15851ba169256e46926356a4f13eaf5bba71a701cb64804d3a8587bf82eade95

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 06:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2ca5975ec539fe5a5b5926e311fbaf73_JaffaCakes118.exe
Size

521KB
MD5

2ca5975ec539fe5a5b5926e311fbaf73
SHA1

174a39d61cb9d6ec8e95ed66d6553f01a69d601d
SHA256

15851ba169256e46926356a4f13eaf5bba71a701cb64804d3a8587bf82eade95
SHA512

040869a9e1183e65fad0278b396904cfe617602873367cd23907a1219690464b1cf7c43888d79054862ab90ddc397aa66c05fbf47c795cb700f5d3f74e74ffb0
SSDEEP

12288:RYCdqrktyBcXfXOZBfkuCaGBEqrcIdnqnPLE5skoprCYomu0l7hG:arhBKX8fkuCaGyJIdnALE5lQrCHmlltG

Score

7^/10

discovery upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2156	2ca5975ec539fe5a5b5926e311fbaf73_JaffaCakes118.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2156-0-0x0000000000400000-0x0000000000513000-memory.dmp	upx
behavioral1/memory/2156-1-0x0000000000400000-0x0000000000513000-memory.dmp	upx
behavioral1/memory/2156-3-0x0000000000400000-0x0000000000513000-memory.dmp	upx
behavioral1/files/0x000600000001947e-147.dat	upx
behavioral1/memory/2156-148-0x00000000060C0000-0x00000000060D0000-memory.dmp	upx
behavioral1/memory/2156-291-0x0000000000400000-0x0000000000513000-memory.dmp	upx
behavioral1/memory/2156-293-0x0000000000400000-0x0000000000513000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2ca5975ec539fe5a5b5926e311fbaf73_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	2ca5975ec539fe5a5b5926e311fbaf73_JaffaCakes118.exe

Modifies system certificate store 2 TTPs 7 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	2ca5975ec539fe5a5b5926e311fbaf73_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	2ca5975ec539fe5a5b5926e311fbaf73_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	2ca5975ec539fe5a5b5926e311fbaf73_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	2ca5975ec539fe5a5b5926e311fbaf73_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	2ca5975ec539fe5a5b5926e311fbaf73_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	2ca5975ec539fe5a5b5926e311fbaf73_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	2ca5975ec539fe5a5b5926e311fbaf73_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2156	2ca5975ec539fe5a5b5926e311fbaf73_JaffaCakes118.exe
2156	2ca5975ec539fe5a5b5926e311fbaf73_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2ca5975ec539fe5a5b5926e311fbaf73_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2ca5975ec539fe5a5b5926e311fbaf73_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac4454d5b65773b07dbbd890461a0b5f

SHA1
e8ce089854c226f68a298b93deec4cbbab32e8f2

SHA256
c219e6e60bb0a65b1d4ed0a727706c62ef72f03cca71f8c1d8d464185ffcf1c3

SHA512
b27749f85e45e8fa7f8c1e49267aceba93719d4b5aa054043db7676708689568c0744e2c45058b71fee346a633ed16a6ea0e4c5acbd1869c5738ac7b395a1dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA823.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA846.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259428445\bootstrap_49594.html

Filesize
156B

MD5
1ea9e5b417811379e874ad4870d5c51a

SHA1
a4bd01f828454f3619a815dbe5423b181ec4051c

SHA256
f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a

SHA512
965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259428445\css\main.css

Filesize
5KB

MD5
224ce27420b9adf4491edadb3bc4ccda

SHA1
91d7a7984288713e8b82b1ec5ff36a7de8e8633c

SHA256
2e6dd307b58b6eab1ff4a51c5d532e2050de590deb80e3fc62cd2daefbd55393

SHA512
e28ce17f9dc7a730e95c0d1a6e50d08c4c4704bccee4bd396ebead971e55c75b2b1f26fd38e1749a3a468b04c1b52cffe8dba6da6ae45505f7cc50d098967600

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259428445\css\sdk-ui\progress-bar.css

Filesize
506B

MD5
5335f1c12201b5f7cf5f8b4f5692e3d1

SHA1
13807a10369f7ff9ab3f9aba18135bccb98bec2d

SHA256
974cd89e64bdaa85bf36ed2a50af266d245d781a8139f5b45d7c55a0b0841dda

SHA512
0d4e54d2ffe96ccf548097f7812e3608537b4dae9687816983fddfb73223c196159cc6a39fcdc000784c79b2ced878efbc7a5b5f6e057973bf25b128124510df

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259428445\images\BG1.png

Filesize
6KB

MD5
d2a826cfb8e441ebdead29bb0e1d1ed7

SHA1
b75f295cdf11977e5b2d74fcfddede5a82f59c06

SHA256
aa9c26e67a11beb0fbcbd569779f421079224ac8a3ff29251c0f8eae3e562a8d

SHA512
c8144812b9a9ce124bc1dae7ece948c042369b827695ef7f0916490568d32d37b19a91f6ec3b82fdbb9106539f6eda31dc9fdc657e9dc025b8f8aaac31604b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259428445\images\BG2.png

Filesize
5KB

MD5
3ddb3f3052989498efba386b8a0c21d6

SHA1
9d66abc2ff7abb3282f3303a85de97d13811eb62

SHA256
2c845e3e3c1f48c0867bd39e39f5f81b114fe0d6f51302adb0f1231a372cbcda

SHA512
ee5eca9e2ce4baa967559326e313c84ff333858e6644f0b7ac805f4c221150cb52199cbd7feb36c9db3bc64a0773be7593027b55869fde9abb7349d3f24ec2bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259428445\images\Close.png

Filesize
322B

MD5
5b97212a9d8ad0865531c4941e20bde6

SHA1
61a0c546e8c2ac403ac2dc20587173c8e1418ffe

SHA256
d78b9e6c8cb83728615c7664d95dd2c3f11afd7bb4c382b0388ace743e2305af

SHA512
5ef7b48c1a543b370b9957a20821f802f5578bda83a4aa4ab6a8cb47d465da31fee9b2de709a439245d8526b337c35c0738f2f7ce6122da9e9600d25a3f84ab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259428445\images\Color_Button.png

Filesize
592B

MD5
499b602442514ccf3794f01c83909eca

SHA1
e1ee94a95c6690be69cc6215b8defcdc30a19d5c

SHA256
371e00281023b79884d559b67cc2db529da70c295dde53b812aaddb6181d73fd

SHA512
3946c5262cdc535fb9a928282216c59cf1a1fe349bded69086864cde2de2465b6a7d6425f9fb988c150d2bcc9491471f4930aea9397297e2e07d42e786241e08

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259428445\images\Gray_Button.png

Filesize
291B

MD5
257b6acbb516ebf9b81d982e415ffad2

SHA1
132f7b288412911f0c7313e0e9c7da8294126791

SHA256
96c2f3a633fb04207b27caa7e391372d968728e6ae9eee71908dc7c9d8218048

SHA512
624650a5437bb30c076e2f370e123f22b5e80b4b4f97357504345338031afcbf09630b84373dfedc3a47b4322e33b92e72e683f69c9a7a47afed97bc3a9a7536

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259428445\images\Prod_Circle.png

Filesize
1KB

MD5
239e096a673ac6c2adfd34f78aa6234d

SHA1
dc2c5fe032a777171cdd08cd8de040503b59f642

SHA256
39ec7a68971d5536e4c4d45e91943548b4ede65a42fd7ff3d89a03ac998d5538

SHA512
5c21d549d434844798655e40e331a6b03ff7d5d0f1f8c698395fd334f58ae791fafb361eb96566e0184e52a2fb59da7d6ab3b62a59e8e6b5b4d4d8869291618a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259428445\images\ProgressBar.png

Filesize
469B

MD5
48b1d53e7b743bc1dc9ed2ab24d3e8d3

SHA1
798a0b8be166adadd45f70b38bb44d2bf9baf450

SHA256
c58d4eb376e7a08421deb20d039465db89bc26814425ed68df97df873d86cff5

SHA512
380acd30ef72f786d51e63885d295b02870ac7b0bb54712f3be488e5a38107902ba0137ba02584f1d974276325638dc9342d7edfd5cbbce80c1b8133745941b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259428445\images\ProgressBar_Element.png

Filesize
246B

MD5
001862156596834b18af80203241ab75

SHA1
43786b8f6a46f0b94853f5cc1d5e20202c1ac311

SHA256
e8458a7e0d987fb72034de02df8562cc0c566622eeeaf9d73899fbe7cf46d793

SHA512
5dcdf43fd3aef06bf6c959cfdbe5ff704ed7330697cf36f2b07e0538b84d4ce8d44defbdf8d7f9b0b148229e39c2a61b0290a9e8d4016072ad32ea83fba1fdfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259428445\images\loader.gif

Filesize
21KB

MD5
360281e85620142c3329848262da263d

SHA1
032ae1e422af859d78d172e918573fb0f55318de

SHA256
6c7d0d5402ebcf34cb6280473b4dac5966aae2a4bdadf80c796245663e2d9b55

SHA512
48ea37754839abce73898d29c6cb1ede20ac980dcd0b8c0f1274a690ea0bb44659129aba7581bd473ab7a735b7b9d08d6d041973bced4fe3fc0b70b3a73ec2a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259428445\locale\EN.locale

Filesize
1KB

MD5
77765c009c5ab6d2f13961315751f645

SHA1
1c118a0e3557bd545fccce81a38ff29b51675dad

SHA256
ea60de0c44dbb70d9d9e6c6b1d499899f05f2132511f0a65be801de3f1294d89

SHA512
d5661b1d4f8ce8e30b396ee1077715e7d66483d6297ac813a5ac3f761dd87117166c64245edcad6e59aeb8d685ce2bd60a9216c19596c24646fc4aca23992e7a

Download Submit
\Users\Admin\AppData\Local\Temp\ICReinstall_2ca5975ec539fe5a5b5926e311fbaf73_JaffaCakes118.exe

Filesize
521KB

MD5
2ca5975ec539fe5a5b5926e311fbaf73

SHA1
174a39d61cb9d6ec8e95ed66d6553f01a69d601d

SHA256
15851ba169256e46926356a4f13eaf5bba71a701cb64804d3a8587bf82eade95

SHA512
040869a9e1183e65fad0278b396904cfe617602873367cd23907a1219690464b1cf7c43888d79054862ab90ddc397aa66c05fbf47c795cb700f5d3f74e74ffb0

Download Submit
memory/2156-148-0x00000000060C0000-0x00000000060D0000-memory.dmp

Filesize
64KB

Download
memory/2156-0-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/2156-3-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/2156-2-0x0000000000401000-0x00000000004C6000-memory.dmp

Filesize
788KB

Download
memory/2156-1-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/2156-291-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/2156-292-0x0000000000401000-0x00000000004C6000-memory.dmp

Filesize
788KB

Download
memory/2156-293-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads