Analysis
- max time kernel
121s - max time network
121s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
02/10/2024, 16:20
Static task
static1
Behavioral task
behavioral1
Sample
0b8b4d1854add7dfc1a27b1e93fb002b_JaffaCakes118.msi
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
0b8b4d1854add7dfc1a27b1e93fb002b_JaffaCakes118.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
22 signatures
150 seconds
General
- Target 0b8b4d1854add7dfc1a27b1e93fb002b_JaffaCakes118.msi
- Size 3.9MB
- Sample241002-ts9mmswarj
- SHA256 dee25db703acc220d63785d7a72cce3817305642f5da1dc6f155d5d693bcde88
- MD5 0b8b4d1854add7dfc1a27b1e93fb002b
- SHA1 38cecb90eb2b89d81db27a988ff09ce20db26e8e
- SHA512 746d3f81089bf4210a831b5f5a8bec6fa946fe2cb071eb03cce2702c1e79f198cf40a7eafc89067923282a11d583188c885de8fd7d656367ee0b2ba1b861dd34
- SSDEEP 98304:nxnFFK+GEWJRgsnAWE05y4faRXsYA+tiQDnIjlBzpA7iQTWKKhgblL0n:JFFKZEWJtni7XpA+MSIjl5pQnTWth
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Blocklisted process makes network request 3 IoCs
flow pid Process 3 1964 msiexec.exe 5 1964 msiexec.exe 6 2588 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Drops file in Program Files directory 27 IoCs
description ioc Process File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-localization-l1-2-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-conio-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-runtime-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-stdio-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-process-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-time-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\setup.bat msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\SyncMonitor.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-heap-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-synch-l1-2-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-math-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-multibyte-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\Register.exe msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\vcruntime140_1.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-timezone-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-convert-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-environment-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-file-l2-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-private-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-utility-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\patch_service.exe msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\vcruntime140.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-filesystem-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-locale-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-processthreads-l1-1-1.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-string-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-file-l1-2-0.dll msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Installer\f76f1de.msi msiexec.exe File opened for modification C:\Windows\Installer\f76f1de.msi msiexec.exe File created C:\Windows\Installer\f76f1df.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIF572.tmp msiexec.exe File created C:\Windows\Installer\wix{D475A886-3AC6-4816-B147-DC43D33F3540}.SchedServiceConfig.rmi MsiExec.exe File opened for modification C:\Windows\Installer\f76f1df.