lokibot | 8679bc0899fa881c2df5ee13a0a97fbdb14712ba9599c9d9bfcf8444f68312c8

General

Target

210da055070c2b04b4555752e8e1651b_JaffaCakes118.msi
Size

704KB
MD5

210da055070c2b04b4555752e8e1651b
SHA1

fae84c44f55fc07f7184927cc603eb4c787b5c61
SHA256

8679bc0899fa881c2df5ee13a0a97fbdb14712ba9599c9d9bfcf8444f68312c8
SHA512

8000f5fb663e1e7cb09e823748aa57b13c529de03efe4d3df9a61cb0b23fe54d164b3ea680ce8f67964bb513c42a333e115e45fe9033c11b1739043db5f08177
SSDEEP

12288:9EcB7rgUSPwodwuLE1mdOd7A2YBianCsGCp9dKgAYkx:9EGrbSYeLqmdOd7A2YBianCsGCpLAYkx

Score

10^/10

lokibot collection discovery persistence privilege_escalation spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://dymanite.ca/ome/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

MSIC4D7.tmp

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	MSIC4D7.tmp
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	MSIC4D7.tmp
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	MSIC4D7.tmp

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

MSIC4D7.tmp

description pid process target process

PID 4300 set thread context of 440 4300 MSIC4D7.tmp MSIC4D7.tmp

description	pid	process	target process
PID 4300 set thread context of 440	4300	MSIC4D7.tmp	MSIC4D7.tmp

Drops file in Windows directory 10 IoCs

Processes:

msiexec.exeMSIC4D7.tmpMSIC4D7.tmp

description	ioc	process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e57c3ec.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC4D7.tmp	msiexec.exe
File opened for modification	C:\Windows\win.ini	MSIC4D7.tmp
File opened for modification	C:\Windows\win.ini	MSIC4D7.tmp
File opened for modification	C:\Windows\Installer\e57c3ec.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{29EF7317-DCA1-4159-97B2-C883AD400AC6}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC488.tmp	msiexec.exe

Executes dropped EXE 3 IoCs

Processes:

MSIC4D7.tmpMSIC4D7.tmpMSIC4D7.tmp

pid process

4756 MSIC4D7.tmp
4300 MSIC4D7.tmp
440 MSIC4D7.tmp
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
persistence privilege_escalation

Installer Packages
T1546.016

Msiexec
T1218.007

Processes:

msiexec.exe

pid process

800 msiexec.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

pid	process
4756	MSIC4D7.tmp
4300	MSIC4D7.tmp
440	MSIC4D7.tmp

pid	process
800	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

MSIC4D7.tmpMSIC4D7.tmp

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIC4D7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIC4D7.tmp

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000038a6760542cf76680000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000038a676050000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090038a67605000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d38a67605000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000038a6760500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

msiexec.exe

pid process

216 msiexec.exe
216 msiexec.exe
216 msiexec.exe

pid	process
216	msiexec.exe
216	msiexec.exe
216	msiexec.exe

Suspicious use of AdjustPrivilegeToken 56 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeMSIC4D7.tmpsrtasks.exe

description	pid	process
Token: SeShutdownPrivilege	800	msiexec.exe
Token: SeIncreaseQuotaPrivilege	800	msiexec.exe
Token: SeSecurityPrivilege	216	msiexec.exe
Token: SeCreateTokenPrivilege	800	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	800	msiexec.exe
Token: SeLockMemoryPrivilege	800	msiexec.exe
Token: SeIncreaseQuotaPrivilege	800	msiexec.exe
Token: SeMachineAccountPrivilege	800	msiexec.exe
Token: SeTcbPrivilege	800	msiexec.exe
Token: SeSecurityPrivilege	800	msiexec.exe
Token: SeTakeOwnershipPrivilege	800	msiexec.exe
Token: SeLoadDriverPrivilege	800	msiexec.exe
Token: SeSystemProfilePrivilege	800	msiexec.exe
Token: SeSystemtimePrivilege	800	msiexec.exe
Token: SeProfSingleProcessPrivilege	800	msiexec.exe
Token: SeIncBasePriorityPrivilege	800	msiexec.exe
Token: SeCreatePagefilePrivilege	800	msiexec.exe
Token: SeCreatePermanentPrivilege	800	msiexec.exe
Token: SeBackupPrivilege	800	msiexec.exe
Token: SeRestorePrivilege	800	msiexec.exe
Token: SeShutdownPrivilege	800	msiexec.exe
Token: SeDebugPrivilege	800	msiexec.exe
Token: SeAuditPrivilege	800	msiexec.exe
Token: SeSystemEnvironmentPrivilege	800	msiexec.exe
Token: SeChangeNotifyPrivilege	800	msiexec.exe
Token: SeRemoteShutdownPrivilege	800	msiexec.exe
Token: SeUndockPrivilege	800	msiexec.exe
Token: SeSyncAgentPrivilege	800	msiexec.exe
Token: SeEnableDelegationPrivilege	800	msiexec.exe
Token: SeManageVolumePrivilege	800	msiexec.exe
Token: SeImpersonatePrivilege	800	msiexec.exe
Token: SeCreateGlobalPrivilege	800	msiexec.exe
Token: SeBackupPrivilege	1868	vssvc.exe
Token: SeRestorePrivilege	1868	vssvc.exe
Token: SeAuditPrivilege	1868	vssvc.exe
Token: SeBackupPrivilege	216	msiexec.exe
Token: SeRestorePrivilege	216	msiexec.exe
Token: SeRestorePrivilege	216	msiexec.exe
Token: SeTakeOwnershipPrivilege	216	msiexec.exe
Token: SeRestorePrivilege	216	msiexec.exe
Token: SeTakeOwnershipPrivilege	216	msiexec.exe
Token: SeRestorePrivilege	216	msiexec.exe
Token: SeTakeOwnershipPrivilege	216	msiexec.exe
Token: SeRestorePrivilege	216	msiexec.exe
Token: SeTakeOwnershipPrivilege	216	msiexec.exe
Token: SeRestorePrivilege	216	msiexec.exe
Token: SeTakeOwnershipPrivilege	216	msiexec.exe
Token: SeDebugPrivilege	440	MSIC4D7.tmp
Token: SeBackupPrivilege	3988	srtasks.exe
Token: SeRestorePrivilege	3988	srtasks.exe
Token: SeSecurityPrivilege	3988	srtasks.exe
Token: SeTakeOwnershipPrivilege	3988	srtasks.exe
Token: SeBackupPrivilege	3988	srtasks.exe
Token: SeRestorePrivilege	3988	srtasks.exe
Token: SeSecurityPrivilege	3988	srtasks.exe
Token: SeTakeOwnershipPrivilege	3988	srtasks.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

msiexec.exeMSIC4D7.tmpMSIC4D7.tmp

pid process

800 msiexec.exe
4756 MSIC4D7.tmp
4756 MSIC4D7.tmp
4300 MSIC4D7.tmp
4300 MSIC4D7.tmp
800 msiexec.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

MSIC4D7.tmpMSIC4D7.tmp

pid process

4756 MSIC4D7.tmp
4756 MSIC4D7.tmp
4300 MSIC4D7.tmp
4300 MSIC4D7.tmp
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

MSIC4D7.tmpMSIC4D7.tmp

pid process

4756 MSIC4D7.tmp
4300 MSIC4D7.tmp

pid	process
800	msiexec.exe
4756	MSIC4D7.tmp
4756	MSIC4D7.tmp
4300	MSIC4D7.tmp
4300	MSIC4D7.tmp
800	msiexec.exe

pid	process
4756	MSIC4D7.tmp
4756	MSIC4D7.tmp
4300	MSIC4D7.tmp
4300	MSIC4D7.tmp

pid	process
4756	MSIC4D7.tmp
4300	MSIC4D7.tmp

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

msiexec.exeMSIC4D7.tmpMSIC4D7.tmp

description	pid	process	target process
PID 216 wrote to memory of 3988	216	msiexec.exe	srtasks.exe
PID 216 wrote to memory of 3988	216	msiexec.exe	srtasks.exe
PID 216 wrote to memory of 4756	216	msiexec.exe	MSIC4D7.tmp
PID 216 wrote to memory of 4756	216	msiexec.exe	MSIC4D7.tmp
PID 216 wrote to memory of 4756	216	msiexec.exe	MSIC4D7.tmp
PID 4756 wrote to memory of 4300	4756	MSIC4D7.tmp	MSIC4D7.tmp
PID 4756 wrote to memory of 4300	4756	MSIC4D7.tmp	MSIC4D7.tmp
PID 4756 wrote to memory of 4300	4756	MSIC4D7.tmp	MSIC4D7.tmp
PID 4300 wrote to memory of 440	4300	MSIC4D7.tmp	MSIC4D7.tmp
PID 4300 wrote to memory of 440	4300	MSIC4D7.tmp	MSIC4D7.tmp
PID 4300 wrote to memory of 440	4300	MSIC4D7.tmp	MSIC4D7.tmp
PID 4300 wrote to memory of 440	4300	MSIC4D7.tmp	MSIC4D7.tmp
PID 4300 wrote to memory of 440	4300	MSIC4D7.tmp	MSIC4D7.tmp
PID 4300 wrote to memory of 440	4300	MSIC4D7.tmp	MSIC4D7.tmp
PID 4300 wrote to memory of 440	4300	MSIC4D7.tmp	MSIC4D7.tmp
PID 4300 wrote to memory of 440	4300	MSIC4D7.tmp	MSIC4D7.tmp
PID 4300 wrote to memory of 440	4300	MSIC4D7.tmp	MSIC4D7.tmp
PID 4300 wrote to memory of 440	4300	MSIC4D7.tmp	MSIC4D7.tmp

