Analysis
- max time kernel
95s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
04/10/2024, 20:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
14bdf6fc0169d6126bde9ff2c980b04e_JaffaCakes118.dll
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
General
- Target 14bdf6fc0169d6126bde9ff2c980b04e_JaffaCakes118.dll
- Size 177KB
- Sample241004-yrfqdsxhph
- SHA256 75cd95e7377c82f350101c702e44733d59a02bb56594fe7ede26990b33948314
- MD5 14bdf6fc0169d6126bde9ff2c980b04e
- SHA1 d24047604e8dae044e18a466b39304013d90d1e6
- SHA512 73b8b90a3b299cbee3346e6ed67329a76edea44bf98d0964e055855cbae801991291335606c4fad50dfe74d8ada001ae342786697257e91e1e207255e6e2cda6
- SSDEEP 3072:V38DFxj9wHC/d7VLMTfWHom1T9VFyxON14t3zBnl5Fx/Yd1Zbafyue5O:V38DFxj6+OxNpl5Fx/01taDes
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 3520 rundll32mgr.exe 4948 WaterMark.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
resource yara_rule behavioral2/memory/3520-6-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3520-7-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3520-15-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4948-29-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3520-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3520-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3520-10-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3520-8-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4948-36-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4948-39-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4948-42-0x0000000000400000-0x0000000000421000-memory.dmp upx - Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\pxB6EC.tmp rundll32mgr.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe - Program crash 1 IoCs
pid pid_target Process procid_target 2084 4120 WerFault.exe 84 - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaterMark.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "944349279" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "941067961" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135384" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "944192745" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434837040" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31135384" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135384" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{63B78BFA-828B-11EF-939B-562BAB028465} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "941067961" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135384" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{63B2C757-828B-11EF-939B-562BAB028465} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 4948 WaterMark.exe 4948 WaterMark.exe 4948 WaterMark.exe 4948 WaterMark.exe 4948 WaterMark.exe 4948 WaterMark.exe 4948 WaterMark.exe 4948 WaterMark.exe 4948 WaterMark.exe 4948 WaterMark.exe 4948 WaterMark.exe 4948 WaterMark.exe 4948 WaterMark.exe 4948 WaterMark.exe 4948 WaterMark.exe 4948 WaterMark.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4948 WaterMark.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1920 iexplore.exe 2660 iexplore.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1920 iexplore.exe 1920 iexplore.exe 2660 iexplore.exe 2660 iexplore.exe 1680 IEXPLORE.EXE 1680 IEXPLORE.EXE 3264 IEXPLORE.EXE 3264 IEXPLORE.EXE 1680 IEXPLORE.EXE 1680 IEXPLORE.EXE - Suspicious use of UnmapMainImage 2 IoCs
pid Process 3520 rundll32mgr.exe 4948 WaterMark.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 4932 wrote to memory of 2988 4932 rundll32.exe 81 PID 4932 wrote to memory of 2988 4932 rundll32.exe 81 PID 4932 wrote to memory of 2988 4932 rundll32.exe 81 PID 2988 wrote to memory of 3520 2988 rundll32.exe 82 PID 2988 wrote to memory of 3520 2988 rundll32.exe 82 PID 2988 wrote to memory of 3520 2988 rundll32.exe 82 PID 3520 wrote to memory of 4948 3520 rundll32mgr.exe 83 PID 3520 wrote to memory of 4948 3520 rundll32mgr.exe 83 PID 3520 wrote to memory of 4948 3520 rundll32mgr.exe 83 PID 4948 wrote to memory of 4120 4948 WaterMark.exe 84 PID 4948 wrote to memory of 4120 4948 WaterMark.exe 84 PID 4948 wrote to memory of 4120 4948 WaterMark.exe 84 PID 4948 wrote to memory of 4120 4948 WaterMark.exe 84 PID 4948 wrote to memory of 4120 4948 WaterMark.exe 84 PID 4948 wrote to memory of 4120 4948 WaterMark.exe 84 PID 4948 wrote to memory of 4120 4948 WaterMark.exe 84 PID 4948 wrote to memory of 4120 4948 WaterMark.exe 84 PID 4948 wrote to memory of 4120 4948 WaterMark.exe 84 PID 4948 wrote to memory of 2660 4948 WaterMark.exe 89 PID 4948 wrote to memory of 2660 4948 WaterMark.exe 89 PID 4948 wrote to memory of 1920 4948 WaterMark.exe 90 PID 4948 wrote to memory of 1920 4948 WaterMark.exe 90 PID 1920 wrote to memory of 1680 1920 iexplore.exe 92 PID 2660 wrote to memory of 3264 2660 iexplore.exe 91 PID 1920 wrote to memory of 1680 1920 iexplore.exe 92 PID 1920 wrote to memory of 1680 1920 iexplore.exe 92 PID 2660 wrote to memory of 3264 2660 iexplore.exe 91 PID 2660 wrote to memory of 3264 2660 iexplore.exe 91
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\14bdf6fc0169d6126bde9ff2c980b04e_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\14bdf6fc0169d6126bde9ff2c980b04e_JaffaCakes118.dll,#12⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵PID:4120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 2046⤵
- Program crash
PID:2084
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2660 CREDAT:17410 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3264
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1920 CREDAT:17410 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1680
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4120 -ip 41201⤵PID:1472
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 471B
- SHA256 1ae4c8aa37bf433bc5b3b45e017c95bf843c7dbbe348c78c7ab6f3cad0fda4b8
- MD5 db7c83e09ebc4317f2bf2df7f66b8513
- SHA1 29d58ef43f72ce7cf79ce6109d038a6c9b4873f0
- SHA512 6eb46ae0c3e091ba13b1c0e3fb6de568882940df7968d0e1297568ea5356a4691f2a869c7c9ac9e9642bcc2e4e1388d00b15c663276143e8cb5015ab89c27867
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 404B
- SHA256 c0105792540bec306f2e309ce610f142ba62cd0c72fabbda89e4a200740572bd
- MD5 a8c653aa17e71810ee29493c3e99e7d2
- SHA1 bf615c0fd13b26a6568f20056ec1b63916d484ce
- SHA512 0cdc9d10241e9f1e13db41b5770bf745b51eb147d209427a379626bd87825bf5ddfc7a62fd9122e85ce1e4430e2ed892ece588fbb38afe16f6c4accac8c7f53b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 404B
- SHA256 7b66334308670c85b5fe2e982b7e2f4fdaf541a4b2e79539212ef2c32aab0887
- MD5 e11d16cfff4b55f03a4649b4d43877dd
- SHA1 a19a1060d1397b862183afa4a3381e0102d4db93
- SHA512 906ee1f7d428ba984dd0aa1bddbfebb073b54866272ac03ea16ecfc3dd7cfb292db1190003c3531e7d8919eeeff9a1d3f9f754a01173277775ace581721a40d1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{63B2C757-828B-11EF-939B-562BAB028465}.dat
- Size 4KB
- SHA256 bf526dd82dd9adc5ed8aae169f99689a7c61c7f8ad02b0505a468374020f4b43
- MD5 0ce48f0d36f8c3750ffeaf021f73debc
- SHA1 145dd2713de3ed93c33e1d1d291495bcaabcde7f
- SHA512 74a2dc9044584f8c544b91b9adf307f3bbacf7572ba59a57dfc80d04d9d590d18467023fbafdd23fa9b734fd9ad94fb3b46a21318781910ea7502eb325bcee60
- SSDEEP 12:rlfFyLjrEgm8Gj76FyTDrEgmf+IaCyoqw9lTqOEwC+C9lTqOEwCAGoEzIY:rGvG8aXGv/99lWgC9lWigI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{63B78BFA-828B-11EF-939B-562BAB028465}.dat
- Size 5KB
- SHA256 ec3f2e49b6f74d881de0290eb1bd18358acd37e1d8970c00e78b7bbe0cf24fbe
- MD5 6bc1e06f8574e89c4e47753e9de1e2dc
- SHA1 91703a135eba9337b0fc61da53c22b20d17a5943
- SHA512 269c57290e0db5f048acdcd65c498c38cb889a1a0d1056967d3a3ab4598763c4e652c6fe9d20aedd8638fac65a43024f6bb907c0df9cb85b226e76bbcba85f1d
- SSDEEP 24:rVoGo/Q62gTCGo/O2gTR2gT879lWFIG29lWFIG0:rOGo462XGom2Y2nCFIEFI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver394C.tmp
- Size 15KB
- SHA256 557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
- MD5 1a545d0052b581fbb2ab4c52133846bc
- SHA1 62f3266a9b9925cd6d98658b92adec673cbe3dd3
- SHA512 bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
- SSDEEP 384:79Jv9DF9/C9qc9/J9V791T9TK9Xf9Nm9xQ95a9BR9fV:79Jv9DF9/C9qc9/J9V791T9TK9Xf9NmT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T1CTRFUW\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\rundll32mgr.exe
- Size 60KB
- SHA256 ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed
- MD5 94f2f6ffbba8e7644668b51b39983916
- SHA1 63357bbdf90101969117983dbc0d4ed0e713c4d7
- SHA512 d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156
- SSDEEP 1536:SVZnxm6MG9xgfrvEaoiT/GyphjXDYjKwttoswRmhApEH:CnxwgxgfR/DVG7wBpEH
- MD5 SHA1 SHA512 SSDEEP