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIF583.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF66F.tmp msiexec.exe File created C:\Windows\Installer\f76f1e1.msi msiexec.exe File created C:\Windows\Installer\{D475A886-3AC6-4816-B147-DC43D33F3540}\Logo.ico msiexec.exe File opened for modification C:\Windows\Installer\{D475A886-3AC6-4816-B147-DC43D33F3540}\Logo.ico msiexec.exe - Executes dropped EXE 1 IoCs
pid Process 2476 Register.exe - Loads dropped DLL 20 IoCs
pid Process 2580 MsiExec.exe 1784 MsiExec.exe 2476 Register.exe 2476 Register.exe 2476 Register.exe 2476 Register.exe 2476 Register.exe 2476 Register.exe 2476 Register.exe 2476 Register.exe 2476 Register.exe 2476 Register.exe 2476 Register.exe 2476 Register.exe 2476 Register.exe 2476 Register.exe 2476 Register.exe 2476 Register.exe 2476 Register.exe 2476 Register.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1964 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Register.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe - Modifies registry class 23 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\688A574D6CA361841B74CD343DF35304\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\688A574D6CA361841B74CD343DF35304\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\688A574D6CA361841B74CD343DF35304 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\688A574D6CA361841B74CD343DF35304\ProductName = "Java SE" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\688A574D6CA361841B74CD343DF35304\PackageCode = "9D60AB34E1F9AF540951EAB0CA4EB4A5" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\688A574D6CA361841B74CD343DF35304\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\688A574D6CA361841B74CD343DF35304\SourceList\PackageName = "0b8b4d1854add7dfc1a27b1e93fb002b_JaffaCakes118.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\688A574D6CA361841B74CD343DF35304\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\688A574D6CA361841B74CD343DF35304\ProductFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\688A574D6CA361841B74CD343DF35304 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\688A574D6CA361841B74CD343DF35304\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\688A574D6CA361841B74CD343DF35304\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\688A574D6CA361841B74CD343DF35304\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\688A574D6CA361841B74CD343DF35304\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\688A574D6CA361841B74CD343DF35304\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\688A574D6CA361841B74CD343DF35304\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\688A574D6CA361841B74CD343DF35304\Version = "134217999" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\688A574D6CA361841B74CD343DF35304\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\688A574D6CA361841B74CD343DF35304\ProductIcon = "C:\\Windows\\Installer\\{D475A886-3AC6-4816-B147-DC43D33F3540}\\Logo.ico" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\688A574D6CA361841B74CD343DF35304\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3434171B899944440BE5255593F74797 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3434171B899944440BE5255593F74797\688A574D6CA361841B74CD343DF35304 