgm.com 1184 "C:\Windows\SysWOW64\Tilecomgm.com"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4460
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\AcD.bat
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        8⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:2488
        
        C:\Windows\SysWOW64\Tilecomgm.com
        
        C:\Windows\system32\Tilecomgm.com 1188 "C:\Windows\SysWOW64\Tilecomgm.com"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\AcD.bat
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1148
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        9⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:4988
        
        C:\Windows\SysWOW64\Tilecomgm.com
        
        C:\Windows\system32\Tilecomgm.com 1196 "C:\Windows\SysWOW64\Tilecomgm.com"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3152
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\AcD.bat
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2868
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        10⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:2904
        
        C:\Windows\SysWOW64\Tilecomgm.com
        
        C:\Windows\system32\Tilecomgm.com 1192 "C:\Windows\SysWOW64\Tilecomgm.com"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\AcD.bat
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4040
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        11⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:2944
        
        C:\Windows\SysWOW64\Tilecomgm.com
        
        C:\Windows\system32\Tilecomgm.com 1200 "C:\Windows\SysWOW64\Tilecomgm.com"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1176
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\AcD.bat
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:3116
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        12⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:2500
        
        C:\Windows\SysWOW64\Tilecomgm.com
        
        C:\Windows\system32\Tilecomgm.com 1208 "C:\Windows\SysWOW64\Tilecomgm.com"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\AcD.bat
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:396
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        13⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:1100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
298B

MD5
4117e5a9c995bab9cd3bce3fc2b99a46

SHA1
80144ccbad81c2efb1df64e13d3d5f59ca4486da

SHA256
37b58c2d66ab2f896316ee0cdba30dcc9aac15a51995b8ba6c143c8ba34bf292

SHA512
bdb721bd3dea641a9b1f26b46311c05199de01c6b0d7ea2b973aa71a4f796b292a6964ddef32ba9dfc4a545768943d105f110c5d60716e0ff6f82914affb507c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
2KB

MD5
5575ef034e791d4d3b09da6c0c4ee764

SHA1
50a0851ddf4b0c4014ad91f976e953baffe30951

SHA256
9697ec584ef188873daa789eb779bb95dd3efa2c4c98a55dffa30cac4d156c14

SHA512
ecf52614d3a16d8e558751c799fde925650ef3e6d254d172217e1b0ed76a983d45b74688616d3e3432a16cec98b986b17eaecd319a18df9a67e4d47f17380756

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
2KB

MD5
b79d7c7385eb2936ecd5681762227a9b

SHA1
c2a21fb49bd3cc8be9baac1bf6f6389453ad785d

SHA256
fd1be29f1f4b9fc4a8d9b583c4d2114f17c062998c833b2085960ac02ef82019

SHA512
7ea049afca363ff483f57b9fff1e213006d689eb4406cefe7f1e096c46b41e7908f1e4d69e1411ae56eb1c4e19489c9322176ffdd8ea2f1c37213eb51f03ef5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
2KB

MD5
f5fa5178657d29a36c5dc4ac9445cbdc

SHA1
4be1a87a89715d24d52b23c59006f9cb74437ba0

SHA256
f5df5a0913b98b4c5ef35c76ba8c7601adb2698300bef0a47f23845a95942114

SHA512
54272b6eaead06588ac6605a5d995c928f2270c2bccb18891f83dc5cae98eb2c88a98b49bd553f6305659cbf51c36842840dd98fa0b44a3b693de8c7af1f6b6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
831afd728dd974045c0654510071d405

SHA1
9484f4ee8e9eef0956553a59cfbcbe99a8822026

SHA256
03223eaae4ac389215cb8a9cb4e4d5a70b67f791f90e57b8efd3f975f5cf6af2

SHA512
ab7ac4d6d45b8aac5f82432468d40bd2b5bfae6d93006732ce27a6513fd3e7ddc94c029051092bf8b6f5649688c0f6600dbd88968732fc7b779e916e6bcda5c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
6b0182442d6e09100c34904ae6d8ee0c

SHA1
6255e65587505629521ea048a4e40cc48b512f2c

SHA256
cb34af7065e6c95f33fee397991045dae5dfae9d510660e6981ee6263542f9a4

SHA512
64395a0c6fce50a64a2067522b798f9b27c577da96e8d68f830a075ba833f1d644af27a9c6fc941ebb3d79999ac31576763378c9997a5b38eb5fdf075918eb46

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
3637baf389a0d79b412adb2a7f1b7d09

SHA1
f4b011a72f59cf98a325f12b7e40ddd0548ccc16

SHA256
835336f5d468ac1d8361f9afbc8e69ff1538c51b0b619d641b4b41dcfaa39cba

SHA512
ea71a49c3673e9ce4f92d0f38441b3bc5b3b9ef6649caa21972648e34b6cec8694fa8fb7fc0ddad1e58f0464e0ba917c4500090a3db3fc07e1d258079c1c2506

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
5002319f56002f8d7ceacecf8672ce25

SHA1
3b26b6801be4768cc7582e29bc93facdf2a74be3

SHA256
f23f4854d17525744e8028db6dde6eb7d5d664b0ee1b08870c9c01b639e0124c

SHA512
8eae0fabc7f5a7e452abacf988a3632874c556af409da5e60c5e529524732b40f22d4e1d860ccceae87642875c819fc8a8120eceaabd25861f920c8c066a9aef

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
a437192517c26d96c8cee8d5a27dd560

SHA1
f665a3e5e5c141e4527509dffd30b0320aa8df6f

SHA256
d0ec3ddd0503ee6ddae52c33b6c0b8780c73b8f27ca3aadc073f7fa512702e23

SHA512
f9538163b6c41ff5419cb12a9c103c0da5afbfe6237317985d45ff243c4f15ee89a86eab2b4d02cbda1a14596d2f24d3d1cdf05bb3e5fd931fbe9be4b869aa41

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
e2d37af73d5fe4a504db3f8c0d560e3d

SHA1
88c6bf5b485dd9c79283ccb5d2546ffbb95e563d

SHA256
e615959931f345e611ac44be7534d697c1495c641d13e50ae919a7807c8ff008

SHA512
8cb17131326361071a3ae2997cdfaa316ce10c481f48af23fa526380daffa39b2538251cbaa4cf3bd9a9c0014a9184be5a13a44cf45fb93591ba3180670ddb89

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
3bd23392c6fcc866c4561388c1dc72ac

SHA1
c4b1462473f1d97fed434014532ea344b8fc05c1

SHA256
696a382790ee24d6256b3618b1431eaf14c510a12ff2585edfeae430024c7a43

SHA512
15b3a33bb5d5d6e6b149773ff47ade4f22271264f058ad8439403df71d6ecfaa2729ef48487f43d68b517b15efed587b368bc6c5df549983de410ec23b55adb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
2KB

MD5
bef09dc596b7b91eec4f38765e0965b7

SHA1
b8bb8d2eb918e0979b08fd1967dac127874b9de5

SHA256
8dab724d5941eb7becff35ce1a76e8525dcdca024900e70758300dcdddf8e265

SHA512
0bbce4150b47bafb674f2074fdfc20df86edadb85037f93c541d1d53f721ed52e37a49d14522dac56e9d2e9ce801bcdb701509fa02285778a086d547f1be966a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
2KB

MD5
8c6aa92ac8ffdfb7a0fb3dafd14d65f1

SHA1
cac3992d696a99a5dec2ab1c824c816117414b16

SHA256
dc98a84d679d0ba1e36e3142000fa9fd7c5cd4606e07cbcb33f12c98bc1510fa

SHA512
f17a7cbfc11ce2a258aee2857720dcc72ddcfd17ebe9c9b1b04bedb52835c2b35ca4bb649fd5ef3d7ef3f9585f87ef321efec52cb7524be3b83a919999c4900c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
2KB

