fabookie | aa9b8b79b9b4e0478e85c4ae5b08c15aadea45cac7617de2c298070fd781748e

Analysis

max time kernel
69s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

281c7ba6787d047d9eff840c79c19816_JaffaCakes118.exe
Size

4.0MB
MD5

281c7ba6787d047d9eff840c79c19816
SHA1

1b41a63ce815c055038824ecd67fb606a2210fc7
SHA256

aa9b8b79b9b4e0478e85c4ae5b08c15aadea45cac7617de2c298070fd781748e
SHA512

8ba03a346dc3246abd8af0768f20c71cf875de6554dfa961c17de373fe28f6252a3c263238760148a208d830e53fb399b8bafceaa2f678c94b891a08b517dfc4
SSDEEP

98304:JH4fPHwHNLfwCFx7zWBBWUhT0BRQf6608yFLBiMt/cwC:JYnQtz/WBcEIKVML1qwC

Score

10^/10

fabookie nullmixer redline sectoprat vidar olkani aspackv2 discovery dropper infostealer rat spyware stealer trojan upx

Malware Config

Extracted

Family

nullmixer

http://watira.xyz/

Extracted

Family

redline

Botnet

OLKani

ataninamei.xyz:80

Signatures

Detect Fabookie payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\sonia_9.txt	family_fabookie

Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
dropper nullmixer
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1192-207-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1192-205-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1192-204-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1192-201-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1192-199-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1192-207-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/1192-205-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/1192-204-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/1192-201-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/1192-199-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detected Nirsoft tools 10 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

Processes:

resource	yara_rule
behavioral1/memory/2932-189-0x00000000002F0000-0x000000000034B000-memory.dmp	Nirsoft
behavioral1/memory/1436-194-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/memory/2256-188-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/memory/1668-265-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/memory/1788-267-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/memory/3060-304-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/memory/2932-305-0x00000000002F0000-0x000000000034B000-memory.dmp	Nirsoft
behavioral1/memory/1744-302-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/memory/2508-315-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/memory/2684-318-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/1736-312-0x0000000000400000-0x0000000002CC3000-memory.dmp	family_vidar
behavioral1/memory/1736-343-0x0000000000400000-0x0000000002CC3000-memory.dmp	family_vidar

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\7zS8E98B096\setup_install.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\libcurlpp.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\libcurl.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\libstdc++-6.dll	aspack_v212_v242

Executes dropped EXE 27 IoCs

Processes:

setup_installer.exesetup_install.exesonia_5.exesonia_6.exesonia_1.exesonia_7.exesonia_9.exesonia_3.exesonia_5.tmpsonia_1.exesonia_8.exesonia_2.exesonia_4.exechrome2.exesetup.exewinnetdriv.exejfiag3g_gg.exejfiag3g_gg.exesonia_8.exejfiag3g_gg.exejfiag3g_gg.exejfiag3g_gg.exejfiag3g_gg.exejfiag3g_gg.exejfiag3g_gg.exeservices64.exesihost64.exe

pid	process
2536	setup_installer.exe
2900	setup_install.exe
1212	sonia_5.exe
1252	sonia_6.exe
2040	sonia_1.exe
2364	sonia_7.exe
2932	sonia_9.exe
1736	sonia_3.exe
2716	sonia_5.tmp
1612	sonia_1.exe
2608	sonia_8.exe
1956	sonia_2.exe
2988	sonia_4.exe
2352	chrome2.exe
1588	setup.exe
1960	winnetdriv.exe
2256	jfiag3g_gg.exe
1436	jfiag3g_gg.exe
1192	sonia_8.exe
1668	jfiag3g_gg.exe
1788	jfiag3g_gg.exe
1744	jfiag3g_gg.exe
3060	jfiag3g_gg.exe
2508	jfiag3g_gg.exe
2684	jfiag3g_gg.exe
2572	services64.exe
2872	sihost64.exe

Loads dropped DLL 64 IoCs

Processes:

281c7ba6787d047d9eff840c79c19816_JaffaCakes118.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.exesonia_5.execmd.execmd.exesonia_1.exesonia_7.exesonia_9.exesonia_3.exesonia_5.tmpsonia_1.execmd.execmd.execmd.exesonia_8.exesonia_2.exesonia_4.exeWerFault.exesetup.exeWerFault.exe

pid	process
2404	281c7ba6787d047d9eff840c79c19816_JaffaCakes118.exe
2536	setup_installer.exe
2536	setup_installer.exe
2536	setup_installer.exe
2536	setup_installer.exe
2536	setup_installer.exe
2536	setup_installer.exe
2900	setup_install.exe
2900	setup_install.exe
2900	setup_install.exe
2900	setup_install.exe
2900	setup_install.exe
2900	setup_install.exe
2900	setup_install.exe
2900	setup_install.exe
1592	cmd.exe
1592	cmd.exe
1932	cmd.exe
108	cmd.exe
2060	cmd.exe
1212	sonia_5.exe
1212	sonia_5.exe
1444	cmd.exe
1444	cmd.exe
1608	cmd.exe
2040	sonia_1.exe
2040	sonia_1.exe
2364	sonia_7.exe
2364	sonia_7.exe
2040	sonia_1.exe
1212	sonia_5.exe
2932	sonia_9.exe
2932	sonia_9.exe
1736	sonia_3.exe
1736	sonia_3.exe
2716	sonia_5.tmp
2716	sonia_5.tmp
2716	sonia_5.tmp
1612	sonia_1.exe
1612	sonia_1.exe
1568	cmd.exe
1052	cmd.exe
1112	cmd.exe
1112	cmd.exe
1568	cmd.exe
2608	sonia_8.exe
2608	sonia_8.exe
1956	sonia_2.exe
1956	sonia_2.exe
2988	sonia_4.exe
2988	sonia_4.exe
2988	sonia_4.exe
2988	sonia_4.exe
1300	WerFault.exe
1300	WerFault.exe
1300	WerFault.exe
1300	WerFault.exe
2608	sonia_8.exe
1588	setup.exe
1300	WerFault.exe
1656	WerFault.exe
1656	WerFault.exe
1656	WerFault.exe
1656	WerFault.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service
T1102

Processes:

flow ioc

44 iplogger.org
45 iplogger.org
46 iplogger.org
62 raw.githubusercontent.com
63 raw.githubusercontent.com
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

24 ip-api.com
2 ipinfo.io
7 ipinfo.io
12 api.db-ip.com
13 api.db-ip.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

sonia_8.exe

description pid process target process

PID 2608 set thread context of 1192 2608 sonia_8.exe sonia_8.exe

flow	ioc
44	iplogger.org
45	iplogger.org
46	iplogger.org
62	raw.githubusercontent.com
63	raw.githubusercontent.com

flow	ioc
24	ip-api.com
2	ipinfo.io
7	ipinfo.io
12	api.db-ip.com
13	api.db-ip.com

description	pid	process	target process
PID 2608 set thread context of 1192	2608	sonia_8.exe	sonia_8.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1436-194-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/1436-190-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2256-188-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2256-183-0x0000000000400000-0x000000000045B000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
behavioral1/memory/2932-257-0x00000000002F0000-0x000000000034B000-memory.dmp	upx
behavioral1/memory/1668-265-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/1788-267-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/3060-304-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/1744-302-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2508-315-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2684-318-0x0000000000400000-0x000000000045B000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

Processes:

setup.exe

description ioc process

File created C:\Windows\winnetdriv.exe setup.exe
File opened for modification C:\Windows\winnetdriv.exe setup.exe
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1300 1956 WerFault.exe sonia_2.exe
1656 2900 WerFault.exe setup_install.exe

description	ioc	process
File created	C:\Windows\winnetdriv.exe	setup.exe
File opened for modification	C:\Windows\winnetdriv.exe	setup.exe

pid	pid_target	process	target process
1300	1956	WerFault.exe	sonia_2.exe
1656	2900	WerFault.exe	setup_install.exe