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\688A574D6CA361841B74CD343DF35304\SourceList msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2588 msiexec.exe 2588 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1964 msiexec.exe Token: SeIncreaseQuotaPrivilege 1964 msiexec.exe Token: SeRestorePrivilege 2588 msiexec.exe Token: SeTakeOwnershipPrivilege 2588 msiexec.exe Token: SeSecurityPrivilege 2588 msiexec.exe Token: SeCreateTokenPrivilege 1964 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1964 msiexec.exe Token: SeLockMemoryPrivilege 1964 msiexec.exe Token: SeIncreaseQuotaPrivilege 1964 msiexec.exe Token: SeMachineAccountPrivilege 1964 msiexec.exe Token: SeTcbPrivilege 1964 msiexec.exe Token: SeSecurityPrivilege 1964 msiexec.exe Token: SeTakeOwnershipPrivilege 1964 msiexec.exe Token: SeLoadDriverPrivilege 1964 msiexec.exe Token: SeSystemProfilePrivilege 1964 msiexec.exe Token: SeSystemtimePrivilege 1964 msiexec.exe Token: SeProfSingleProcessPrivilege 1964 msiexec.exe Token: SeIncBasePriorityPrivilege 1964 msiexec.exe Token: SeCreatePagefilePrivilege 1964 msiexec.exe Token: SeCreatePermanentPrivilege 1964 msiexec.exe Token: SeBackupPrivilege 1964 msiexec.exe Token: SeRestorePrivilege 1964 msiexec.exe Token: SeShutdownPrivilege 1964 msiexec.exe Token: SeDebugPrivilege 1964 msiexec.exe Token: SeAuditPrivilege 1964 msiexec.exe Token: SeSystemEnvironmentPrivilege 1964 msiexec.exe Token: SeChangeNotifyPrivilege 1964 msiexec.exe Token: SeRemoteShutdownPrivilege 1964 msiexec.exe Token: SeUndockPrivilege 1964 msiexec.exe Token: SeSyncAgentPrivilege 1964 msiexec.exe Token: SeEnableDelegationPrivilege 1964 msiexec.exe Token: SeManageVolumePrivilege 1964 msiexec.exe Token: SeImpersonatePrivilege 1964 msiexec.exe Token: SeCreateGlobalPrivilege 1964 msiexec.exe Token: SeRestorePrivilege 2588 msiexec.exe Token: SeTakeOwnershipPrivilege 2588 msiexec.exe Token: SeRestorePrivilege 2588 msiexec.exe Token: SeTakeOwnershipPrivilege 2588 msiexec.exe Token: SeRestorePrivilege 2588 msiexec.exe Token: SeTakeOwnershipPrivilege 2588 msiexec.exe Token: SeRestorePrivilege 2588 msiexec.exe Token: SeTakeOwnershipPrivilege 2588 msiexec.exe Token: SeRestorePrivilege 2588 msiexec.exe Token: SeTakeOwnershipPrivilege 2588 msiexec.exe Token: SeShutdownPrivilege 1784 MsiExec.exe Token: SeRestorePrivilege 2588 msiexec.exe Token: SeTakeOwnershipPrivilege 2588 msiexec.exe Token: SeRestorePrivilege 2588 msiexec.exe Token: SeTakeOwnershipPrivilege 2588 msiexec.exe Token: SeRestorePrivilege 2588 msiexec.exe Token: SeTakeOwnershipPrivilege 2588 msiexec.exe Token: SeRestorePrivilege 2588 msiexec.exe Token: SeTakeOwnershipPrivilege 2588 msiexec.exe Token: SeRestorePrivilege 2588 msiexec.exe Token: SeTakeOwnershipPrivilege 2588 msiexec.exe Token: SeRestorePrivilege 2588 msiexec.exe Token: SeTakeOwnershipPrivilege 2588 msiexec.exe Token: SeRestorePrivilege 2588 msiexec.exe Token: SeTakeOwnershipPrivilege 2588 msiexec.exe Token: SeRestorePrivilege 2588 msiexec.exe Token: SeTakeOwnershipPrivilege 2588 msiexec.exe Token: SeRestorePrivilege 2588 msiexec.exe Token: SeTakeOwnershipPrivilege 2588 msiexec.exe Token: SeRestorePrivilege 2588 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1964 msiexec.exe 1964 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2476 Register.exe 2476 Register.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2588 wrote to memory of 2580 2588 msiexec.exe 31 PID 2588 wrote to memory of 2580 2588 msiexec.exe 31 PID 2588 wrote to memory of 2580 2588 msiexec.exe 31 PID 2588 wrote to memory of 2580 2588 msiexec.exe 31 PID 2588 wrote to memory of 2580 2588 msiexec.exe 31 PID 2588 wrote to memory of 2580 2588 msiexec.exe 31 PID 2588 wrote to memory of 2580 2588 msiexec.exe 31 PID 2588 wrote to memory of 1784 2588 msiexec.exe 32 PID 2588 wrote to memory of 1784 2588 msiexec.exe 32 PID 2588 wrote to memory of 1784 2588 msiexec.exe 32 PID 2588 wrote to memory of 1784 2588 msiexec.exe 32 PID 2588 wrote to memory of 1784 2588 msiexec.exe 32 PID 2588 wrote to memory of 1784 2588 msiexec.exe 32 PID 2588 wrote to memory of 1784 2588 msiexec.exe 32 PID 2588 wrote to memory of 2476 2588 msiexec.exe 33 PID 2588 wrote to memory of 2476 2588 msiexec.exe 33 PID 2588 wrote to memory of 2476 2588 msiexec.exe 33 PID 2588 wrote to memory of 2476 2588 msiexec.exe 33
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\0b8b4d1854add7dfc1a27b1e93fb002b_JaffaCakes118.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1964
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 24DF91AAA51E1C54DC27C0DB29033CB12⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2580
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5CD75624FC4F290F47B774F3C017EB00 M Global\MSI00002⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1784
-
-
C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\Register.exe"C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\Register.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2476
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\f76f1e0.rbs
- Size 223KB
- SHA256 bfca48eb9fdd1b97cbd9e13b2701552eb9eb592036099c780e374447d662620c
- MD5 6c3a5c82d3df11a4db7bb78ca670fd67
- SHA1 22b81dae226fb11fab4737b1736e254416388caa
- SHA512 1c58c54c85b2b9f9cf23d3aab026b727f3500295cf002a0b1531731c9715dce556527f75ce73eef9315887420e1d26d9670f3cd6849c7ebf3734e21c17cb5b96
- SSDEEP 3072:3Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxav:3t/kE1jOZy2KL4GBiwQtEa4L2sW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\Register.exe
- Size 4.3MB
- SHA256 6fe23163ea43ab8d9e84fed45b8590fe643d599c7f218ea05d505e3aeea86f23
- MD5 96b62cfb83cf0e9790a3ef939173ee31
- SHA1 23ecaefa21524e9446ea16e1f532f8bf9c5a56f1
- SHA512 d018997c50702fe035bd3974180f274ffa34605bd19a3ce8fbabf96633794afe8f1ee4a2ee731a9ff3c73163e45ad26f8d7bac30b9ae55d1d47c8a333b657b6b
- SSDEEP 98304:n79QoFKy2aJmu59ScnMB1sLghxkqNmpEY5AsSB1QBR/TUIbVtnGF3:n71klemuDVMB1JnmeqAsJRnE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\VCRUNTIME140.dll
- Size 83KB
- SHA256 678f9d715220512a823ca45d7e8545a1288728d8d47243e072e17049441cdd2b
- MD5 e008fbfdea1bf873f3d94d74c1cf7935
- SHA1 2a2af5e9084e7b55cdd5d01df342b02c1917573c
- SHA512 145acb67ab06dc90e5c7ed89623a339f595998af683bf47d665ffa23b05f9b87016b3ae5777c2c45f53b91a757e510b0f5aa5a9b908d79df3d566b2307d9d3d0
- SSDEEP 1536:sjoRdMu1c42OEAiyh03MqdOB1BECZ9qXWcecbQHv+rBa:s04OksZtFECZyecbQHGs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-file-l1-2-0.dll
- Size 17KB
- SHA256 9f7bda59faafc8a455f98397a63a7f7d114efc4e8a41808c791256ebf33c7613
- MD5 79ee4a2fcbe24e9a65106de834ccda4a
- SHA1 fd1ba674371af7116ea06ad42886185f98ba137b
- SHA512 6ef7857d856a1d23333669184a231ad402dc62c8f457a6305fe53ed5e792176ca6f9e561375a707da0d7dd27e6ea95f8c4355c5dc217e847e807000b310aa05c
- SSDEEP 192:Y+W1hWifcvHCjdks/nGfe4pBjSYA89sX5W5RKTt3E2sVWQ4GWFuLOgVqnaj6uDp6:Y+W1hWoQim0GftpBj7sIm3SFOslD16hP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-file-l2-1-0.dll
- Size 17KB
- SHA256 ae5e73416eb64bc18249ace99f6847024eceea7ce9c343696c84196460f3a357
- MD5 3f224766fe9b090333fdb43d5a22f9ea
- SHA1 548d1bb707ae7a3dfccc0c2d99908561a305f57b
- SHA512 c12ea6758071b332368d7ef0857479d2b43a4b27ceeab86cbb542bd6f1515f605ea526dfa3480717f8f452989c25d0ee92bf3335550b15ecec79e9b25e66a2ca
- SSDEEP 192:FZkW1hWiecvHCjdks/nGfe4pBjSYo3Vq34W5RKTt3E2sVWQ4GW2rOqnajd2siD+k:MW1hWdQim0GftpBj4VuFm3SWlg+0mw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-localization-l1-2-0.dll
- Size 20KB
- SHA256 a7fa48de6c06666b80184afee7e544c258e0fb11399ab3fe47d4e74667779f41
- MD5 23bd405a6cfd1e38c74c5150eec28d0a
- SHA1 1d3be98e7dfe565e297e837a7085731ecd368c7b
- SHA512 c52d487727a34fbb601b01031300a80eca7c4a08af87567da32cb5b60f7a41eb2cae06697cd11095322f2fc8307219111ee02b60045904b5c9b1f37e48a06a21
- SSDEEP 384:9OMw3zdp3bwjGjue9/0jCRrndb5W1hW54wm0GftpBjvTNvwm3SBMltZ2m:9OMwBprwjGjue9/0jCRrndboUFViZ2Vu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-processthreads-l1-1-1.dll
- Size 18KB
- SHA256 ff9b51aff7fbec8d7fe5cc478b12492a59b38b068dc2b518324173bb3179a0e1
- MD5 95c5b49af7f2c7d3cd0bc14b1e9efacb
- SHA1 c400205c81140e60dffa8811c1906ce87c58971e
- SHA512 f320937b90068877c46d30a15440dc9ace652c3319f5d75e0c8bb83f37e78be0efb7767b2bd713be6d38943c8db3d3d4c3da44849271605324e599e1242309c3
- SSDEEP 384:NS8DfIelW1hWu4wm0GftpBjBFm3SzlJrI:NSLecfFViRTs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-synch-l1-2-0.dll
- Size 18KB
- SHA256 758a2f9ef6908b51745db50d89610fe1de921d93b2dbea919bfdba813d5d8893
- MD5 6e704280d632c2f8f2cadefcae25ad85
- SHA1 699c5a1c553d64d7ff3cf4fe57da72bb151caede
- SHA512 ade85a6cd05128536996705fd60c73f04bab808dafb5d8a93c45b2ee6237b6b4ddb087f1a009a9d289c868c98e61be49259157f5161feccf9f572fd306b460e6
- SSDEEP 384:DtZ3UW1hWxDzDm0GftpBjEILkm3ScrlPpU9:n0ViIQxi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-timezone-l1-1-0.dll
- Size 18KB
- SHA256 b5c725bbb475b5c06cc6cb2a2c3c70008f229659f88fba25ccd5d5c698d06a4b
- MD5 c9a55de62e53d747c5a7fddedef874f9
- SHA1 c5c5a7a873a4d686bfe8e3da6dc70f724ce41bad
- SHA512 adca0360a1297e80a8d3c2e07f5fbc06d2848f572f551342ad4c9884e4ab4bd1d3b3d9919b4f2b929e2848c1a88a4e844dd38c86067cace9685f9640db100efb
- SSDEEP 384:rWW1hWv4wm0GftpBjgpm3SSP9lndaYhpwe/:ReFVi02vZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-convert-l1-1-0.dll
- Size 21KB
- SHA256 b7c3ebc36c84630a52d23d1c0e79d61012dfa44cdebdf039af31ec9e322845a5
- MD5 9ddea3cc96e0fdd3443cc60d649931b3
- SHA1 af3cb7036318a8427f20b8561079e279119dca0e
- SHA512 1427193b31b64715f5712db9c431593bdc56ef512fe353147ddb7544c1c39ded4371cd72055d82818e965aff0441b7cbe0b811d828efb0ece28471716659e162
- SSDEEP 384:FuyhW1hWF4wm0GftpBjErIm3StlndaYhpFeD:4cFViUIbi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-heap-l1-1-0.dll
- Size 18KB
- SHA256 675b1b82dd485cc8c8a099272db9241d0d2a7f45424901f35231b79186ec47ee
- MD5 1776a2b85378b27825cf5e5a3a132d9a
- SHA1 626f0e7f2f18f31ec304fe7a7af1a87cbbebb1df
- SHA512 541a5dd997fc5fec31c17b4f95f03c3a52e106d6fb590cb46bdf5adad23ed4a895853768229f3fbb9049f614d9bae031e6c43cec43fb38c89f13163721bb8348
- SSDEEP 384:XY3eBW1hWqvm0GftpBjtzsxm3SKulndaYhp6s:zQzViATv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-locale-l1-1-0.dll
- Size 18KB
- SHA256 8b543b1bb241f5b773eb76f652dad7b12e3e4a09230f2e804cd6b0622e8baf65
- MD5 034379bcea45eb99db8cdfeacbc5e281
- SHA1 bbf93d82e7e306e827efeb9612e8eab2b760e2b7
- SHA512 7ea6efb75b0c59d3120d5b13da139042726a06d105c924095ed252f39ac19e11e8a5c6bb1c45fa7519c0163716745d03fb9daaaca50139a115235ab2815cc256
- SSDEEP 192:lW1hWi6+49Cjdks/nGfe4pBjSY38yMsW5RKTt3E2sVWQ4GWbGBfqnajE49dRX3tK:lW1hWa4wm0GftpBjlWm3S7dlPptZA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-math-l1-1-0.dll
- Size 28KB
- SHA256 39723e61c98703034b264b97ee0fe12e696c6560483d799020f9847d8a952672
- MD5 8da414c3524a869e5679c0678d1640c1
- SHA1 60cf28792c68e9894878c31b323e68feb4676865
- SHA512 6ef3f81206e7d4dca5b3c1fafc9aa2328b717e61ee0acce30dfb15ad0fe3cb59b2bd61f92bf6046c0aae01445896dcb1485ad8be86629d22c3301a1b5f4f2cfa
- SSDEEP 384:jOTEmbM4Oe5grykfIgTmLmW1hWSsngm0GftpBjGm3SAlD16hX:lEMq5grxfIndCngVis5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-runtime-l1-1-0.dll
- Size 22KB
- SHA256 1ee8e99190cc31b104fb75e66928b8c73138902fefedbcfb54c409df50a364df
- MD5 fb0ca6cbfff46be87ad729a1c4fde138
- SHA1 2c302d1c535d5c40f31c3a75393118b40e1b2af9
- SHA512 99144c67c33e89b8283c5b39b8bf68d55638daa6acc2715a2ac8c5dba4170dd12299d3a2dffb39ae38ef0872c2c68a64d7cdc6ceba5e660a53942761cb9eca83
- SSDEEP 384:Lb7hrKkW1hW54wm0GftpBjGOm3SdWlmTwhctW:LbNrKn8FVinhZW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-stdio-l1-1-0.dll
- Size 23KB
- SHA256 7bcab4ca00fb1f85fea29dd3375f709317b984a6f3b9ba12b8cf1952f97beee5
- MD5 d5166ab3034f0e1aa679bfa1907e5844
- SHA1 851dd640cb34177c43b5f47b218a686c09fa6b4c
- SHA512 8f2d7442191de22457c1b8402faad594af2fe0c38280aaafc876c797ca79f7f4b6860e557e37c3dbe084fe7262a85c358e3eeaf91e16855a91b7535cb0ac832e
- SSDEEP 384:/ZpFVhHW1hWxgYBm0GftpBjMm3SNlndaYhpn3p:boEVi6DBp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-time-l1-1-0.dll
- Size 20KB
- SHA256 4d0f0ea6e8478132892f9e674e27e2bc346622fc8989c704e5b2299a18c1d138
- MD5 9b79fda359a269c63dcac69b2c81caa4
- SHA1 a38c81b7a2ec158dfcfeb72cb7c04b3eb3ccc0fb
- SHA512 e69d275c5ec5eae5c95b0596f0cc681b7d287b3e2f9c78a9b5e658949e6244f754f96ad7d40214d22ed28d64e4e8bd507363cdf99999fea93cfe319078c1f541
- SSDEEP 384:iUW1hWQ4wm0GftpBjddQxm3SLDlD16h1S:eRFViexn1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-utility-l1-1-0.dll
- Size 18KB
- SHA256 7e6b33a4c0c84f18f2be294ec63212245af4fd8354636804ffe5ee9a0d526d95
- MD5 70e9104e743069b573ca12a3cd87ec33
- SHA1 4290755b6a49212b2e969200e7a088d1713b84a2
- SHA512 e979f28451d271f405b780fc2025707c8a29dcb4c28980ca42e33d4033666de0e4a4644defec6c1d5d4bdd3c73d405fafcffe3320c60134681f62805c965bfd9
- SSDEEP 192:UfHQdurW1hWiSuDz7eCjdks/nGfe4pBjSYp2VZGW5RKTt3E2sVWQ4GWO3uDVqna9:UfVW1hWKDzDm0GftpBjYLm3Sy5lD16hC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6525274CBC2077D43D7D17A33C868C4F
- Size 959B
- SHA256 5c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e
- MD5 d5e98140c51869fc462c8975620faa78
- SHA1 07e032e020b72c3f192f0628a2593a19a70f069e
- SHA512 9bd164cc4b9ef07386762d3775c6d9528b82d4a9dc508c3040104b8d41cfec52eb0b7e6f8dc47c5021ce2fe3ca542c4ae2b54fd02d76b0eabd9724484621a105
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6525274CBC2077D43D7D17A33C868C4F
- Size 192B
- SHA256 bb7d224ac4a9a0cc9a2629c4213d8596b24998481e6f81148ce369f45dd0093e
- MD5 bcd1d97c3bee5778bb4d33e0d87ff9e6
- SHA1 db64b9801db7a8c142093470b46780638ecad4ce
- SHA512 85753a250a75259de745fa4ba3a086d2ffec55efaf4c6c3e1eca6dbbde5bd4182b45dbdd6807d4ff735cd51fd9a9a4cd0d567f68cb4f82e0414dff5791fc9a98
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 0a688e9c76a3890f302cc7035bbdf819078ef561ab3273b8ba070a29f54050a5
- MD5 a4d5306ee84326cba235291893d4975f
- SHA1 91f6a6a2d720a23a85dcd262d8b111490a174f5c
- SHA512 6ae5a4e8de310502d65b42624c5d1993d56c8996df9aa66f386a9ca42fd6b06b5bc3d1d65f3f60f93179ca7164abdb1affffc7571fcf88c5befc61d38f6bb82b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\CabF0C7.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TarF0D9.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIF583.tmp
- Size 211KB
- SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
- MD5 a3ae5d86ecf38db9427359ea37a5f646
- SHA1 eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
- SHA512 96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
- SSDEEP 3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaQ:/t/kE1jOZy2KL4GBiwQtEa4L2sV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\f76f1de.msi
- Size 3.9MB
- SHA256 dee25db703acc220d63785d7a72cce3817305642f5da1dc6f155d5d693bcde88
- MD5 0b8b4d1854add7dfc1a27b1e93fb002b
- SHA1 38cecb90eb2b89d81db27a988ff09ce20db26e8e
- SHA512 746d3f81089bf4210a831b5f5a8bec6fa946fe2cb071eb03cce2702c1e79f198cf40a7eafc89067923282a11d583188c885de8fd7d656367ee0b2ba1b861dd34
- SSDEEP 98304:nxnFFK+GEWJRgsnAWE05y4faRXsYA+tiQDnIjlBzpA7iQTWKKhgblL0n:JFFKZEWJtni7XpA+MSIjl5pQnTWth
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-environment-l1-1-0.dll
- Size 18KB
- SHA256 56d8b7ee7619579a3c648eb130c9354ba1ba5b33a07a4f350370ee7b3653749a
- MD5 39325e5f023eb564c87d30f7e06dff23
- SHA1 03dd79a7fbe3de1a29359b94ba2d554776bdd3fe
- SHA512 087b9dcb744ad7d330bacb9bda9c1a1df28ebb9327de0c5dc618e79929fd33d1b1ff0e1ef4c08f8b3ea8118b968a89f44fe651c66cba4ecbb3216cd4bcce3085
- SSDEEP 192:4rW1hWiSu7jCjdks/nGfe4pBjSYC69poCxW5RKTt3E2sVWQ4GWmEsSC9qnajuZDW:AW1hW6am0GftpBjtBQm3SzSKlUKTT
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-filesystem-l1-1-0.dll
- Size 19KB
- SHA256 ac0cec8644340125507dd0bc9a90b1853a2d194eb60a049237fb5e752d349065
- MD5 228c6bbe1bce84315e4927392a3baee5
- SHA1 ba274aa567ad1ec663a2f9284af2e3cb232698fb
- SHA512 37a60cce69e81f68ef62c58bba8f2843e99e8ba1b87df9a5b561d358309e672ae5e3434a10a3dde01ae624d1638da226d42c64316f72f3d63b08015b43c56cab
- SSDEEP 384:Cq6nWm5CZW1hW9YBm0GftpBjVem3SuPvlg+0Pd:T6nWm5CIhViDeKPmd
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-string-l1-1-0.dll
- Size 23KB
- SHA256 73ab2161a7700835b2a15b7487045a695706cc18bcee283b114042570bb9c0aa
- MD5 ad99c2362f64cde7756b16f9a016a60f
- SHA1 07c9a78ee658bfa81db61dab039cffc9145cc6cb
- SHA512 9c72f239adda1de11b4ad7028f3c897c93859ef277658aeaa141f09b7ddfe788d657b9cb1e2648971ecd5d27b99166283110ccba437d461003dbb9f6885451f7
- SSDEEP 384:jiFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlbW1hWS4wm0GftpBjwwO5m3S9lJrm:j6S5yguNvZ5VQgx3SbwA71IkFhbFViWs
- MD5 SHA1 SHA512 SSDEEP