b8f64cabf9cd76735d77fd405a1635a0591eb7cbbd18830c47625b5c8936d20e

Analysis

max time kernel
147s
max time network
133s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 06:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Size

1013KB
MD5

16943270f05c11e266860bcd56bb20bb
SHA1

2a0cfe0c8c06938c00043858fa2aa81b6ddf3c98
SHA256

b8f64cabf9cd76735d77fd405a1635a0591eb7cbbd18830c47625b5c8936d20e
SHA512

2de21d417748ecc86ee8690ef0a6d63295961d013dc3e5f73b601a4041d730f1ad2d410d1f4b67322ac98ced3d77eb971793fdc3ffe99f386bd7f75e52d89def
SSDEEP

24576:ix+OSa0eVkMakTXBghG0dyMJqLDMMMMMMy6LD/dtfhS:ihp0eVbjqh9dYMMMMMMy6LD/drS

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	tazebama.dl_

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	tazebama.dl_

Executes dropped EXE 1 IoCs

pid	Process
1944	tazebama.dl_

Loads dropped DLL 3 IoCs

pid	Process
2328	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
2328	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
2328	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	tazebama.dl_
File opened (read-only)	\??\M:	tazebama.dl_
File opened (read-only)	\??\V:	tazebama.dl_
File opened (read-only)	\??\U:	tazebama.dl_
File opened (read-only)	\??\Q:	tazebama.dl_
File opened (read-only)	\??\N:	tazebama.dl_
File opened (read-only)	\??\J:	tazebama.dl_
File opened (read-only)	\??\I:	tazebama.dl_
File opened (read-only)	\??\H:	tazebama.dl_
File opened (read-only)	\??\Y:	tazebama.dl_
File opened (read-only)	\??\W:	tazebama.dl_
File opened (read-only)	\??\R:	tazebama.dl_
File opened (read-only)	\??\L:	tazebama.dl_
File opened (read-only)	\??\E:	tazebama.dl_
File opened (read-only)	\??\Z:	tazebama.dl_
File opened (read-only)	\??\X:	tazebama.dl_
File opened (read-only)	\??\T:	tazebama.dl_
File opened (read-only)	\??\S:	tazebama.dl_
File opened (read-only)	\??\O:	tazebama.dl_
File opened (read-only)	\??\K:	tazebama.dl_
File opened (read-only)	\??\G:	tazebama.dl_

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\CD Burning\autorun.inf	tazebama.dl_
File opened for modification	F:\autorun.inf	tazebama.dl_
File opened for modification	C:\autorun.inf	tazebama.dl_

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\EXCEL.EXE	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JVISUALVM.EXE	tazebama.dl_

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tazebama.dl_
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\WinRAR\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\DragDropHandlers\WinRAR\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR recovery volume"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0"	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\WinRAR	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1944	tazebama.dl_

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2328	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 1944	2328	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe	30
PID 2328 wrote to memory of 1944	2328	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe	30
PID 2328 wrote to memory of 1944	2328	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe	30
PID 2328 wrote to memory of 1944	2328	16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\16943270f05c11e266860bcd56bb20bb_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\autorun.inf

Filesize
126B

MD5
163e20cbccefcdd42f46e43a94173c46

SHA1
4c7b5048e8608e2a75799e00ecf1bbb4773279ae

SHA256
7780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e

SHA512
e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8

Download Submit
C:\zPharaoh.exe

Filesize
151KB

MD5
94c0eec8497f7f326eb35d7bd66c2c59

SHA1
89f5f2d228a95e77dc4f40d290e4b7696d0ff3db

SHA256
385c5cb7e5b188c6b41f183aa2ac7cfe3c3bea7a4b6d71acd1145b7bfb2a1de1

SHA512
0c4fb2b0ac26b299e01729c94bed6d9271fb8837db1540a567d2c2473285f6c41420fa4791c3b155a7cbc856155058832a2fc35d968c423cb08ec449bf8ee801

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-4177215427-74451935-3209572229-1000\RCXB28F.tmp

Filesize
69KB

MD5
bf2277f6e811a8e7c4c9eb72b803e433

SHA1
e52c984d30aa770817bcab76d54c762abe9eec2a

SHA256
b20c1d76f46d86fabcd756f4db7ee2bde81be9355a1ff891172566c5457691db

SHA512
c2848a7555496b400e019dd8dc41baf38c6f07fca1ed6d2536efa30dd3c2b00d7c3ee6320bc75c63f3efcceadbd5649abeffb82e55191c98f7f1b95e76cf6edc

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-4177215427-74451935-3209572229-1000\S-1-5-21-4177215427-74451935-3209572229-1000 .exe

Filesize
151KB

MD5
a2630f5e1a54cde9e47daa99a18a335b

SHA1
7c0133edee5401140ffde617bfb589753c39afd1

SHA256
053c26f41cc3025a27d0a2d04f2c3155954131c27be723def2f873a8afc308cc

SHA512
f5d52deff92906058c4b707b8ecdcbba39b316638b3a71cb6d2f36f698fc19ad99ba63e4e4d346d16b867a9cf4c70546ecf39acf3c92ad57ae0910b8beff0c3c

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-4177215427-74451935-3209572229-1000\WinrRarSerialInstall.exe

Filesize
71KB

MD5
a35ce2412fd7df3e8065475defc82730

SHA1
1db02ed0e46299fec20b2343a0bd4211ed32217b

SHA256
d6fc7c8b8bad1ecd16b14e69c4f745c759de2663bd00c9e01554a2153a28e2db

SHA512
64331a7223554dc986f3804e4945d2a478170acfc6bc3955cef0e80a4e9d99fb73dfddbce1005ed0405e8c1ea6734bfdffdbd19aca9d833f7729854c2b2c8628

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-4177215427-74451935-3209572229-1000\WinrRarSerialInstall.exe

Filesize
151KB

MD5
a2861c89f56c7fe6bf54018f79759dce

SHA1
c21313ae7665c7fef07f7de9c2346defc97efe1f

SHA256
7bf06e4d053de6997db3bd98a622e8e364b557bd4b449f33c001d6a9e6e90cd9

SHA512
fc0435605109830adde713402b18411adeb7dd54db7f9fb77b3c49c05e00cd22b19358f41a44d26435f3df3ff5dfa74c9c3d7ea59066a4933b15d0456f7bb20f

Download Submit
F:\zPharaoh.exe

Filesize
152KB

MD5
165cf39256b3ff6dea92eb578d9c414f

SHA1
7f3b452808973f9096977e7123afc7d289c49262

SHA256
1ffad65440b417a14dfd1425f10c22afb45ab4379dc769fdc7fc618d2a7a92c1

SHA512
6b1b4d5790dbfef47b7ed0ab42722e384708bfbd70f23657a7eebedbfb6b95952f50e00796a56f13cea540720bd903c89a5e8aa6fdc2a3629733838f62a98245

Download Submit
\Users\tazebama.dl_

Filesize
151KB

MD5
0e141dae671d401855632dedfd7045ea

SHA1
c033c687495f1789485b8c2b6fb1e4509b94d03d

SHA256
a17f31fa26805f36024c4cd49827ae1ccaa8dc3443d4e186cc6e224e33bc63ac

SHA512
4697f437703eda0c564ef592a513574829b24e227dedd04653546b37ffb41c6d8f82fb9e355beb4466458804a472b567368c6e974a3cd1b51190c8b38e3a5d17

Download Submit
\Users\tazebama.dll

Filesize
32KB

MD5
b6a03576e595afacb37ada2f1d5a0529

SHA1
d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8

SHA256
1707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad

SHA512
181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c

Download Submit
memory/1944-531-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1944-16-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2328-14-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2328-8-0x0000000001D60000-0x0000000001D76000-memory.dmp

Filesize
88KB

Download
memory/2328-13-0x0000000001D60000-0x0000000001D76000-memory.dmp

Filesize
88KB

Download
memory/2328-0-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/2328-145-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/2328-196-0x0000000000400000-0x0000000000518000-memory.dmp

Filesize
1.1MB

Download
memory/2328-512-0x0000000001D60000-0x0000000001D76000-memory.dmp

Filesize
88KB

Download
memory/2328-529-0x0000000001D60000-0x0000000001D76000-memory.dmp

Filesize
88KB

Download
memory/2328-6-0x0000000000240000-0x0000000000358000-memory.dmp

Filesize
1.1MB

Download