System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.execmd.execmd.execmd.exesonia_5.tmp281c7ba6787d047d9eff840c79c19816_JaffaCakes118.exesetup_installer.exesetup_install.exesonia_3.exejfiag3g_gg.exejfiag3g_gg.exejfiag3g_gg.exesonia_7.exesetup.exejfiag3g_gg.execmd.exesonia_5.exesonia_8.execmd.exesonia_8.exesonia_4.exejfiag3g_gg.execmd.exesonia_1.exejfiag3g_gg.exejfiag3g_gg.exejfiag3g_gg.execmd.exesonia_9.exesonia_2.execmd.exesonia_1.exewinnetdriv.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sonia_5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	281c7ba6787d047d9eff840c79c19816_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sonia_3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jfiag3g_gg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jfiag3g_gg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jfiag3g_gg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sonia_7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jfiag3g_gg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sonia_5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sonia_8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sonia_8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sonia_4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jfiag3g_gg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sonia_1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jfiag3g_gg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jfiag3g_gg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jfiag3g_gg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sonia_9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sonia_2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sonia_1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winnetdriv.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

sonia_3.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sonia_3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	sonia_3.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

sonia_3.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	sonia_3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	sonia_3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	sonia_3.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

888 schtasks.exe
2944 schtasks.exe

pid	process
888	schtasks.exe
2944	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

sonia_3.exechrome2.exesonia_7.exeservices64.exe

pid	process
1736	sonia_3.exe
1736	sonia_3.exe
1736	sonia_3.exe
1736	sonia_3.exe
2352	chrome2.exe
2364	sonia_7.exe
2364	sonia_7.exe
2364	sonia_7.exe
2364	sonia_7.exe
2364	sonia_7.exe
2364	sonia_7.exe
2364	sonia_7.exe
2364	sonia_7.exe
2572	services64.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

sonia_6.exesonia_8.exechrome2.exeservices64.exe

description	pid	process
Token: SeDebugPrivilege	1252	sonia_6.exe
Token: SeDebugPrivilege	1192	sonia_8.exe
Token: SeDebugPrivilege	2352	chrome2.exe
Token: SeDebugPrivilege	2572	services64.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

281c7ba6787d047d9eff840c79c19816_JaffaCakes118.exesetup_installer.exesetup_install.exe

description	pid	process	target process
PID 2404 wrote to memory of 2536	2404	281c7ba6787d047d9eff840c79c19816_JaffaCakes118.exe	setup_installer.exe
PID 2404 wrote to memory of 2536	2404	281c7ba6787d047d9eff840c79c19816_JaffaCakes118.exe	setup_installer.exe
PID 2404 wrote to memory of 2536	2404	281c7ba6787d047d9eff840c79c19816_JaffaCakes118.exe	setup_installer.exe
PID 2404 wrote to memory of 2536	2404	281c7ba6787d047d9eff840c79c19816_JaffaCakes118.exe	setup_installer.exe
PID 2404 wrote to memory of 2536	2404	281c7ba6787d047d9eff840c79c19816_JaffaCakes118.exe	setup_installer.exe
PID 2404 wrote to memory of 2536	2404	281c7ba6787d047d9eff840c79c19816_JaffaCakes118.exe	setup_installer.exe
PID 2404 wrote to memory of 2536	2404	281c7ba6787d047d9eff840c79c19816_JaffaCakes118.exe	setup_installer.exe
PID 2536 wrote to memory of 2900	2536	setup_installer.exe	setup_install.exe
PID 2536 wrote to memory of 2900	2536	setup_installer.exe	setup_install.exe
PID 2536 wrote to memory of 2900	2536	setup_installer.exe	setup_install.exe
PID 2536 wrote to memory of 2900	2536	setup_installer.exe	setup_install.exe
PID 2536 wrote to memory of 2900	2536	setup_installer.exe	setup_install.exe
PID 2536 wrote to memory of 2900	2536	setup_installer.exe	setup_install.exe
PID 2536 wrote to memory of 2900	2536	setup_installer.exe	setup_install.exe
PID 2900 wrote to memory of 1592	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1592	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1592	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1592	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1592	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1592	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1592	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1568	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1568	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1568	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1568	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1568	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1568	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1568	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1444	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1444	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1444	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1444	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1444	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1444	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1444	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1052	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1052	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1052	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1052	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1052	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1052	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1052	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1932	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1932	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1932	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1932	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1932	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1932	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1932	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 2060	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 2060	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 2060	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 2060	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 2060	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 2060	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 2060	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1608	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1608	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1608	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1608	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1608	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1608	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1608	2900	setup_install.exe	cmd.exe
PID 2900 wrote to memory of 1112	2900	setup_install.exe	cmd.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\281c7ba6787d047d9eff840c79c19816_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\281c7ba6787d047d9eff840c79c19816_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_1.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\sonia_1.exe
        
        sonia_1.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\sonia_1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\sonia_1.exe" -a
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1612
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_2.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\sonia_2.exe
        
        sonia_2.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1956
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 272
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:1300
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_3.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1444
    - - C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\sonia_3.exe
        
        sonia_3.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        
        PID:1736
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_4.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\sonia_4.exe
        
        sonia_4.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\chrome2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\chrome2.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2352
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        7⤵
        
        PID:2020
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:888
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2572
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        
        PID:2880
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2944
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        8⤵
        Executes dropped EXE
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1588
        
        C:\Windows\winnetdriv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe" 1728461733 0
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1960
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_5.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\sonia_5.exe
        
        sonia_5.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1212
      - C:\Users\Admin\AppData\Local\Temp\is-G4DMV.tmp\sonia_5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-G4DMV.tmp\sonia_5.tmp" /SL5="$7019C,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\sonia_5.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2716
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_6.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\sonia_6.exe
        
        sonia_6.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1252
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_7.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\sonia_7.exe
        
        sonia_7.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2364
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_8.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\sonia_8.exe
        
        sonia_8.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\sonia_8.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\sonia_8.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1192
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_9.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:108
    - - C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\sonia_9.exe
        
        sonia_9.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2256
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /DeleteCookiesWildcard "*.facebook.com"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1436
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1744
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2684
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 424
      4⤵
      Loads dropped DLL
      Program crash
      PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\softokn3.dll

Filesize
275B

MD5
a378c450e6ad9f1e0356ed46da190990

SHA1
d457a2c162391d2ea30ec2dc62c8fb3b973f6a66

SHA256
b745b0c0db87a89de5e542e9ae0a06f585793ac3f4240bff3524e7dbdba79978

SHA512
e6cdc8f570af97e48b1d8968730db0afc46f9dd6ad7366a936a5518801debb61c86cc61526e5e26e7ad3b3daeb76a19b32d7c0da33140597f6d19163683c12b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
93927471f257a8282aaa12cf855f610e

SHA1
4fb6fb33bf78e536fa67fabca763ae21d4c7dcaa

SHA256
26604e47e7d0a59d84fbc2296b3112867d828c60d5e551f742a66d2d69b974b5

SHA512
50959a1985d0afbcdde3a8c07f393cf7643b78f5aeca1026f9fcd3122d56c98a78be05aa940601b1287e08f084afd4a69eeeaf11965346b32117b45d20965193

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\libcurl.dll

Filesize
218KB

MD5
d09be1f47fd6b827c81a4812b4f7296f

SHA1
028ae3596c0790e6d7f9f2f3c8e9591527d267f7

SHA256
0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

SHA512
857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\libcurlpp.dll

Filesize
54KB

MD5
e6e578373c2e416289a8da55f1dc5e8e

SHA1
b601a229b66ec3d19c2369b36216c6f6eb1c063e

SHA256
43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

SHA512
9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\libstdc++-6.dll

Filesize
647KB

MD5
5e279950775baae5fea04d2cc4526bcc

SHA1
8aef1e10031c3629512c43dd8b0b5d9060878453

SHA256
97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

SHA512
666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\sonia_2.txt

Filesize
193KB

MD5
b1f48224b74bd5789edda9e910eef29f

SHA1
7b4271d40384d41bff8928c476020abfe70490f6

SHA256
b7e9740c81b1b49e8d3f49ec79717f4282bdf307d393d143a92e36f1abf09aa6

SHA512
58edcb222a69030ba6a94a5f545a8602e16a95c74ac9cbc92681f993602829791f7d14272d631894557819525607434678c000906379db8b9ca867a9e60b7209

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\sonia_3.exe

Filesize
560KB

MD5
d5150e7c78eac749b00f0c0d803914f4

SHA1
ff00396e2d2c029738453ec66bf63a8d39512c83

SHA256
61e83ca939ee966f83663418b9bc88987370f25ee5f1897c4928507be5c54332

SHA512
8d891f3986952ec0a065287f36ef6ae4366e09501c587b45f993c6353111e1d326431d586e3aed5e6f843a627b635bd460c31efd4ce801a82d675c52bf6d5e60

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\sonia_4.txt

Filesize
923KB

MD5
13a289feeb15827860a55bbc5e5d498f

SHA1
e1f0a544fcc5b3bc0ab6a788343185ad1ad077ad

SHA256
c5483b2acbb352dc5c9a811d9616c4519f0e07c13905552be5ec869613ada775

SHA512
00c225fb1d88920c5df7bb853d32213a91254fb8c57169c58c8b0ffab4501486e24d87e3d8f5665b16e366362cb81deec535d833ed42434fdc31f0400ee7ffa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\sonia_5.exe

Filesize
759KB

MD5
52e5bf9bc7e415e0dd079bfa2d753054

SHA1
086f3ca067952333f587384ec81ac5cfb343d1db

SHA256
19c5cf5343d2ab1b120d41b3c536340ccb8a6c0656ba9567d7ce5afaed18e277

SHA512
f3386dc44073be1f3bdf471a0144363a55311088738a4e0d87250f2038bcf41bd884afbce8a4d98f57a82d7ba8cfe68c9366ef4c5ba9250a0e470806338054bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\sonia_6.exe

Filesize
200KB

MD5
e1ccf1fd5a4e6c1edb774a42ccee2b7b

SHA1
67ba5d76ea49aa6dc3d94027966a05c4c8adfabd

SHA256
be958aa7672b7eeabd668cd8c0893eb22b84ab490dbef447b142e191b4ef97e0

SHA512
cbc421b0e803cf1fd85171fc653fc5c26f45aaa02971cec2000d3c0d7fead07f39300ccbe3c11b21bd0938baca95b32d95235926c86f02677594378bc97ad8b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\sonia_7.txt

Filesize
1.7MB

MD5
62ca6931bc7a374f80ff8541138baa9e

SHA1
d36e63034bddf32d3c79106a75cfa679cfdd336a

SHA256
5dbe764c587a5a27b0daaa1b3a56a2ac4047cc78c2b878ae49589c2ec55c350a

SHA512
5e7e4edefa978e7e355ee9692ff925241c7d1e4f1aff0f3e4068685b6a3eb00638a2706cda0a0581e240dc31e18b96c41fbc7f9e42f30673a29b7c995ddd8952

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\sonia_8.txt

Filesize
397KB

MD5
7c61996bdaf647b491d88063caecbf0c

SHA1
38f6448a659e294468ee40f7dfebf1277c3771f1

SHA256
de67bb06f8462526665e4b791f5b90f3e2c248eec21f4cab5954b322eed25d46

SHA512
c92cb5711ce691c4cca9e786172e713ce5da7c463ebe0e2973ce0d63454faafb568c99e90f182839b06e4103a1bf361eb9089a5b9125b04e38a9f35a949780cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8E98B096\sonia_9.txt

Filesize
983KB

MD5
270dd1da0ab7f38cdff6fab84562ec7a

SHA1
cf7be169ee4415085baeb4aeaa60932ac5abf4ac

SHA256
7d7d5ae0fa9286fea65a6f94240389998ff0d08340a2aedc67ef3547e84d64c6

SHA512
dc3d7d112a8e43c34261f3425ef6710d61cb92d797dd4a1e9b04e02971db42a4a2e2488bf5397c0ec9a6a1a6a718cec77c379377647402099cb7e4a5bb381286

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD0B9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD0DB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-G4DMV.tmp\sonia_5.tmp

Filesize
1.0MB

MD5
9638f27a949cc2c5ba8eacaa5532256c

SHA1
5de822a91542245433b43cfb73c0bfc3cb4abc22

SHA256
263717e1bc127eb304a9e2f5f9498eb1de3104a4706b22401cff24554bed4e38

SHA512
1972e6aca6be4fb1c44de1e2aee43cb982024a52d88fa57b982592aa599d9eface31d4e67ced2f9a30e6c5120284e775f61f68dd08baae2eb59223f5083f3dac

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe

Filesize
184KB

MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Roaming\services64.exe

Filesize
43KB

MD5
ad0aca1934f02768fd5fedaf4d9762a3

SHA1
0e5b8372015d81200c4eff22823e854d0030f305

SHA256
dc10f50f9761f6fbafe665e75a331b2048a285b1857ad95e0611ace825cba388

SHA512
2fba342010ba85440784190245f74ea9e7c70974df12c241ccb6b72a6e1006a72bd1fa2e657f434d7479758f9508edb315398f6e95d167a78b788cea732be3b7

Download Submit
C:\Windows\winnetdriv.exe

Filesize
869KB

MD5
01ad10e59fa396af2d5443c5a14c1b21

SHA1
f209a4f0bb2a96e3ee6a55689e7f00e79c04f722

SHA256
bef1cffaba8186ce62265e0b322ca9fd9326a8929591df569a4953456c752137

SHA512
1e067ade999ff933a644fde66c6ab9abb8a960ce1c8064368adcde4c09d924bd22d1b43c68b7c968e982fc75937969a2876e9e2a024f72e693f9ba397d449e02

Download Submit
\Users\Admin\AppData\Local\Temp\7zS8E98B096\libgcc_s_dw2-1.dll

Filesize
113KB

MD5
9aec524b616618b0d3d00b27b6f51da1

SHA1
64264300801a353db324d11738ffed876550e1d3

SHA256
59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

SHA512
0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

Download Submit
\Users\Admin\AppData\Local\Temp\7zS8E98B096\libwinpthread-1.dll

Filesize
69KB

MD5
1e0d62c34ff2e649ebc5c372065732ee

SHA1
fcfaa36ba456159b26140a43e80fbd7e9d9af2de

SHA256
509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

SHA512
3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

Download Submit
\Users\Admin\AppData\Local\Temp\7zS8E98B096\setup_install.exe

Filesize
287KB

MD5
7a82c73b9a1b6bf3d2aefe2f3740a564

SHA1
1debd41cb9589c9ebc50b0e370d6d8da565be370

SHA256
35a72b874265e4109dd7d94a37c4417b8fb71a158c4ad10100ef112480b4a8bf

SHA512
61c110e3f12b31fb429afc2fc5b074ab6d4665a8e1b716660bc3f4ef8360ab4187d6137b553430e104998307a849ac9a5db206a2ac20665e890e9bb4c88d6787

Download Submit
\Users\Admin\AppData\Local\Temp\7zS8E98B096\sonia_1.exe

Filesize
56KB

MD5
c0d18a829910babf695b4fdaea21a047

SHA1
236a19746fe1a1063ebe077c8a0553566f92ef0f

SHA256
78958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98

SHA512
cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823

Download Submit
\Users\Admin\AppData\Local\Temp\is-TN62D.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-TN62D.tmp\idp.dll

Filesize
216KB

MD5
8f995688085bced38ba7795f60a5e1d3

SHA1
5b1ad67a149c05c50d6e388527af5c8a0af4343a

SHA256
203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

SHA512
043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

Download Submit
\Users\Admin\AppData\Local\Temp\setup_installer.exe

Filesize
4.0MB

MD5
944d41f7f2edf92ba7308f0cc063e0e6

SHA1
5fa4e1b3ada8568e0e9836ca42f7b37891031833

SHA256
e095acc932243514d360b9ee1e5d45889eb5f22a2b4ab3c30ce113b1ea30613d

SHA512
d44e0219079f6ce6e81d334ea6d9a86088e57ae69ce032446c760d3015db46281394333730d5c06acd1763be62a227717ddb5362af66e774f05967ab8990c2c2

Download Submit
memory/1192-199-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1192-203-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1192-201-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1192-204-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1192-205-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1192-207-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1192-197-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1192-195-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1212-108-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1212-175-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1252-147-0x0000000000240000-0x0000000000268000-memory.dmp

Filesize
160KB

Download
memory/1252-141-0x00000000002A0000-0x00000000002DA000-memory.dmp

Filesize
232KB

Download
memory/1436-192-0x00000000002C0000-0x000000000031B000-memory.dmp

Filesize
364KB

Download
memory/1436-194-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1436-190-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1436-191-0x00000000002C0000-0x000000000031B000-memory.dmp

Filesize
364KB

Download
memory/1588-154-0x0000000002270000-0x0000000002354000-memory.dmp

Filesize
912KB

Download
memory/1668-265-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1668-262-0x0000000000310000-0x000000000036B000-memory.dmp

Filesize
364KB

Download
memory/1736-343-0x0000000000400000-0x0000000002CC3000-memory.dmp

Filesize
40.8MB

Download
memory/1736-312-0x0000000000400000-0x0000000002CC3000-memory.dmp

Filesize
40.8MB

Download
memory/1744-299-0x0000000000240000-0x000000000029B000-memory.dmp

Filesize
364KB

Download
memory/1744-302-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1744-298-0x0000000000240000-0x000000000029B000-memory.dmp

Filesize
364KB

Download
memory/1788-267-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1956-320-0x0000000000400000-0x0000000002C67000-memory.dmp

Filesize
40.4MB

Download
memory/1960-166-0x00000000002E0000-0x00000000003C4000-memory.dmp

Filesize
912KB

Download
memory/2256-185-0x0000000000240000-0x000000000029B000-memory.dmp

Filesize
364KB

Download
memory/2256-183-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2256-188-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2256-184-0x0000000000240000-0x000000000029B000-memory.dmp

Filesize
364KB

Download
memory/2352-345-0x0000000000550000-0x000000000055E000-memory.dmp

Filesize
56KB

Download
memory/2352-149-0x000000013FD60000-0x000000013FD70000-memory.dmp

Filesize
64KB

Download
memory/2508-315-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2536-52-0x00000000034E0000-0x00000000035FD000-memory.dmp

Filesize
1.1MB

Download
memory/2536-46-0x00000000034E0000-0x00000000035FD000-memory.dmp

Filesize
1.1MB

Download
memory/2572-349-0x000000013F9A0000-0x000000013F9B0000-memory.dmp

Filesize
64KB

Download
memory/2608-143-0x0000000000D50000-0x0000000000DBA000-memory.dmp

Filesize
424KB

Download
memory/2684-318-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2716-174-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/2872-353-0x000000013FF40000-0x000000013FF46000-memory.dmp

Filesize
24KB

Download
memory/2900-215-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/2900-72-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/2900-75-0x0000000000520000-0x000000000063D000-memory.dmp

Filesize
1.1MB

Download
memory/2900-80-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/2900-217-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2900-216-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/2900-84-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2900-214-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2900-212-0x000000006EB40000-0x000000006EB63000-memory.dmp

Filesize
140KB

Download
memory/2900-209-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2900-81-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/2900-65-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/2900-83-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2900-82-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2900-77-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2900-87-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2900-79-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2900-54-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2900-60-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/2900-85-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2900-76-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2900-86-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2900-71-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2900-74-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/2900-78-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2900-73-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/2932-342-0x00000000002F0000-0x000000000034B000-memory.dmp

Filesize
364KB

Download
memory/2932-189-0x00000000002F0000-0x000000000034B000-memory.dmp

Filesize
364KB

Download
memory/2932-316-0x00000000002F0000-0x000000000034B000-memory.dmp

Filesize
364KB

Download
memory/2932-319-0x00000000002F0000-0x000000000034B000-memory.dmp

Filesize
364KB

Download
memory/2932-296-0x00000000002F0000-0x000000000034B000-memory.dmp

Filesize
364KB

Download
memory/2932-297-0x00000000002F0000-0x000000000034B000-memory.dmp

Filesize
364KB

Download
memory/2932-181-0x00000000002F0000-0x000000000034B000-memory.dmp

Filesize
364KB

Download
memory/2932-341-0x00000000002F0000-0x000000000034B000-memory.dmp

Filesize
364KB

Download
memory/2932-182-0x00000000002F0000-0x000000000034B000-memory.dmp

Filesize
364KB

Download
memory/2932-305-0x00000000002F0000-0x000000000034B000-memory.dmp

Filesize
364KB

Download
memory/2932-306-0x00000000002F0000-0x000000000034B000-memory.dmp

Filesize
364KB

Download
memory/2932-257-0x00000000002F0000-0x000000000034B000-memory.dmp

Filesize
364KB

Download
memory/2932-268-0x00000000002F0000-0x000000000034B000-memory.dmp

Filesize
364KB

Download
memory/2932-261-0x00000000002F0000-0x000000000034B000-memory.dmp

Filesize
364KB

Download
memory/2988-144-0x0000000000EB0000-0x0000000000F9E000-memory.dmp

Filesize
952KB

Download
memory/3060-304-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download