MD5
f708dcfd087b5b3763678cfb8d63735e

SHA1
a38fa7fa516c1402762425176ff1b607db36c752

SHA256
abf4c5f7dbed40d58dc982256535a56128f86d5eaf163d634037ae2b61027a10

SHA512
fa0e84032b88e19fc67c5be846983cf89c8ba021351a0aa9cab0162ea27a3933dade0b78146b2230b0c57f218b18da52a5ce1d04b6f9746b21e4285e2540049c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
2KB

MD5
294976e85ad11a45853f99c1b208723f

SHA1
8d83101d69420b5af97ec517165d849d3ab498fc

SHA256
04fe02d621f3d9853840b27476da4a191fc91592a77632f9cf85d4ef0370acff

SHA512
e8193036e0e411afe75c1e23f9ce1a7f32d1297706cdd0d99c20375dd7a2bdfb23cc550015852f36816668f0d085042afe74fcfff294f90854ea70f3b929a9d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
2KB

MD5
fa83299c5a0d8714939977af6bdafa92

SHA1
46a4abab9b803a7361ab89d0ca000a367550e23c

SHA256
f3bb35f7fc756da2c2297a100fa29506cb12371edb793061add90ee16318bf03

SHA512
85e46b9f1089054e60c433459eea52bec26330f8b91879df3b48db1533a307443dd82006ac3bb86245bbd207c1d8c75c29949f755cc0dc262ede888a1d531599

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
a57e37dfb6f88b2d04424936ed0b4afb

SHA1
35e2f81486b8420b88b7693ad3e92f846367cb12

SHA256
411f47af20b97f1fe35d3ff6f2a03a77301c8bee20cdfd4638a68430af77456d

SHA512
41f683cc837a2ac36eaf8c32ac336534d329eb482c1a7bd23728b3878492ce79488647df4746701c15254e552e3460f8efa8cec9448a252146596c7926dff448

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
1c6131354c6987300ea512b765475b82

SHA1
2ad74e27ee9080f65d1b2b2e537f73d8f6b59f53

SHA256
3a16ce0b62d9b7bc6832082d30e37163bbde0eddcffe9b09f20fc118b1e0d640

SHA512
b1274a40e10dea26834d3839a4c64a593252640a8a55bcbf642b661f1711451ea81ca712cc98d0c0b9132b4aaf5c8aaac6cc974fc8cbe0eed6ffc13d1b01db68

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
384B

MD5
c93c561465db53bf9a99759de9d25f07

SHA1
5386934828e2c2589bfe394ac1f03ffbfba93bfa

SHA256
32eae568e5a03070b122719c66798a0574658b85dc61bcf3c48eae29f4d77851

SHA512
bb0163e1a26f6b7cfd4ce214ae33a56e446fa74efca7682352ab52aa4b4d5b5b92a141e3e2a12b76f33827b1cd423f3d862cc973079d5da291832ce6a9fb9b18

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
47985593a44ee38c64665b04cbd4b84c

SHA1
84900c2b2e116a7b744730733f63f2a38b4eb76e

SHA256
4a62e43cadba3b8fa2ebead61f9509107d8453a6d66917aad5efab391a8f8e70

SHA512
abdd7f2f701a5572fd6b8b73ff4a013c1f9b157b20f4e193f9d1ed2b3ac4911fa36ffc84ca62d2ceea752a65af34ec77e3766e97e396a8470031990faff1a269

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
1daa413d1a8cd1692f2e4ae22b54c74a

SHA1
2e02e2a23cfaa62f301e29a117e291ff93cc5d31

SHA256
10732e2612780d9694faf0bb9b27cdc6f3376ad327da7dfc346e9e5579493d33

SHA512
b947c70c7c4af971e3fbdc66fb7175b6624ac68c6a723dac7ecb5cf5f43bbe210fa0fa61fd4b6153dccf7de077d003ca03f061e209dc37773546b038e6aef277

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
872656500ddac1ddd91d10aba3a8df96

SHA1
ddf655aea7e8eae37b0a2dd4c8cabaf21cf681fc

SHA256
d6f58d2fbf733d278281af0b9e7732a591cdd752e18a430f76cb7afa806c75f8

SHA512
e7fab32f6f38bde67c8ce7af483216c9965ab62a70aee5c9a9e17aa693c33c67953f817406c1687406977b234d89e62d7feb44757527de5db34e5a61462a0be9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
784B

MD5
5a466127fedf6dbcd99adc917bd74581

SHA1
a2e60b101c8789b59360d95a64ec07d0723c4d38

SHA256
8cd3b8dd28ac014cf973d9ab4b03af1c274bbc9b5ee0ee4ab8af0bdb01573b84

SHA512
695cafc932bc8f0a514bc515860cb275297665de63ca3394b55f42c457761ebf654d29d504674681a77b34e3356a469e8c5b97ff7efc24de330d5375f025cba5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
614dc91c25423b19711b270e1e5a49ad

SHA1
f66496dcf9047ae934bdc4a65f697be55980b169

SHA256
cd2b70a70c7da79d5136e4268d6c685e81d925b9387b9ed9e1b3189118e2de5e

SHA512
27a8649bb02ab6a67a1f2482662a6c690aefca551eec3575ea9aeee645d318b23d0dc6d5d2db239583ddb5f04ba13d94e5180a184566416291b7180fab0029e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
2KB

MD5
501effddf60a974e98b67dc8921aa7e8

SHA1
734dfe4b508dbc1527ec92e91821a1251aec5b2e

SHA256
672e3c47827c2fc929fc92cd7d2a61d9ba41e847f876a1e5486e2701cbc3cb06

SHA512
28081046c5b0eb6a5578134e19af2a447d38afda338bd3ae4c2fc0054460580d47f9ab6d8c9001ff605e76df462e7bbcab80be15deaf3ca6264e20717dfb9c1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
2KB

MD5
e6d8af5aed642209c88269bf56af50ae

SHA1
633d40da997074dc0ed10938ebc49a3aeb3a7fc8

SHA256
550abc09abce5b065d360dfea741ab7dd8abbe2ea11cd46b093632860775baec

SHA512
6949fc255c1abf009ecbe0591fb6dbfd96409ee98ae438dbac8945684ccf694c046d5b51d2bf7679c1e02f42e8f32e8e29a9b7bdbc84442bec0497b64dfa84cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
2KB

MD5
5855edf3afa67e11de78af0389880d18

SHA1
c43fcd36d70a6ffcd41fbb48c1d0c406fd00286f

SHA256
c7798759a159989611cdf47f702c8813ad0f029b52f18af573f383859a8bfaaa

SHA512
5be99a55f86486c04bda0a089571c296d041dae337321578c0f8d19d7bd2e51802aafbc8716753b6191b8e5ced782a5bc7d44bdd4995ab8e6ac1f7cd4b0f91ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
849B

MD5
558ce6da965ba1758d112b22e15aa5a2

SHA1
a365542609e4d1dc46be62928b08612fcabe2ede

SHA256
c11beaac10a5e00391ef4b41be8c240f59c5a2dc930aead6d7db237fcd2641fb

SHA512
37f7f10c3d201b11cc5224ae69c5990eb33b4430c601d3c21f6bec9323621120442e0cfa49e1f4eda459ea4ac750277e446dca78b9e44c1445bd891e4e460b5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
5b77620cb52220f4a82e3551ee0a53a6

SHA1
07d122b8e70ec5887bad4ef8f4d6209df18912d0

SHA256
93ee7aaab4bb8bb1a11aede226bdb7c2ad85197ef5054eb58531c4df35599579

SHA512
9dc2b10a03c87d294903ff3514ca38ce1e85dec66213a7042d31f70fb20d36fed645150c5a6cb6f08c31bdc9f61e7dee2f1737c98aab263c289b09ffa663371c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
2KB

MD5
8a36f3bf3750851d8732b132fa330bb4

SHA1
1cb36be31f3d7d9439aac14af3d7a27f05a980eb

SHA256
5d88aebc1d13a61609ef057cb38dc9d7b0a04a47a7670a7591f40d1ea05b6ad9

SHA512
a822885389f3b12baed60b565646bed97aea1740e163e236ca3647fb63a9c15f6e21bc5ff92eb2d47bb6b1268c71ffb8e5e84006f3c04377d9d3a7c16434e646

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
2KB

MD5
6bf876cd9994f0d41be4eca36d22c42a

SHA1
50cda4b940e6ba730ce59000cfc59e6c4d7fdc79

SHA256
ff39ffe6e43e9b293c5be6aa85345e868a27215293e750c00e1e0ba676deeb2a

SHA512
605e2920cd230b6c617a2d4153f23144954cd4bae0f66b857e1b334cd66258fbc5ba049c1ab6ab83c30fd54c87235a115ec7bbfd17d6792a4bbbae4c6700e106

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
c1e5f93e2bee9ca33872764d8889de23

SHA1
167f65adfc34a0e47cb7de92cc5958ee8905796a

SHA256
8f5276e847b1c6beb572b1eeae20f98784aae11ea2d8f8860adcdb78fd9dca3a

SHA512
482741b0df7bf6e94ba9667892fe12125df30812e21de40fd60dee540922da70ffb6db4a0c0e17346e714d4bb6e49e2d4eca53c0d5194cd888903071c82b8859

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
2KB

MD5
f82bc8865c1f6bf7125563479421f95c

SHA1
65c25d7af3ab1f29ef2ef1fdc67378ac9c82098d

SHA256
f9799dc2afb8128d1925b69fdef1d641f312ed41254dd5f4ac543cf50648a2f6

SHA512
00a9b7798a630779dc30296c3d0fed2589e7e86d6941f4502ea301c5bce2e80a5d8a4916e36183c7064f968b539ae6dac49094b1de3643a1a2fedc83cf558825

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
2KB

MD5
d5e129352c8dd0032b51f34a2bbecad3

SHA1
a50f8887ad4f6a1eb2dd3c5b807c95a923964a6a

SHA256
ebdaad14508e5ba8d9e794963cf35bd51b7a92b949ebf32deef254ab9cdd6267

SHA512
9a3aa2796657c964f3c3ff07c8891533a740c86e8b0bebb449b5a3e07e1248d0f6608e03d9847caf1c8bff70392d15474f2954349869d92658108515df6831c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
2KB

MD5
b9dc88ed785d13aaeae9626d7a26a6a0

SHA1
ab67e1c5ca09589b93c06ad0edc4b5a18109ec1e

SHA256
9f1cba2944ed1a547847aa72ba5c759c55da7466796389f9a0f4fad69926e6fc

SHA512
df6380a3e5565ff2bc66d7589af7bc3dcfa2598212c95765d070765341bba446a5a5d6206b50d860f6375c437622deb95a066440145a1b7917aee6dcef207b91

Download Submit
C:\Windows\SysWOW64\Tilecomgm.com

Filesize
207KB

MD5
03cae9ca903d0d948fd144ba9315a1a8

SHA1
c3929908918990100f1930c36509b37219aa1b85

SHA256
7b0deff51daba0c2967e71799ad43f2b7a53c36703051eb8e95bbe06df85c450

SHA512
385691a678941ad3bd116cb80d79c7daf55c36a097ed019392fceb2e884de7178d1a1eb2e5631b45fb5d3689c3a8056914541eed810d211c69780cb46d02e424

Download Submit
\??\c:\AcD.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
memory/1288-422-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/1288-535-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/1288-309-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2172-538-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2172-762-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2216-194-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/2216-183-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/2216-420-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2216-182-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/2216-178-0x0000000000600000-0x0000000000630000-memory.dmp

Filesize
192KB

Download
memory/2216-193-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/2216-307-0x0000000000600000-0x0000000000630000-memory.dmp

Filesize
192KB

Download
memory/2216-306-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2216-192-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/2216-191-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/2216-190-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/2216-179-0x0000000002270000-0x0000000002271000-memory.dmp

Filesize
4KB

Download
memory/2216-181-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/2216-421-0x0000000000600000-0x0000000000630000-memory.dmp

Filesize
192KB

Download
memory/2216-184-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/2216-185-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/2216-186-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/2216-187-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/2216-188-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/2216-189-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/2256-536-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2256-648-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2256-424-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2480-765-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/4460-876-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/4460-651-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/4460-763-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/4952-8-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/4952-149-0x00000000031D0000-0x00000000031D1000-memory.dmp

Filesize
4KB

Download
memory/4952-150-0x0000000003200000-0x0000000003201000-memory.dmp

Filesize
4KB

Download
memory/4952-151-0x00000000031F0000-0x00000000031F1000-memory.dmp

Filesize
4KB

Download
memory/4952-152-0x0000000003220000-0x0000000003221000-memory.dmp

Filesize
4KB

Download
memory/4952-153-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/4952-148-0x00000000031E0000-0x00000000031E1000-memory.dmp

Filesize
4KB

Download
memory/4952-154-0x0000000003240000-0x0000000003241000-memory.dmp

Filesize
4KB

Download
memory/4952-155-0x0000000003230000-0x0000000003231000-memory.dmp

Filesize
4KB

Download
memory/4952-160-0x0000000000960000-0x0000000000990000-memory.dmp

Filesize
192KB

Download
memory/4952-161-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/4952-167-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/4952-168-0x00000000032C0000-0x00000000032C1000-memory.dmp

Filesize
4KB

Download
memory/4952-169-0x00000000032F0000-0x00000000032F1000-memory.dmp

Filesize
4KB

Download
memory/4952-170-0x00000000032E0000-0x00000000032E1000-memory.dmp

Filesize
4KB

Download
memory/4952-171-0x0000000003310000-0x0000000003311000-memory.dmp

Filesize
4KB

Download
memory/4952-172-0x0000000003300000-0x0000000003301000-memory.dmp

Filesize
4KB

Download
memory/4952-304-0x0000000000960000-0x0000000000990000-memory.dmp

Filesize
192KB

Download
memory/4952-305-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/4952-173-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/4952-174-0x0000000003320000-0x0000000003321000-memory.dmp

Filesize
4KB

Download
memory/4952-162-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/4952-163-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download
memory/4952-164-0x00000000032A0000-0x00000000032A1000-memory.dmp

Filesize
4KB

Download
memory/4952-159-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/4952-156-0x0000000003270000-0x0000000003271000-memory.dmp

Filesize
4KB

Download
memory/4952-157-0x0000000003250000-0x0000000003251000-memory.dmp

Filesize
4KB

Download
memory/4952-4-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/4952-5-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/4952-6-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/4952-7-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4952-0-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/4952-9-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/4952-10-0x00000000022A0000-0x00000000022A1000-memory.dmp

Filesize
4KB

Download
memory/4952-11-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/4952-13-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4952-12-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/4952-15-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/4952-16-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/4952-17-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/4952-18-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/4952-19-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/4952-20-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/4952-21-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/4952-22-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/4952-23-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/4952-24-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/4952-25-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/4952-26-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/4952-27-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/4952-28-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/4952-31-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/4952-32-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/4952-33-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/4952-36-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/4952-37-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/4952-38-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/4952-34-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/4952-14-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/4952-35-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/4952-29-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/4952-3-0x0000000000650000-0x0000000000654000-memory.dmp

Filesize
16KB

Download
memory/4952-2-0x0000000000960000-0x0000000000990000-memory.dmp

Filesize
192KB

Download
memory/4952-1-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads