Malware Analysis Report

2024-10-19 10:43

Sample ID 241007-knl64swerk
Target 1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118
SHA256 84466b849c2ee067c513dadc5a23951636b3abd8b41f0e9d7bbcf974a4fe1446
Tags
xorist bootkit discovery persistence ransomware spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

84466b849c2ee067c513dadc5a23951636b3abd8b41f0e9d7bbcf974a4fe1446

Threat Level: Known bad

The file 1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

xorist bootkit discovery persistence ransomware spyware stealer upx

Xorist Ransomware

Detected Xorist Ransomware

Renames multiple (2135) files with added filename extension

Renames multiple (97) files with added filename extension

Reads user/profile data of web browsers

Checks computer location settings

Executes dropped EXE

Drops startup file

Checks BIOS information in registry

Loads dropped DLL

Adds Run key to start application

Writes to the Master Boot Record (MBR)

Drops file in System32 directory

UPX packed file

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Modifies data under HKEY_USERS

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-07 08:44

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-07 08:44

Reported

2024-10-07 08:45

Platform

win7-20240903-en

Max time kernel

8s

Max time network

8s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe"

Signatures

Detected Xorist Ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xorist Ransomware

ransomware xorist

Renames multiple (2135) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\îáõîä.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FKDECIFFBGEOHMO = "C:\\Windows\\system32\\mbr-locker.exe" C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kw0mB3PsO47k94v.exe" C:\Windows\SysWOW64\coder.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A
File opened for modification \??\PHYSICALDRIVE0 C:\Windows\SysWOW64\mbr-locker.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\coder.exe C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\coder.exe C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\mbr-locker.exe C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\mbr-locker.exe C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\îáõîä.exe C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\îáõîä.exe C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\ufr_reports C:\Windows\SysWOW64\îáõîä.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101863.BMP C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\15.png C:\Windows\SysWOW64\coder.exe N/A
File created C:\Program Files\Java\jre7\lib\management\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\THMBNAIL.PNG C:\Windows\SysWOW64\coder.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\activity16v.png C:\Windows\SysWOW64\coder.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\calendar.html C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15168_.GIF C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115863.GIF C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\LAUNCH.GIF C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Interface.zip C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\UndoStep.mp3 C:\Windows\SysWOW64\coder.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143743.GIF C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_sun.png C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\16.png C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR51B.GIF C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_down.png C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\THMBNAIL.PNG C:\Windows\SysWOW64\coder.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\text_renderer\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_left.png C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_snow.png C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099191.JPG C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png C:\Windows\SysWOW64\coder.exe N/A
File created C:\Program Files (x86)\Windows NT\Accessories\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\19.png C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\42.png C:\Windows\SysWOW64\coder.exe N/A
File created C:\Program Files\VideoLAN\VLC\hrtfs\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Peacock.htm C:\Windows\SysWOW64\coder.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Program Files\Windows Defender\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\43.png C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\picturePuzzle.html C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\36.png C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\view.html C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\cpu.html C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\calendar.html C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_lrg.png C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\picturePuzzle.html C:\Windows\SysWOW64\coder.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR8B.GIF C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR1F.GIF C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_left.gif C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf C:\Windows\SysWOW64\coder.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\DELETE.GIF C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsFormTemplate.html C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\Java\jre7\Welcome.html C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_top.png C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR8F.GIF C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png C:\Windows\SysWOW64\coder.exe N/A
File created C:\Program Files\Java\jre7\lib\images\cursors\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-crescent.png C:\Windows\SysWOW64\coder.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv C:\Windows\SysWOW64\coder.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_en_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.dtc.resources\3.0.0.0_es_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\sysglobl\857fbc76bdd79711e5228e5b075ade49\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Web.8dc504e4#\53cf54ff35686c4044952a8cf8b8021e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_en_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\System.Data.OracleClient.resources\2.0.0.0_de_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_fr_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_it_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_it_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\SecurityAuditPoliciesSnapIn.resources\6.1.0.0_es_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\system.management.resources\2.0.0.0_ja_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Tas#\3cf3740de20740208d614d330aa4416c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Te3736ca4#\f0a8400b761cf5680fd7fdd7db26181c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\office\14.0.0.0__71e9bce111e9429c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\WindowsFormsIntegration.resources\3.0.0.0_es_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\e4031bd0b7706fd0a686e9bb6353aa2a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\6f4c8aeb8f066adf5cafedbec0cac415\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8df695fb80187f65208d87229e81e8a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\de64901e4cd2074f5c70733ab5d7787a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\System.AddIn\ed852e32514b415cfb4ac81aef9ac0fd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessData.Intl\14.0.0.0__71e9bce111e9429c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\1.0.0.0_it_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\policy.3.5.System.Data.SqlServerCe.Entity\3.5.0.0__89845dcd8080cc91\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\sysglobl.resources\2.0.0.0_de_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\WindowsFormsIntegration\3.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Web.Services\15edb548fa79197e66dc803215bd391b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_64\mcstoredb\6.1.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor\1.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap.resources\2.0.0.0_ja_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_fr_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Security.#\84ebf4aede3a599b943b3320ca704911\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\WindowsFormsIntegra#\0cb1830849e0ce11c8985339523d5b63\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\047c9c4a6b9dcd9d1985b95e0f4f1daa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\NativeImages_v4.0.30319_32\dfsvc\261c09179eae03d67c9b6f3e70b603bd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio49d6fefe#\f52bfe40c54917622ed3abb98db8f90a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\14.0.0.0__71e9bce111e9429c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\10.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\napsnap.resources\6.1.0.0_es_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Outlook\14.0.0.0__71e9bce111e9429c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\UIAutomationTypes.resources\3.0.0.0_it_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Services\c335a6ef5339fa917518475c286c8ca4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\MCESidebarCtrl\6.1.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\9.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_it_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\SrpUxSnapIn\6.1.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\System.Data.OracleClient.resources\2.0.0.0_it_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\461d3b6b3f43e6fbe6c897d5936e17e4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\PresentationFramewo#\c462be068987b2b4fac3a700f265fc77\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Accessibility\c9bdcf9e45459b60e542e8f270de0c52\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\ehiBmlDataCarousel\6.1.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_it_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\SMDiagnostics\4b5adb098f8ce2890826195454a777b2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Windows\assembly\GAC_MSIL\system.io.log.resources\3.0.0.0_it_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mbr-locker.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\sCheat.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\îáõîä.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd C:\Windows\SysWOW64\coder.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VVYJXUMQZAEMRMB\ = "CRYPTED!" C:\Windows\SysWOW64\coder.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VVYJXUMQZAEMRMB\DefaultIcon C:\Windows\SysWOW64\coder.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VVYJXUMQZAEMRMB\shell C:\Windows\SysWOW64\coder.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VVYJXUMQZAEMRMB\shell\open C:\Windows\SysWOW64\coder.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "VVYJXUMQZAEMRMB" C:\Windows\SysWOW64\coder.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VVYJXUMQZAEMRMB C:\Windows\SysWOW64\coder.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VVYJXUMQZAEMRMB\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kw0mB3PsO47k94v.exe,0" C:\Windows\SysWOW64\coder.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VVYJXUMQZAEMRMB\shell\open\command C:\Windows\SysWOW64\coder.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VVYJXUMQZAEMRMB\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kw0mB3PsO47k94v.exe" C:\Windows\SysWOW64\coder.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\îáõîä.exe N/A
N/A N/A C:\Windows\SysWOW64\îáõîä.exe N/A
N/A N/A C:\Windows\SysWOW64\îáõîä.exe N/A
N/A N/A C:\Windows\SysWOW64\îáõîä.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sCheat.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sCheat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sCheat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sCheat.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2400 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe C:\Windows\SysWOW64\coder.exe
PID 2400 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe C:\Windows\SysWOW64\coder.exe
PID 2400 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe C:\Windows\SysWOW64\coder.exe
PID 2400 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe C:\Windows\SysWOW64\coder.exe
PID 2400 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe C:\Windows\SysWOW64\mbr-locker.exe
PID 2400 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe C:\Windows\SysWOW64\mbr-locker.exe
PID 2400 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe C:\Windows\SysWOW64\mbr-locker.exe
PID 2400 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe C:\Windows\SysWOW64\mbr-locker.exe
PID 2400 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe C:\Windows\SysWOW64\îáõîä.exe
PID 2400 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe C:\Windows\SysWOW64\îáõîä.exe
PID 2400 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe C:\Windows\SysWOW64\îáõîä.exe
PID 2400 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe C:\Windows\SysWOW64\îáõîä.exe
PID 2580 wrote to memory of 2160 N/A C:\Windows\SysWOW64\mbr-locker.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 2580 wrote to memory of 2160 N/A C:\Windows\SysWOW64\mbr-locker.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 2580 wrote to memory of 2160 N/A C:\Windows\SysWOW64\mbr-locker.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 2580 wrote to memory of 2160 N/A C:\Windows\SysWOW64\mbr-locker.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 2400 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\sCheat.exe
PID 2400 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\sCheat.exe
PID 2400 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\sCheat.exe
PID 2400 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\sCheat.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe"

C:\Windows\SysWOW64\coder.exe

"C:\Windows\system32\coder.exe"

C:\Windows\SysWOW64\mbr-locker.exe

"C:\Windows\system32\mbr-locker.exe"

C:\Windows\SysWOW64\îáõîä.exe

"C:\Windows\system32\îáõîä.exe"

C:\Users\Admin\AppData\Local\Temp\sys3.exe

C:\Users\Admin\AppData\Local\Temp\\sys3.exe

C:\Users\Admin\AppData\Local\Temp\sCheat.exe

"C:\Users\Admin\AppData\Local\Temp\sCheat.exe"

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

Country Destination Domain Proto
US 8.8.8.8:53 thehunter.clan.su udp
US 213.174.157.151:21 thehunter.clan.su tcp

Files

C:\Windows\SysWOW64\coder.exe

MD5 d871ac0f3fdcc234f1ba4f39bc76e6fb
SHA1 010fcadadce613eb45923dbbdee46440e8f74bb6
SHA256 08e15773a4caf5225e95ee3f9ebf2ca67b3d500053fb316dea875d5cf361271f
SHA512 0f56b1689661bd0978cfaa16876bd4b2ab3f0b1f6d1ec25bb09d1ea7e9b0a4e888972dbc32d272aa02ddc646061c901c6fed8de586c9406e56c4b9b925dec114

\Windows\SysWOW64\îáõîä.exe

MD5 e04fb60dc115ddc2368000bf4b7b934e
SHA1 60b33f31232a454120e1184bbc502577b9fe3ee5
SHA256 c1fc945b7aeca62e7af8b72663aeb676274360e0b05a8b1a12342e11e25ac109
SHA512 e59c2dc3e379ac2da1cba83895c9ae93f0a64146ebb593185081161aa0e88a9ebd617b57e0aca7d2f5e8bcd051460252ed8261b9f2cb7611e40bd98e448b5fcc

memory/2400-41-0x00000000029B0000-0x0000000002A04000-memory.dmp

memory/2580-35-0x000000002AA00000-0x000000002AA05000-memory.dmp

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

MD5 c0b2257570b3d11be28c93253aaae5f0
SHA1 b1f20d760a1cdeee566d7857deb88ca451c33722
SHA256 ffb6468be6a66d973ef143bf7cf8d059139bb15ca521c5296a3337457bfcc960
SHA512 69e3afd798ad3708e2dfcc9f5dd99e2593ed5f9ba45a7037845370236aa5d7893d407e4ec515498d4d11d933aa1a67031f605857932d829c2644f4b355bfa7c7

C:\Windows\SysWOW64\mbr-locker.exe

MD5 5201eb8656d7f823e7d5253aeda7b5f7
SHA1 01ae8f476827afe420ae806c1a7654770342ff1c
SHA256 6e657c98282a118321c09cf76edef34deeb2d067cea41f4c130e32044830b865
SHA512 1b3ad3a18801c02522b069eee9253ddbdfac7414531eaa4ec9211dc7f3ef051e4fe984c451309f1d265bff96efbdc10d5004f7d5b329b20c52a4861a0daed923

memory/2400-29-0x000000002AA00000-0x000000002AA05000-memory.dmp

memory/2400-28-0x000000002AA00000-0x000000002AA05000-memory.dmp

memory/2792-27-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2400-26-0x00000000003F0000-0x00000000003FC000-memory.dmp

memory/2400-25-0x00000000003F0000-0x00000000003FC000-memory.dmp

memory/2580-111-0x000000002AA00000-0x000000002AA05000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sCheat.exe

MD5 af14998ea9c9a7ab8250a8b9243b5505
SHA1 a868c979df09e426498618cac6301cf9d23e12c8
SHA256 469af5ff07386de5c8a0d7e6766820f76ec550ed730d108f7f654053f4d7b3ba
SHA512 50ca46efa70cdbe3dec881989dd79a099ec2076b93d7cf6a9a4a728ca26cc276efab534e4a9fb2e0e8bd8a22fda7fbc4cb5603beeb0e592b6d5c4d241d83eb39

memory/2400-184-0x0000000002AB0000-0x0000000002B23000-memory.dmp

memory/1576-221-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2792-216-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\systm.txt

MD5 0f6aeead10fa4e4345421a9344920b54
SHA1 8c3fb95046aa8a49de5e0125a1734f6a61e1de9c
SHA256 f7fd935a5b2e344a8528c666005d010bb7fd75785075f4dbb89973f151409ee4
SHA512 dbd688e79df1af689e583e9835cb03e22769313ec38f69ef59934258f296a40e8495b62fec47ee2b60e7cb531b917ac23ca16f14519413c637588a7522f0eca0

memory/2160-131-0x000000002AA00000-0x000000002AA05000-memory.dmp

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

MD5 c24bed06f9d37678547e369d21d81703
SHA1 8ae160bf9c89239278f886958e798e1cc2d75285
SHA256 d0e94ad0df9568271e812031926b4feacee4f40e5055c35eea1c779050806388
SHA512 00e1318811f53b91157af339ab847d87ab412186c47e9c556944199305d417c82baf26e6ee367851dc88c3eaf65ee36be86ec0fe8b35244a21a1185eb9a0f3d1

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

MD5 d2e238a73ac543be5a94c32a677a3c5b
SHA1 41c7c0533fbb2b80d20c71b1757b0e3ed52b8410
SHA256 991acd5499ba2906b48b573d86d3bf7c0844ff510a66526716e58ae39d3168bb
SHA512 926c3a65607896407d2f08435dff1ee63d0c4ad4727f34136958ac72e5ccbf80953b73f370bd5ad05293ea07b906a9e51fe5500fbd00106e88888179d23bec62

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

MD5 170a009f286f64b04983a2cb0d6c0a6a
SHA1 9d93680ffdffa9ed3fa3a2c27526a26c088264d8
SHA256 6c894f58c4da7248016f46f5573f2477ededf3383b5abd91632aa7bc3e8e9e2f
SHA512 1ff647d65606a8ed746532d340aee4d0888cce4abf64c4c87ef7dbe6c98b27ca842b35eba880bccbcccc6e36e2358fc2f60ad1e241b4ab8472c2d8c9b9af4bf2

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

MD5 9c62c0343da69daa97dfbac108fb505d
SHA1 9830904f183ef2d8477806c1989e3100c7c44e6a
SHA256 5aadd27f7d6fe4334cb929732a45a4b162c062e39aa485152e00c668fdcbe4bd
SHA512 6e7255a12de373645ed31df9ddd3f855dece2db9ba91694f7a47d63ec6135a446b0eb6b99875b659b258aa1f1b228dad14fd1b4426bf4be78c2dbfecca044ccc

memory/1532-726-0x0000000000400000-0x0000000000454000-memory.dmp

C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

MD5 a43208416d8efbb316dc51718cf78ae6
SHA1 5c63f432ef8d6420e0944b426f11710a90b19644
SHA256 139d93b4e621e7fb6c27c22bf49b5e8d99d859157c082e8bb0c7ec8d68d54e3d
SHA512 83d0bf95e05888c9fac2b456af542ec34e51b1d96095a49e14f0a645bcd39464434afc0007544ee1880a1b718772be9a96abd464524b8bae4af1875d33e289f4

C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

MD5 6f08c5d373100227c9cf74702f13ed5d
SHA1 0948fc745b7ead85b80ec2da3c3ee671d59e7179
SHA256 3d2c10ec591666295411fedbcad978fe2e9b40caa786d141e54d656bba6e41bd
SHA512 937ea0b91ea16cad8c0f6b25aedc26f9599afdb4a4d761a65d971d1543b1c4680001df686676946ea5354adf6fc90586d700f5c8e787abca5be76b1b50ef1bf1

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

MD5 475af4774b716d3df0c6cd013a794f33
SHA1 9970fc0ecbf70aa738e3375a828d59cbfd5acff3
SHA256 0f5ff26cdf1f3402c0878549149096156ceffa7a15186c3f4a130a1b327562fd
SHA512 acf9fae0abc072a025cda988ae82970fea23d41adba09573237aec30bd9888da0d3157926618c545edb84904638491b285c1ebdd48b6ed75205278b9810397d8

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

MD5 4afd37380eeacfbd5bd1925af1761994
SHA1 99e53512d67a092691f7dddf6da5c6f03c177113
SHA256 07ab3fcff54552de3f924550fdf0b9870ecbc55b25b9ffef3d3ad903f09b4e9c
SHA512 677576d6b2b5a896a5781a5d9154a7e354d987f8287123f2063e965731ae4afef26ed691ec21191a321e1df8d2a89694224dadf9129aaf1ee83178cbcd72f88a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

MD5 251d0795e02f4908a697f52c7558649a
SHA1 ac912cef5f707f2e1d270397c6275cf3136d474c
SHA256 ffe4950ed86117f6258268e010f338b417d0e01b0438dfb8bc63d261b5fdb689
SHA512 aa01ba576f33de3b2a2fed86cf2b5ccc28ca115bb5db97d03a92d3eb65e6a0fbf6981b25b451bde6cf2f77b397efa83a5b9cbb4cf9ebbfad66cba6ed65eed167

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

MD5 cbdadf836e7675b9126c3667b1173bf3
SHA1 e68d9f5ab18913e80a902303c211bdae88bcbddb
SHA256 fb09b04b47fb3c9204a39fe846fccc6160d5d26a9c1e87be74e2e9cfed030032
SHA512 9accf4a28b13f88ced12666453197372a6ef5c7129c456da32ccfa777a2dfa8b70b5536b9108cab612448f4987b4a777b3ade15470040e00ac6c3a3ccb0ee9ac

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

MD5 6dc9b8ff19d7f9bfc2b85dae150dffde
SHA1 7c90ad49bf9fb84f86011ea6ff6cc5881175f43b
SHA256 fa504d9c7abf7434e32845561c42e1e8765695dda8f7569ee6b5164c6d249288
SHA512 7c60bd2f89b4bac1cfc26ed917f97897330b7a579b6744f1072fe11c093946673aa0e9551e834ae4bee2a354056e3748aa36f993150f8e06bb4e556021f3d216

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

MD5 8057464350540c86167d1836a3412ba8
SHA1 749f11c9c7b93b0079c8ee99c9671bd9a6adbe63
SHA256 bd256d7d23f61f7fe66ee7794904169f91401368c39039df53efafcd20ed084c
SHA512 c7a45150fbe81babb3e95600f31d8b8019729c23b2ce5b0de585d407de44b28703d429caacbcf44b4f8ce58415730e96965a6ae870290f65da7dbb516ebdf0f7

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

MD5 c27d1494ca15586d52cb1841764c679a
SHA1 3eded7082e34a0bb86acb9e9825a2398f15f9b8d
SHA256 e553f68da7f31dfb66331dabf0070fe8ba82e9fd8d5a46297a0642606c3959c3
SHA512 7a418af2ffca99c09ba805c40aec8c1311b18cbbad91590fb8577991e66ce8257c01e3823c492db75d1b82df5f7fd809d9e6514a092cc5ece9d0c7b5802d8083

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

MD5 3a95e917c5387ba1f35d07096366d33c
SHA1 423619a2aedc6373689d3477cbabcc6b69eaac9d
SHA256 11f1ac2f335b77d0e5c35dca393947aa3b420eeea0d8a0c511fdfe2dee8f22d1
SHA512 6b255853b23ff22cfbc561fbf32ac9a3246ded29953abaee2d7797e4ba401ca396dab6df022746738f76d62185bdd2604bf369de737ed26e6e4ecbd6be8b00df

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

MD5 7ff431e64d62f7f67897735c119c3b54
SHA1 7329ae3d6ef68f65866417bc4788144a5f7489c4
SHA256 d00731aa8322ae623362504a50cb8ac109f27332f90c50aa19f7a594c563bc44
SHA512 cc65e78c1ed0ef1bbcb65b548ddf322e03ed2303fb6a541b8a7639b331d714bcc2900898d547bc4a0ef22965c621f102c858ec0a2f1faebbd86bbff1485b12ab

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

MD5 697413b98ba480cf0a451d70eebdd2ce
SHA1 7daaa3e5a66778d29d95e186073c16cf016f08b2
SHA256 960ede92876afa3ab99cf12d8a7c8408bbc82269f7fb3c5e1674e857e7c9fa86
SHA512 bd1a4ea965a02eea0f5567f3d8d8e2d62afdeae107179d0a42d87ce5e23844f2c38c40f42136889f04ab697e81f6b5590eca14c79972e787cc89ec2c6f224c6b

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

MD5 95bae6e36bf56b230f9a00adbdf7e50c
SHA1 1d8f52973bebbeba259a216723beb0473000faad
SHA256 e2b9e3fa909d6f0bbf31ee0674eb536705b1f0219beaec4c6044f6dab87b43d5
SHA512 1afd331f937f20321c1b848a2513476bf01f29dfdf9a8786f753118d439385209a408f703479dfbddd10e77dd45d33a4fbbb46d6722e75ee75281ad208f1070c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

MD5 1d4acd08b387629d35af14017e2211d6
SHA1 29b7bae838c7fc797f4327b776f133846ad75268
SHA256 5f51622cc9bbe4a39bfef63aaa17c373efcbc3d968ebaf923598c3a2cbd2d5c4
SHA512 f6e12421b7b508a9939fee91448f60a3f2a55469b90eab3e9470a37333ace6bc91aed5a5e0d97d1fdd7478d2d747c11582e67eaa9ff7e38093e895daab007e4a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

MD5 d2a8b2dbe4eb63342c2df2546a9dc51d
SHA1 9fcf05828effe7b5f443ccea9f308a6b4a85b0b2
SHA256 0dbf94003078f484afc446774c7444c3bc3841f988153da4af7e721ad8c3c1d0
SHA512 3cda7c01cb57c0b5cd43a2dbf62457e6ece4be10fe98076c012e3b814934a725b40484fe41bde3dbe47ed3d131a5fd85f43e428219810b5ef6a26d40d0a78046

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

MD5 83bf8bd297b62b9b7bd883cf064a4eaf
SHA1 007c2e624d4d8417971144656b383d0f28e42116
SHA256 6777155f2459bab5d0dd1a248fbed0d92ede1d2496ce8d8549e93e63683bdbb4
SHA512 e7bc26366d8342f954ecf917405bd1ea82fbebed9d6e89bbc4e80d549499055a3387ef30cb6dd4e6447204b24e11f275277bb83bebceb312854b46f89d611814

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

MD5 bb215a420138ea7fa0c0f5316653b101
SHA1 3e6c69caf21965b6af776e2dbff9a5fbda1f66d4
SHA256 9a896bd98fac7a0061e5a6d2be728711e4358dd8126452233140d4989daf9c5d
SHA512 2349164bdf71d1041f4bd1808c592a3c1ac85e26db88e58da2d854c0c2f5070a3455a0f8477ff1e9d5a2b789125e157f3044c7e7af9d0533e3d71ade6ca9e231

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

MD5 be016f138485190086c78f14435ca157
SHA1 503885271e09ba1b0cbb1cbf513f955877f21fc0
SHA256 2323c289ea101d929d88ba31834651fee5378936b611b6f9f1077718ab7f2970
SHA512 1aa54fe2cf887f6f8640a54e17c050e3e27be6f851e3222f07be1f60633ce74d583ef3d640ea3c0a71a726b7d73f8565484a85bbe55cead7117128d0ecc2f91f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF.EnCiPhErEd

MD5 8ea36ea04fac8af05bd3cbc192d84616
SHA1 5d77922ed3dbea8857674f517fb0536a0cf16898
SHA256 5ea8c69da03283a79a20ddf34405e166bad83db8822272b94070a23ba5cb5a1d
SHA512 6b1bd07a3133741bb6d25b4e67a56bb9a3b8bd7e4177903f88011bd252831781f31e8619ee36969e4157f560ac7eae876af87d8bd07d740ccf73f8bb4b469af8

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

MD5 28651b6b36ea6459f6af37b5f240a7e7
SHA1 d52610a41f409cb4cae1a25a7ba6efc1eb53de22
SHA256 b016a0a40de28a15e3cdabe03205200b7de980b581dfcfb505585b8044f59dc0
SHA512 04b67ef0884805d380108e78623505ae5ffb237b032b22ef2eadbdcbacb6ee20220e03bd48368939d1e48835e62036cdfa385a7422a3b6c701fa882274f39cd0

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

MD5 690fbcc8ad0a090799c4cacf094b7296
SHA1 ff59a23aa15b4d29d071416430e6814d49c6bc31
SHA256 dbc6fc1b264fa8211a14d0ac02c514fe2de70cc4fa1650e48c07c1e5f5587c8f
SHA512 91af63f5579516f7936dc8a475d91488dac9ba10956f37a2ff428c681aa78b56978f7987b33be5719adbd19595540d3e63fadd2732c80304206e7d35250f7459

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

MD5 8b59efcdaa7a15c258ca0f623dd53bd1
SHA1 b10f121fb7c116fde6bc760ff22e7b32b7702530
SHA256 51c9f541ea09ef5bdb6d51fbedaec825792a02c5e661476dc9794009203ad345
SHA512 d86356191fe096246d3ed242c217c4b9baab2d76d84da677dcadab46cc1a4b77773d937df6d29b42fe7c8cbbf280f2573b056551be5b5335b2d9752bffcdb707

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

MD5 12670ee65ab502bc67092e64c874a329
SHA1 2d7419d99e512db235aaffaf5c10c279516b5494
SHA256 6a8ff5c576e6f48d590abd5b8233e8ea789ddfbd6b229c43b386b42f89906fc5
SHA512 7011d1a2203e8fb03fa3827f59e005f2b5ef9ae69bce2b575d9bfc763fb77fb42c3ecfc400b46e6a789d482a5937e11117d8132d87b02f6498580b098b1f8ed4

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

MD5 5cf0d972cc019311b5a3447d4295548c
SHA1 0d83cd93ef37efa00a5ae95879af8cdc86ebddc4
SHA256 d988c1e3bb552c55dfd8d323c6353ba428075344bf244e2d03ae78d3d5081a47
SHA512 0276dad1e71c875cbb75d08aae6cc899a8de582c31c16fede82afef61d9cd3bc47d09ce2432080fd9ef0ad8c5e23fbe2789ddefd5537b6d5a932771134f773e3

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

MD5 7ea2b99ebe3464194144168a40f15393
SHA1 95a3649f8014a197fa9f490cad68b78856078a87
SHA256 a5ee4e77c050d600e4f728eb5ed04d1da83f80f56c2bbe77d9d2446260c4f69b
SHA512 3a74f92ea2fb0a3f4b439cfb4ef7028c05a7d30015407e72da16519802c5a29ebad77c7d6031e7e795c912c318062c44b711f77d30f4b9a47bf057c5d0299cb0

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

MD5 7117acbe01c96582aaac4b54a7808ddf
SHA1 c380af84077c961b7e34f701d7628c8510f6cdbf
SHA256 733418d03ebdc360b0e16f6abaa5aae46f508e3311604a816e1a79e46d20abdb
SHA512 b323a1a87ea66e275265cb49305f04912e2628c91826765423f0c2be552dc29e4186786c80f2ffa198898a6cc3d407619ebb90ace87440cd7cc4c002a8ae33b2

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

MD5 f38dfaeade4cc44ed0c95b5937555c47
SHA1 52d6e20188d7c8aa42fbfb25462eab518f56d34c
SHA256 a1ea14168ed891557764f748e6574475fb839f2f6dac08618c0c5a497ef1ac7a
SHA512 6e36fc4eb6b07171f1bea3d27e19284a0996b6792b5a18c121231aedf659c1852c63280e05652df5041458cd0965680f26cc4456f6d7c42690da1834c8aedf60

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

MD5 c706d2a15c9a2c30707124b5e62ef17c
SHA1 0b8bb51447a42c5530c2ccb6793e551576a11419
SHA256 16bc2af87359ea4b203c27d3a612ae625b931f6de367cc361732518ae7e60ded
SHA512 2d8659359e46fa1de764e67e7a8f536ac5dac60c2361ed3ee6f346afb88c869133cb4439738f7e1fff042f588bf9b271a63b0fe8e968d14e110afff6b48ff6fd

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

MD5 e56c59dc6bafbb023fd75247185e616e
SHA1 9cf2adc3dc16041d9be2e059220d119b9ac48099
SHA256 913b5ca24f1a64a4624138262c57e26638e62dd20cbaadfc315a61b49e1bef5d
SHA512 1cedb2c7a7d62705d354fcbec731b9e13f48f6ed82ff40dfb18733d779fe910bcdeb435d1da5f6776d05c15cad75b0bd303f581de3020492195205806939115d

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

MD5 8725a47e2b4a638ecda640ef12c1c716
SHA1 0c2ae79baf09bcdd6e8ea33b5b46bff517623562
SHA256 e57bb69635a0984db010e04121a605566ae715e31387865d04c594c5e3e6a39c
SHA512 8c8a665e5be765e5fa969fa3369f6929514206b06863a64c6922be4600840d56e90626edd80b0afff654bb3f9b57f28a9449d3278dfe801cddb97bc85030aca5

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

MD5 a2fa414864329cb6af0cb1670e331b17
SHA1 ea235740243c0472f1cad5e05d36039071ded47d
SHA256 f2a2705d69160412b4d61c373a7072e887f7a1a07e5095d94be3586411f85c45
SHA512 c7116f5d03e594016a1953cdf0b7ce777c543c7cf775363be8414c2405fcd37600f597b8fa69fcdb70ba01d40d46917fff07df3ff5f154bf166602f6fd6d1636

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

MD5 42cc2bc165ec2a17715085e45b2f2236
SHA1 04b786f366fa92ace208c53c8365b1cd342efc25
SHA256 ed6dfd83b22234bfebbedadd554add9c2b77608e1907a97a6ced3c39c9e2412c
SHA512 de7d642850d117503699dc2efc342b48809c1bcde46e00e0802b261f45f3908766533c0e8463ca8588fd1e7b9b98649a43bcb247ef22b95152669af228006ecc

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

MD5 54aaacb189f68d4e876d8ba913a1d06b
SHA1 dd1580e73c4f51a9021bd99ddeb2441567bb24b1
SHA256 117642d4b484b152cdabb423dfeadeeb47189636956a6324d440225bacdffd62
SHA512 c65d089701dc8ba3e18a99c28d601b34bc59738eb79d9b22ec5d38a33779eb6a6b93a80e6263999597ac67ce7e1e4ff7e760eaf6072d4bc6d72b73896d0ec66e

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

MD5 7c48c0c1487c87b144a782c438fc75d5
SHA1 418f7978643202faa42321b5cfc3d6edf5b4e04f
SHA256 9d88418958aa0822fb5b12a337457f3e798eeaf7a1bc464c38ebd91e9e9bc599
SHA512 4f8e904e8d49c89453f356308f8b2f3db61d29b82c00370686f1f3a04f568eee0eccb24f2e118aceaaa29b878c26d297cd26efdb098a786d5c3d0bf932720376

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

MD5 c7c4cdcf240d1a4ad2de3f57834f304f
SHA1 7371145b8388f9b50d4cc8f71e1069c31bc515d5
SHA256 aefc9759b1db4b3b1750653841010f52c3f025529205e48b6aae10cbdd0e273b
SHA512 3b6740c6639e5170785ff4f28fb23b42e767b4d734027e13be8ff5bad8d9fc15098eb238285583e649c35fc3da39e47940d17b5a3e7e4aa8ee65bd1dbc679669

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

MD5 fece550d33ea20f8a1b82d3418a17b0f
SHA1 36c894ca6cbc96a6607425f59217e548a767e34a
SHA256 4d0b7507fa93c6991481fef4ea0ece6e3b2fe52f388e270a5312b06d98e6425c
SHA512 2df36b28a315bf2678e87e207398cb5878f6f210a0bfdeac38e000a454f671ab398022d35ee3f125c36e008e33ef7a0a8de58d8ba08533dc3c8cbc61885c331a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

MD5 e1415b4df623574bfedfa26e1c48bbed
SHA1 1a78a4fe85b0eaca9ef5271ed5026f016ea82879
SHA256 e8b9c3f3c549b0ae8fefa73d1c74c26c763b530bc4974913a240010b281016fe
SHA512 746559882efcb0e911beea2ae8b9e5acceb78e7aac0c7e021a9b590d925e034394bf1bf21ce0204739ee1af9453576a501487993bec64fe08fa414a357e21e83

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

MD5 dee5eef7793263e73a2455e46b3198d5
SHA1 46d35e2748c952fd43e85c519f4c326359437501
SHA256 78a65b449e423e3a4f2f8e0a5d17c87bd8767ac0f9174ef0e4ae3da650fb6434
SHA512 86bc41a63a446c3a18d528555f2d5a7ab1452a9adb8053bb032fccb738ebda0a9667cf7fe7bb744ee28665fac2a60f1fd33d582c8ccf608e4e1c903522cceff2

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

MD5 d9677b9834b2bb7dd6a7c304a4cbe0db
SHA1 92af0c4b21543fbe71e07cdbd1bafdeb7fc065ac
SHA256 65097f220bb2bfac66818e27c37be4026778fd401ef876124fc3c3621c21a3aa
SHA512 e21c1b36dbe061e2ce1b0bcaf58e4d77606739d6a2398c3fe6b7de6dd4bdd0b4091b2458fec5d24def85dc09e10d4b41a284bbf677f633988c8162e301e05fba

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

MD5 98493aeef9bae666ceb83a377c5a80ac
SHA1 9194123460c1e43421198bb8f99f02e597bb53fb
SHA256 0e412c339c54bc57fc399088427dcc6276016a880fe1b95f6d4ad9a2d0eefff2
SHA512 ed5ba420e9517d849378d40cce789accb6587ad68404f7c14fd9ddcda9de10d7673f18cf5d13bc586746ea745b100cc2bd741f097fd09f50b6f6da36894169bc

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

MD5 031252751fac8e482a6f167e7cc9e1fb
SHA1 9d3b9c127ef2d6344cc5d1c2be9a0923fae25686
SHA256 d02c584b7eef105617fdc27d52a9fc66566f525116fe284dfb42d3e14ad139b5
SHA512 edb059b0750aa70f4626d7c17377790ecb0a4ed894ff4496d87ddf384a3a3f8228f7aed189b87f0b1d3c5c1303804edaa165aac709d449178fcdd7ab9199a225

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

MD5 493d4d32c2d7882e402df41e5814d993
SHA1 d779cb63202a4c4eaed4618f128bae6d01739dbb
SHA256 e50e9b2f0179949ea33c4e4c6d8a926528e141550bf9330b941fc4cee71e06a1
SHA512 b338c7cd356009244ce4873e391652412e33cf36d4c2e116841caa04e03809f012c7c1f2ffdaba4d3f4d9fc1746274640481cc4b2753e670bce2890efae4c966

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

MD5 3da00db641424d7bf3bf8cc69bb4edf4
SHA1 478ffd602cc7d97f60df49266027440ea1b817c9
SHA256 d380aaaf452a5e5138fdd6219ab2a60487ba57a763a065b62f6f70be38c22369
SHA512 65439f98ccb1a96e2dcf60d651e4ea1a16e781ea31c54a51057b80ae7b36acfc4585d7bf22975b8a489901985fb4c2d1d50d205a0ca58e777eab857f831038e7

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

MD5 2903bf168f9a12f220165e987ed75cf3
SHA1 5762ce12c5061d75089b8155891daf7673aeab09
SHA256 c5284b0e979facc8f9730d930c907cf367867b5980c677a015a76a6b7f18c3e2
SHA512 bd561ef98214870a4b399dadb26959b56120e679f6c6342ae9933047b841f7ef65264a7a531984bf93ff04a2b1737d94fdb69954e87b11bf841f3c5134c77937

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

MD5 08403adec87cb7a9ca345a4397a6e0f3
SHA1 faf84fe318bea999da21c0aaafb08ba9e46632aa
SHA256 900f5a8897d08e6bac88c44189f3869b666e0e3391b356f6b821c0302159e863
SHA512 cba9802d33e1acd07479db545d97626c5c0371cdfe5d3a3f73d85a7f05a3118ddaa15674a33a471dadfd39d2d2f53cef0c89e0e5e54b81500a9ffde82a78f6d9

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

MD5 40eb6fd3a1f7c81698dd603ddc1313ff
SHA1 c027733b94c56f3fc9d3dd63ca5c73aa6444f0d7
SHA256 c9498fb502126edce1932e7ae31d1e3d35049f62ada0ce0695656c7a370dee2e
SHA512 8a896fa5b789cbe77752c063e80ca7726653be648e61b4f80f01ba210c6e6ce12de658acd7525e2c1cd3bd9673553241b2c9f435526f1b044d0afd435322a815

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

MD5 e40656d53d58df5b9fdb4f01f3b35ea1
SHA1 7392d8b47bbaa03869da935ace42806a01002e6b
SHA256 84b241ee9ba2e115eb51ec12118d61eafbb22dd11f347ec3d8a9b10ecbf070c0
SHA512 32df3ada7982dc96a88b19ba42517cb8e65c814f80c9334677f3f506f7d233be164c148ff179ce5fd9e424016626f133147c53ec1a50a5182317887420a00de1

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

MD5 27c3558b8c60dea44e92754aa0a09527
SHA1 135a5cd38df4e6674485fa8d14ad9a3350e8fd13
SHA256 bba85aa20c56bffcf5b6476b8864597d8476fd3142273cf433051d6a5faa7762
SHA512 7aed65939a65ad42c7964f99cd99ed1b895d88a12ed2230da67336ea45314a5dc77c7a3f870dd1ad27892a154f7c150fb7c27f8a5881826acc12570a1b5e5a18

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

MD5 381c08a9d5a9e965bcb812c41b25a0a7
SHA1 efb243889457809aef7608a9efb171d131e3d4dc
SHA256 6d4c79fedbd41e93d9b5017928626eaa88d0b1a9bcb8d06f69c64823b80dff05
SHA512 76c1dd374ae606ac098bec923db4ad03ef48e31827007339109c411dfc86f4f1fc3bcadc325b4bf8c3c2011af5978facf86f35bc9fe5f8531bad8302226bcbb7

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

MD5 8a504b0f50151973017302687463f817
SHA1 a6f07a7c1d4dfec243604d35cd8598ea65b19fb1
SHA256 b8efc9621dd3abb02672121d341aa258badd0deeef5b19aeb7d7ddcf806c1889
SHA512 992eb475ae5de28db2109af22461536cb5da6287d5469993be1bd619850fd299c4182348c9f3d78553a3d422e182b2f391e30c4b96ba81fa488afabb6d48d429

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

MD5 8f87d6dd396208a1c3838fbf840a1512
SHA1 5a0f60f811c1cceeaf5508542709e3d1e2eef023
SHA256 f31d5c6aa3d23e724506ea2b83e9d6001e314673c99dd222253205117f075f01
SHA512 18c3a963321aa145dc453a8ae8d2b7a8229161e69844473d6cb93e1ff8d0c4fd2afc823df30834412da82b8dc5e31637bb75ccb739425ea02cec5bc5e744eadb

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

MD5 258da82dbdb58e7533631f79acc49009
SHA1 e817164da4f1b790d43e998ba86821614c83e4a4
SHA256 5956a66754ca6381de8daa48381429a4ce4478db226e725008d9e366ab8baa0c
SHA512 b33e12f32efe6333f16fe67e4976b145ec6c847279dfb0c5faa82d52d85df20e7d244a362f8fc7bbd757fafedc319ef35319c95de5098c595eb37924f511f21c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

MD5 9a4dc3352536f0270bf6d314dd242ad9
SHA1 ae1a17752f2f389796ac91ebd0da9101ee1475ca
SHA256 a8d2c60716ec92118e5305051a841117b3bbc2ffeef06cc668a6fb2c4dc047d8
SHA512 a211931f6b8f5ab0598062f6ba802bcec5fcf83ad1c75bd24e4dd51c509877b306d3135fac641a22c9e0473a8941635cc0e3c713dc7131a4e52750f6cca6ae51

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

MD5 f9a3782a4a14277d80751b1ffafe875c
SHA1 d68243460ff63f95cb3651c0872a1926b03aa0d4
SHA256 a17034f4625e4adafad954466a5d89011aa9de64f170e618bfc262060960c111
SHA512 ab3f1c71e5119046a835e37b4782f7a3fa321178c5c9acff16a02c71ff279f5f37df6818c31ef17fb6ddc8d2d7f2b7759894b8bd81c39df214bd69b16f7ec22d

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

MD5 cb0803a538e5c792955469b1beba0f39
SHA1 1520bab1c842bd90535d76c6dc42fbb63e8883bf
SHA256 3d5976d71aa3a0388bc1b5825ab7072dfe779a3fdd922db43c9fe18535c7581d
SHA512 a3b45f5757f3723074bee72c8a0bebf951bec4c4042412ff764f2fa20d2e6889724bfd20ebd147027aa1522b161948192a3a09ed762b627d5f4c4ea74df9b8cb

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

MD5 0e0c8d023321b01d4ce6c92d63f2b880
SHA1 23f8773d05384c2371383a68d7b2ad24c4aa07f0
SHA256 8d2d8bbfd9b436a4da99cd402187249a93c0bf507a1df367953dc4a4ef5cd6bf
SHA512 0e59492d63864a473ae5bbc2076f453ace190a4168a868be9eaaed18a1e642985dfec7520f614707ec2d099c9da07ed9b54d7b722d527a4de6865e393c73251f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

MD5 47686989cd08e75eaead8291dfcb0659
SHA1 61842af5306e7da8f6be770ccd10a9a8b63398f6
SHA256 86725623321dc7fa3ddd5779b371f233392dba49f2806f94b5461934c15327ce
SHA512 da6ab24ba5c47c1d96750ee90956248fe212982a1e89146bfc29b947d778f39d54ddc9c561058d0f7fdaf3543f6ad09245af6cbbda66dd1ce024dff79a0cc7f7

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

MD5 eff90e51df303e1e6136cb54de1f7ddd
SHA1 38d876b496223c6d6c01a2d415dc6c2f7161169a
SHA256 6e01b51eb000820a1e214d05ac374e6a9ab9b628f14562ad0f2ab07dce6cc5b2
SHA512 70da84fe9a08ec9640d28ccd6c14dfe5f592644183b2fffce1759aac3761ca6c0a3f8c05c02051f1307e1d7f56ff2f17bda7487a3de508ab7ecea6f036f4bd3a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

MD5 65dc089c9f7ee08e2cf5e8739f9a7460
SHA1 581f269b12396014efdc33529379be23624088fb
SHA256 c3c3346cefcfa52d8c8304b34a059a9fc391494627d97295c76ff560bf645445
SHA512 bbdc60551a20b484f5e90b97b3161b1941e99e55f732a3a4adcc028d23a4bcec5918198b0a0ec353483e32f1f320b77506773ef5e9eeb8cdd4cd2ae50ec62630

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

MD5 b6ee89ca7b7aa46d47df90a493b06cff
SHA1 70d020aeeb945182d84022f99c8111c8f75942f4
SHA256 bcd24e8c93be72109f3c590c9ba0d6a6a4c4de7e436ead7b24fa55fb2ef9ba8c
SHA512 0e257038f47da65087ae29551ad9464c05d3f88a1731b73fe790b9775c9b901d14646e4f251f3f9a07cbb765414b96d4f36af5119914283768eab77241ae8eeb

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

MD5 38dc44af8d6c2091a69ff67ec54cc3a9
SHA1 bc3a54a7fa9751a3e20c1e9df8173636edc9c249
SHA256 e19617183fc2b44109a3a22e21ed995666f0fd682658bf93b6ab8d89a86ac7ea
SHA512 5285b08c6e6bd1a723e9168e92ec74cb5f42d2f79319e064cad3c4117d8b27eadb1f161e975b92d030d75d10776c6fa5211734333daf0295f78225021a0554a6

memory/1576-7567-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2792-7571-0x0000000000400000-0x000000000040C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-07 08:44

Reported

2024-10-07 08:45

Platform

win10v2004-20240802-en

Max time kernel

3s

Max time network

4s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe"

Signatures

Detected Xorist Ransomware

Description Indicator Process Target
N/A N/A N/A N/A

Xorist Ransomware

ransomware xorist

Renames multiple (97) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\îáõîä.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LAFOHHPIGMBBNKD = "C:\\Windows\\system32\\mbr-locker.exe" C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kw0mB3PsO47k94v.exe" C:\Windows\SysWOW64\coder.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Windows\SysWOW64\mbr-locker.exe N/A
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\ufr_reports C:\Windows\SysWOW64\îáõîä.exe N/A
File created C:\Windows\SysWOW64\coder.exe C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\coder.exe C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\mbr-locker.exe C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\mbr-locker.exe C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\îáõîä.exe C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\îáõîä.exe C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\7-Zip\Lang\pt.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\et-EE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\eu.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\fa.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\fy.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\lij.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\es.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\io.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ne.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ps.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sv.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\cs.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\kab.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fi-FI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\hy.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\readme.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\tr.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ug.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\et.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\it.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\id.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\da.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\mr.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\nn.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\yo.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ba.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\uz.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\va.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ta.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\lv.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\gl.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\co.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\hr.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\hu.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ast.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\mk.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\CloseUpdate.wmv C:\Windows\SysWOW64\coder.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\he.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\bg.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\gu.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\mng.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\si.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sw.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ar.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\fr.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ka.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ky.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sk.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sl.txt C:\Windows\SysWOW64\coder.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\tk.txt C:\Windows\SysWOW64\coder.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Windows\SysWOW64\coder.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\coder.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mbr-locker.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\îáõîä.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\sCheat.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "91" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "VVYJXUMQZAEMRMB" C:\Windows\SysWOW64\coder.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VVYJXUMQZAEMRMB C:\Windows\SysWOW64\coder.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VVYJXUMQZAEMRMB\shell\open\command C:\Windows\SysWOW64\coder.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VVYJXUMQZAEMRMB\shell\open C:\Windows\SysWOW64\coder.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VVYJXUMQZAEMRMB\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kw0mB3PsO47k94v.exe" C:\Windows\SysWOW64\coder.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd C:\Windows\SysWOW64\coder.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VVYJXUMQZAEMRMB\DefaultIcon C:\Windows\SysWOW64\coder.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VVYJXUMQZAEMRMB\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kw0mB3PsO47k94v.exe,0" C:\Windows\SysWOW64\coder.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VVYJXUMQZAEMRMB\shell C:\Windows\SysWOW64\coder.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VVYJXUMQZAEMRMB\ = "CRYPTED!" C:\Windows\SysWOW64\coder.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\îáõîä.exe N/A
N/A N/A C:\Windows\SysWOW64\îáõîä.exe N/A
N/A N/A C:\Windows\SysWOW64\îáõîä.exe N/A
N/A N/A C:\Windows\SysWOW64\îáõîä.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sys3.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\LogonUI.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4312 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe C:\Windows\SysWOW64\coder.exe
PID 4312 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe C:\Windows\SysWOW64\coder.exe
PID 4312 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe C:\Windows\SysWOW64\coder.exe
PID 4312 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe C:\Windows\SysWOW64\mbr-locker.exe
PID 4312 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe C:\Windows\SysWOW64\mbr-locker.exe
PID 4312 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe C:\Windows\SysWOW64\mbr-locker.exe
PID 4312 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe C:\Windows\SysWOW64\îáõîä.exe
PID 4312 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe C:\Windows\SysWOW64\îáõîä.exe
PID 4312 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe C:\Windows\SysWOW64\îáõîä.exe
PID 1472 wrote to memory of 3788 N/A C:\Windows\SysWOW64\mbr-locker.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 1472 wrote to memory of 3788 N/A C:\Windows\SysWOW64\mbr-locker.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 1472 wrote to memory of 3788 N/A C:\Windows\SysWOW64\mbr-locker.exe C:\Users\Admin\AppData\Local\Temp\sys3.exe
PID 4312 wrote to memory of 3372 N/A C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\sCheat.exe
PID 4312 wrote to memory of 3372 N/A C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\sCheat.exe
PID 4312 wrote to memory of 3372 N/A C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\sCheat.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe"

C:\Windows\SysWOW64\coder.exe

"C:\Windows\system32\coder.exe"

C:\Windows\SysWOW64\mbr-locker.exe

"C:\Windows\system32\mbr-locker.exe"

C:\Windows\SysWOW64\îáõîä.exe

"C:\Windows\system32\îáõîä.exe"

C:\Users\Admin\AppData\Local\Temp\sys3.exe

C:\Users\Admin\AppData\Local\Temp\\sys3.exe

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa39a2055 /state1:0x41c64e6d

C:\Users\Admin\AppData\Local\Temp\sCheat.exe

"C:\Users\Admin\AppData\Local\Temp\sCheat.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp

Files

C:\Windows\SysWOW64\coder.exe

MD5 d871ac0f3fdcc234f1ba4f39bc76e6fb
SHA1 010fcadadce613eb45923dbbdee46440e8f74bb6
SHA256 08e15773a4caf5225e95ee3f9ebf2ca67b3d500053fb316dea875d5cf361271f
SHA512 0f56b1689661bd0978cfaa16876bd4b2ab3f0b1f6d1ec25bb09d1ea7e9b0a4e888972dbc32d272aa02ddc646061c901c6fed8de586c9406e56c4b9b925dec114

memory/452-10-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Windows\SysWOW64\mbr-locker.exe

MD5 5201eb8656d7f823e7d5253aeda7b5f7
SHA1 01ae8f476827afe420ae806c1a7654770342ff1c
SHA256 6e657c98282a118321c09cf76edef34deeb2d067cea41f4c130e32044830b865
SHA512 1b3ad3a18801c02522b069eee9253ddbdfac7414531eaa4ec9211dc7f3ef051e4fe984c451309f1d265bff96efbdc10d5004f7d5b329b20c52a4861a0daed923

C:\Windows\SysWOW64\îáõîä.exe

MD5 e04fb60dc115ddc2368000bf4b7b934e
SHA1 60b33f31232a454120e1184bbc502577b9fe3ee5
SHA256 c1fc945b7aeca62e7af8b72663aeb676274360e0b05a8b1a12342e11e25ac109
SHA512 e59c2dc3e379ac2da1cba83895c9ae93f0a64146ebb593185081161aa0e88a9ebd617b57e0aca7d2f5e8bcd051460252ed8261b9f2cb7611e40bd98e448b5fcc

memory/1472-29-0x000000002AA00000-0x000000002AA05000-memory.dmp

C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

MD5 c0b2257570b3d11be28c93253aaae5f0
SHA1 b1f20d760a1cdeee566d7857deb88ca451c33722
SHA256 ffb6468be6a66d973ef143bf7cf8d059139bb15ca521c5296a3337457bfcc960
SHA512 69e3afd798ad3708e2dfcc9f5dd99e2593ed5f9ba45a7037845370236aa5d7893d407e4ec515498d4d11d933aa1a67031f605857932d829c2644f4b355bfa7c7

memory/4436-101-0x0000000000400000-0x0000000000454000-memory.dmp

memory/1472-126-0x000000002AA00000-0x000000002AA05000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\systm.txt

MD5 0f6aeead10fa4e4345421a9344920b54
SHA1 8c3fb95046aa8a49de5e0125a1734f6a61e1de9c
SHA256 f7fd935a5b2e344a8528c666005d010bb7fd75785075f4dbb89973f151409ee4
SHA512 dbd688e79df1af689e583e9835cb03e22769313ec38f69ef59934258f296a40e8495b62fec47ee2b60e7cb531b917ac23ca16f14519413c637588a7522f0eca0

C:\Users\Admin\AppData\Local\Temp\sCheat.exe

MD5 af14998ea9c9a7ab8250a8b9243b5505
SHA1 a868c979df09e426498618cac6301cf9d23e12c8
SHA256 469af5ff07386de5c8a0d7e6766820f76ec550ed730d108f7f654053f4d7b3ba
SHA512 50ca46efa70cdbe3dec881989dd79a099ec2076b93d7cf6a9a4a728ca26cc276efab534e4a9fb2e0e8bd8a22fda7fbc4cb5603beeb0e592b6d5c4d241d83eb39

memory/3372-256-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3372-279-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4436-281-0x0000000000400000-0x0000000000454000-memory.dmp

memory/452-278-0x0000000000400000-0x000000000040C000-memory.dmp