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

Processes:

MSIC4D7.tmp

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	MSIC4D7.tmp

outlook_win_path 1 IoCs

Processes:

MSIC4D7.tmp

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	MSIC4D7.tmp

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\210da055070c2b04b4555752e8e1651b_JaffaCakes118.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:800

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:216
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3988
- C:\Windows\Installer\MSIC4D7.tmp
  "C:\Windows\Installer\MSIC4D7.tmp" grgdfbfsg
  2⤵
  - Drops file in Windows directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\Installer\MSIC4D7.tmp
    "C:\Windows\Installer\MSIC4D7.tmp" grgdfbfsg
    3⤵
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4300
  - - C:\Windows\Installer\MSIC4D7.tmp
      "C:\Windows\Installer\MSIC4D7.tmp" grgdfbfsg
      4⤵
      Accesses Microsoft Outlook profiles
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:440

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Installer Packages

1

T1546.016

Privilege Escalation

Event Triggered Execution

1

T1546

Installer Packages

1

T1546.016

Defense Evasion

System Binary Proxy Execution

1

T1218

Msiexec

1

T1218.007

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57c3ef.rbs

Filesize
663B

MD5
e33e721abb976b1f8b19d35f280b05eb

SHA1
d615460526a8057fae062fb4385e2da5afc0a091

SHA256
f2d2351b0dab2c90bd240b93c9c2c749606c1b484cc96f759462db1a82efed1a

SHA512
a68c7b2b90eba8351b6a4068c32bdd197907cefea2548223c42c111b65e588a4c039e336d09bd69e4d75aeb8b14109b15bc49002d9659893fa5752627fd96244

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-493223053-2004649691-1575712786-1000\0f5007522459c86e95ffcc62f32308f1_755b0f1a-bb38-4bb2-bc7e-240c892146ee

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-493223053-2004649691-1575712786-1000\0f5007522459c86e95ffcc62f32308f1_755b0f1a-bb38-4bb2-bc7e-240c892146ee

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Windows\Installer\MSIC4D7.tmp

Filesize
680KB

MD5
55723c0964059e5cf386d582a9899860

SHA1
833fd26c5667e2502ffd7d214a3078ec27277b0b

SHA256
ca25d81fc11bca2c2759776038eeb276c0b53e9eec5e7c557b52ef95dc7f3eab

SHA512
780c9e0ca34a73a9787cfcc1ca122017db32afc4fc63021ce0d76fe09219d0a5046b74f1ff2b591d79e6b7a976561606f9a65411412cb665b83f4c9160b483f0

Download Submit
C:\Windows\win.ini

Filesize
123B

MD5
6bf517432f65eb7f0d18d574bf14124c

SHA1
5b9f37c1dd1318ebbec3bd2f07c109eb9d22c727

SHA256
6e2b70dfccabf3cc651545676a3a566c9cfae03f15f772886646abce1da35b46

SHA512
7b0cb8c20034585ec8bf4b45eda5eda5993a56e24931a7426dc5a9f081ec1f82545f3e26a48a4df885c8691fc6e8026d0808aebe3cc3358ba85ddca08ac4cb06

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
a11bc0e2c587cbc36b57165305d01ca8

SHA1
82ef23444d964cc333dced5438209e29f86f9a59

SHA256
54a7f0ce56c95c497010c88bcff07ee03da0fbfa12e04d501f43b2688ea1c5f4

SHA512
146b1da7530dcf45a98d65f563176f5e1470afcee37ef078df3368602e99a7b09033635652a2701ca9dd94a9f8add0744cd7b1f96a5d87c4d48fbb9130df3bb6

Download Submit
\??\Volume{0576a638-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2a1dc856-35e3-4adb-9da3-45aed9afdd4f}_OnDiskSnapshotProp

Filesize
6KB

MD5
e2b2fd5e4685a2144cb8c039d0a5b33f

SHA1
edac1dfca61e268d92d4d742557f8895a5346bc4

SHA256
d99d8453445e0958df441822a83e0df400f97ec98225ecc5f1d7ab44ef25cdd7

SHA512
a47924746bbc53f853dbd2bfad7154f74a1b49f0666da0fc1ad7f2f7d6953efd8c00ca1fdac2f63a55a793e46f9635092e94b487345aba7613a90c8c1d1bb9d9

Download Submit
memory/440-20-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/440-22-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/440-76-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads