Malware Analysis Report

2025-08-10 16:44

Sample ID 241014-s55nsawgjp
Target 42ec8922736e487598a628cbe2b12efb_JaffaCakes118
SHA256 e1084b11b372b79a666fce8568900f6e487de29866b7747ea13a37a75b081065
Tags
discovery persistence spyware stealer credential_access
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

e1084b11b372b79a666fce8568900f6e487de29866b7747ea13a37a75b081065

Threat Level: Shows suspicious behavior

The file 42ec8922736e487598a628cbe2b12efb_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery persistence spyware stealer credential_access

Checks computer location settings

Reads user/profile data of web browsers

Credentials from Password Stores: Windows Credential Manager

Adds Run key to start application

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-14 15:43

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-14 15:43

Reported

2024-10-14 15:46

Platform

win7-20240903-en

Max time kernel

150s

Max time network

136s

Command Line

"C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\_Hazafibb = "C:\\Windows\\system32\\brdwgtet.exe" C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\brdwgtet.dll C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\dhiozppy.dll C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\vmxxrtxw.dll C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\irvclfil.dll C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\otaoztqm.dll C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\ahjqutqu.dll C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\wruyszml.dll C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\ntippcwi.dll C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\brdwgtet.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\sitqvyud.dll C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\fqwpaiff.dll C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\IME\shared\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\bdteitrl.dll C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\IME\shared\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Windows Sidebar\Shared Gadgets\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DOMStorage C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DOMStorage\facebook.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435082478" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0FBCA571-8A43-11EF-B5A6-7A9F8CACAEA3} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f5420000000002000000000010660000000100002000000087373c4a4e5f71f21043fb1e3d7c279b4f315f5d68688d7250412e3d6f5bbc3c000000000e80000000020000200000007297a8e8ab72a6b7f0d2d2bbc8b003a97cefd84f9ee30bb51e7dc5e6146e94469000000089bc290b6de5365704d28a685c065792f0fb9b14942d05ab03decb5213b346f72b3eda11ef8b3275d41c758e26a96c650ddef01f56f7493da8a8d223b45eff11d23d2fb4091df53d79b44df1fbc5bd26229331265b09f187be2bf5a27d33fcade5064b35040d2104ad15323233fabee5080bd6c443bc9c53deb9a659e1ded860f35a9ab8e2d57bd5266fdb7dfbc2364d40000000e7655d6fd96be965782e43b9dd996f1759915d540dcd788cc4e07b1a776c34c1b7d7b20ea2ff8458fb5ae0ed4693bd2e43b7da417dfa765d467a141b64c9e542 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f542000000000200000000001066000000010000200000000bec9209f365059d4a0eb1f137c61efab48b3d358230ed617f82107dba942bd3000000000e8000000002000020000000445a9fd2ffcee748d1678449a826044931a79ead86fc2b42ccce4910e03d235820000000cef28fe184ee6e5228fd1943769482df6d5cdab6fc492486790a015c22ec2eba40000000f9966908d2f77ebc266dc2c66bd451773dce883dac8b4f0c132f29b9052c5e030ba25412dce0bde35f29d2a66c077d8926612fae4f1d5213d32cc52ef9b18874 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 302ce5e64f1edb01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DOMStorage\facebook.com\NumberOfSubdomains = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.facebook.com/

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2540 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.facebook.com udp
GB 157.240.221.35:443 www.facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
US 8.8.8.8:53 m.facebook.com udp
GB 163.70.151.35:443 m.facebook.com tcp
GB 163.70.151.35:443 m.facebook.com tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
US 8.8.8.8:53 facebook.com udp
GB 163.70.151.35:443 facebook.com tcp
GB 163.70.151.35:443 facebook.com tcp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 fbcdn.net udp
GB 163.70.151.35:443 fbcdn.net tcp
GB 163.70.151.35:443 fbcdn.net tcp
US 8.8.8.8:53 fbsbx.com udp
GB 163.70.151.35:443 fbsbx.com tcp
GB 163.70.151.35:443 fbsbx.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
US 8.8.8.8:53 scontent.xx.fbcdn.net udp
GB 163.70.151.21:443 scontent.xx.fbcdn.net tcp
GB 163.70.151.21:443 scontent.xx.fbcdn.net tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.19.117.18:80 crl.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

memory/2112-0-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\winamp 7.0 full_install.exe

MD5 769c960c39fd34cc6c4805c41617f234
SHA1 59b9185e0dbcd4071dfa826ce2eabdbdf5d32d72
SHA256 cb4a9e4b3c85476b27983bc8d4e5ac11e2a4dae461be01bd9a8635c74a024bd6
SHA512 df5311867f620d4ad006ab7dc36acd891ae382a6fda7178c98347ade6c99e772fa98babb1e5d83909bd22560aaa727f44cfadf5107a3f9bfa1df2dd8e8b206bd

C:\Users\Admin\AppData\Local\Temp\CabCCF2.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarCD62.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e5f8b7ef129523c7d69f0c79eab2e1ac
SHA1 012425d1bb7870bfabdce1be5888da10908171b7
SHA256 e81e11b31d2ee8cfd1d4197bdd3759100808c40aeb6220dc343bbd924bcef81e
SHA512 02e70bdddc21362a7afa0a087e5ecd75364d814a6a282c151ef1edb038336649ee82a09a3cd4befb3a356677c7afd03957df9ce19d6e65dd20e6e462210e09c0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 84d2c7d27128a8bf404ba2a953cfa5fc
SHA1 dea27301b29224aa335ae82d51cdc8b9e28ca86d
SHA256 1c5ece09a30a03d31ee6829676f63ce66d280e250a721db1e32c2461d2686b6f
SHA512 1becbd6b7000f82279f58a52582d5b28b946d34fea21fce3366659616f6f775a8e325e08ae8e233ac2f06ac5950f42477c1429cddd7ac806ad85194188c9ca81

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\bl977i7\imagestore.dat

MD5 83fa7ed3ab9e12463d713e0f5ec84296
SHA1 b74b4328e532207f3a49990894d6746e6ec64cfb
SHA256 3597d8b69152e6dfc94bd541612002d99dcf4eea7953db6b1d5aa8fe76443951
SHA512 93be3d6d803c2e919075d2ed8389f80c4c13ba5c713257c6490ebdbaa22f70e6202bb50d64d0cb4acb8694827171aa7cba8dfa0a080afec560f4a04a22fe6351

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QS2MOPHD\4Kv5U5b1o3f[1].png

MD5 a81a5e7f71ae4153e6f888f1c92e5e11
SHA1 39c3945c30abff65b372a7d8c691178ae9d9eee0
SHA256 2bc7a47889c56ad49f1b8b97385d5a4d212e79bb8a9b30df0665a165f58b273e
SHA512 1df32349b33f6a6fcb1f8b6093abd737fa0638cdd6e3fd90a7e1852bd0e40bc2633cb4e13c4824fb948d1e012e5cb9eed0b038b121404865495d4e57e123db69

memory/2112-257-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2112-256-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e1897512ef5c2499482493dc1b3b22b6
SHA1 68f864dfd0a0a12177d05657fe0d196e507fdd9a
SHA256 0dad414b32f2855a48fd9f05373671ebb95152f0799269e1969ee0ee84393618
SHA512 5b3e480ed08465e2223d0fede0fd46126dd4135060fc26e6c37ac061c0f90d4621531102abb6b6dbeb029884bffc78af52254271603744fe3a2f4d913abb45ea

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 58443aa0b330a909a4b408b03bbd0245
SHA1 53cc2e1fae8f616944fdd4b270c5097b922bb8a8
SHA256 3b8b8216f056b593b44f09205e20e323f9ac1642719ada22537d44dd7c51a2ba
SHA512 2f07aa6fb8dc4637437903e1b9dfc4a906788235ae2ff72a0d4f6bfb425c5e31fc7e3ddfdfd1de5269e4bc44bca278fd89e27152c076acdbfe51f4165d8caa1d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a188cec6a22adb3b132c85f33ec49e24
SHA1 14f08b9677858055c910449a4d271157a70d3f01
SHA256 897445cff56b2ab6c1fa8571e8b7d3dfb5a1bb1c0f0ca7164b98fd4e893b4931
SHA512 5c514f0be904ffaa7e07d3e0403c67b77cf8756bcfd7fcd1a2799d46e92c6237f9555908265abe617f7407cb173647d946a714e223e5d35618c2627117f63bd2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3523079ebb2f338a977833d23921ef0d
SHA1 3cc432209cbf282f9b6b4ca6ed2da8c8bd21cb96
SHA256 d39ca93e76677da0e3320eb68a0367ebb64e641c0d30a406e2f983ce7ee80d8b
SHA512 0db149226fe3c888de42963e040769aa0c26d03f04e264bc2e40d0d5bb86e4e4bc7717604e8a105ed657d3ec8464a9562c86a4d58337239e306a7083ab3bec90

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b09347f30634d996accab894ad86d93f
SHA1 9826c6e3ec1319b9be73e3d292a92e45de6bfa62
SHA256 9c61b3a935a2e5153f1e5d9b5687e257d8cfe95d97e4d9bbd65c284d61ec8619
SHA512 d95b8c0756ea0953fef1c1eb378c4f406b7473584535a01d35693ac75a6c4e6fb3ffc45d680a88af0c955dc71fcc634d1cd900cbd965909bd3e6b740a1ff2eb3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4dddd0a2c162c245cd0a1b34022bde41
SHA1 b6d04b7de5f974aa989e7fb5bea6a03f81878bda
SHA256 8354a49278f7029a127c9d1b9d584d232af0aff9c6e40934cd04403822851805
SHA512 fd5496bdcd157ffee5152cbb70fbb79d4409822db78c55f871836feb496a936fb5c21b472d1e48af30c71e61a8c72545410c1bc6af09d4694ad5f4d31f10b3ee

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 04daf6f0efec6b46aa1922447795dedb
SHA1 ad47680623e9f274c46775e8cab0e7ea98cb2084
SHA256 41e203b307060dd28c1fa8dceaeb302253802fef2c22876e3ff5177a96798ee2
SHA512 2293499f27e6cdee6981b96b577629d1e91f102c589e03e7f4c5424c6418acfc7d17dbc2272b5375b76e9eafe4b898e76462469085801d28fd28ec97faee05ee

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1fc59520b9b2994c616d32c3ae31a7a0
SHA1 fbdcec28d5288f9587ae62058adc04a592324678
SHA256 69a114d34b631b6efedfbe5a2d872e9f69d37583838a29d350b911d73447d403
SHA512 d4578fc215b612d4bdcdd4479ea5893bd2c603e3f03cc0e9dc7a9c614dd3a556250129d02340d8e24fd98eb9caa9cc69c0a53b7ea18eca8c641e6e2d6ccbfb71

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 73c2af3643dde35242b992c9beba9f64
SHA1 c7fd6dbc414cd1777b4bc83e287bb114b8e14091
SHA256 c76bbb6717ab64032af3e434c10a2581154cee02901d6eb9f5ff55b1bfd761ca
SHA512 73fd70ff1c402c9c31376882d43a09b4c39ebc742ecb0e834f9f91cde5192e8fe14727ac8671a58122ebe379a9c5f82fbeaeb3d102d1ec09faa751d668051ecd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 698d5998faacb98d589e191f7047463c
SHA1 c3c5af8607423ef76271525751538059dbd66798
SHA256 8b85d5c74a79e3500812acddd3d5d4700419ee1210a0b6f3db12497e29a3d50f
SHA512 bf02793845c19d10e131fd509355551cf0c4192edc7c4a7682500c2e352ac4047e1e7fc1094060407d24fbe13093ce3544d524903e00545d105123be4cb482f6

memory/2112-687-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QS2MOPHD\login[1].htm

MD5 349b987a16064420d8fd78e605a1af77
SHA1 8aedee0c4b7cbcd77f3ba3df64f89fcef0b084de
SHA256 0ecf646e9b5aa14c709ad652765202e2d43f7ff8fcac4cf7ce973e80ebe6b301
SHA512 0445260af66d2ff4ae129355ec7874374251975ecb77de7df286f5a568cd555587081d6b570bdd51f2bc04f9f3a411e6563ca13cd9d718d946ae530cc1c90244

memory/2112-712-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2112-713-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2112-714-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2112-715-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 527b680c5628e84edfc1d0f5c5de7dc2
SHA1 7b3f5dfcd751e3efb06c7d3823ae0d76db116c19
SHA256 6fbc4becbaf5d94d1899be77ab033727abe8a9624dbc666a9ae25582d3e09abe
SHA512 b24c2506d0b9ec2678a155b5f613a8ef8a1cbcaf094f133c0c46e3e494b305b930241f13aa7e0c1fce91365b8b9e77ba01a075316a6c0e73619fdd6ed676cd32

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b53dfc0c025d9b64ed130692269ac581
SHA1 a75a2ef950fad086f1bf97584e8db7eb3e857bf5
SHA256 94960c45eeb255b69ebe942b5aa31a9a5ec897cb6f5aa29041cc73b539633b48
SHA512 facdc5da2c2e068e74a52419efa8d02e78410ebd546c1eded825abf4e33b5641a6348ba4fff37c741b7858135de4aa30ada4176396fa4597d1950f548d99641a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 4989012e1093272b9cc30d69eb337b0d
SHA1 c9ec0bbc164c1c2bd4ce780c8c5e03a7a2b96a40
SHA256 93763e885a547e130aede11fdcc99bf86d1d142c1738c75a1b28ad4117347f9c
SHA512 96f66ea2f9289a728a6863eacc0a425cc6c66379d8c9e08b6821da2fe4a1c7cc09cf76525f074412f6ce3abfe2483f81557dc0ed27fe745fcdee88e510ce7e84

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3bb5d6929bb7ee2afb59fe156a7ffcd6
SHA1 48931e490fb84b1155765594aaaa1fbdd5719c3f
SHA256 2e3725657f7725084c5c16d511eacabf1c5bf2ea8abf01380e6ff5744a94b82a
SHA512 6004f4a87d1198a22599a431c9bee77e3207bfadb2f11efd8fd089beb1d008d257a3930e1f6591e16f6ca9cbb4f09acf3bb9998fd4522625cca15265634b541d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a297678af2212b6aa1b146cb568b98e8
SHA1 12f9944f25d35df2a2197cd13e79c3867e167233
SHA256 28614caed8389e648e3fa9e8ae78812cdf4e2c58e8328b302a081dfb4634dcda
SHA512 37d1c7b76b11d2c7fce3196709538ab6cbda210c49e8aff8d5c0a7cb9e2df935e03d7f49e562e06b22a0c98b353012719b7c788f0f6c7d3710c645748443c074

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 896fee67b6859adcb9a56d0f02c66d92
SHA1 3ae3d85981c463245c4d7e3234f8e8d4e7aafc72
SHA256 2536663f0b154e25bd1827486d64747044ca95d011f5c91b82af1938ab061fbe
SHA512 051ed751a06c7d2394b86fb01171b39b82b4d21273c2f48a74daa69d29508764dbfae004753de8b40f1ea1a8cc790dcbfdbee3d5cd37f88be962db41b54f0c87

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b04d46e8f4d3780a139effea25a1a805
SHA1 9c16067efd361755a945abea8b7062b6999743a5
SHA256 3fb810cbf91a6f00a4d3117fbc975f45ddd36b954e4ab177d094c4f9e15b910f
SHA512 e8faa49ab69ef522dd90cd4792dbee35fa2d952d5b373dd3d0141da8d0aff487e60f721db251edb00e35f14a1b21f60bda9f95a5a4b2607ecb720ddbf6bfbde7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5a72cf0d2c99ff0c38085a4bf7ab10d8
SHA1 44cb4b3bede69d49a0d107a7cefe9ef38eece497
SHA256 b0daf4a24427495f62f21da58dc17537ea1fbe8bd69fcea98fa2cfa759de16ef
SHA512 190dcfc8f9727a32a9814cacd118d573497bed68f3cc646e25c5f6fe889489f38d8628e1ed327935c7b54bf94ddbb25f180b30d7f5276fca8d2b67cb9fdd5fa0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 08cd18a6097d8f2b9e757825a0548166
SHA1 097e1e37e851a8515e456aaa2da9ab9eb9e32f33
SHA256 f661f9c8b1843fd8761103067ae3adbf165959b261f644a5f5bcbfb7a8c54d28
SHA512 cbdfbe02baea57918ce2f66dc996b9e4c5bc3062374e96242219146edb8e8f1534b8b88cca4a8bd7ee09cf24f77d57fdd63416bc482db58fb59d60e6be73a1f8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 52b249fce18ecad5e7446ad76eb5769b
SHA1 a4bbf8b2449bc38d768b357a3b07db9f766716c0
SHA256 bcd953fbc1fbdf36317e33f8906de0abdb3e360a4ef75546a0cf97eb7b00dcbd
SHA512 a0b01bca6e55939cb378024f1f74ea06a3518da8f6da7395ce8a0f452ca55c9549fca41a59a43d3c1f94c85929dd41a2be3f0e90dd6f85dc1f694858c9cd67ac

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a31af8166bbaa5797d19a049af05006b
SHA1 3eedd798d07ce306f8876e2aa361917bc51a94b7
SHA256 7c83a5f78aefc5b1df1d8517392c48d0e27dcfb53808f7723473004d82dc1b57
SHA512 c82393f07215bfccfcc5255e709243d9a69cac9a9e904bae18d091e9c364127b69450ecc7e8d7b0fe1d75430ecf718498da45119d67ec22c8fa0c110f73a2a0c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c676c95879b04af7c50ec7ef2bdaedf0
SHA1 00d59419996952c963a5c77a7f267d71f66d225b
SHA256 c022b3bab7395f7e6230ece78fc1da77f943faecd444c51c1115c541cbd823c8
SHA512 2bb9d03e6fbecaa03a99b6ec047fa456f91f4ab14ec0d7b36451c3b745e1aca29e0f1cacefe4ae5d765fa670375bd933eb707d4e6d2951941f9aba41de9eb577

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8b6acaa9c5c2d6d002b56387c325edab
SHA1 8f6fdd2199b18dd6f199a54adda1d002be09ba03
SHA256 3804da9f07cbb01e6536713ced688b262ecaa791a63de9821d29dc3355f2488b
SHA512 6f9926fac934a6b931876be82d254b1686958cbd911dd988dbcf340a76f14e5c03d443839037e0d4b77988c7f79eba999703737822ed136d0387ac76687a25f7

memory/2112-1260-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2112-1261-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2112-1262-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2112-1263-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2112-1264-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2112-1265-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2112-1266-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2112-1267-0x0000000000400000-0x000000000040C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-14 15:43

Reported

2024-10-14 15:46

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A

Credentials from Password Stores: Windows Credential Manager

credential_access stealer

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\_Hazafibb = "C:\\Windows\\system32\\kwbusawe.exe" C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\trrgiahj.dll C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\gxvewgke.dll C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\puohfdfz.dll C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\ckygmimr.dll C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\IME\SHARED\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\qyrqufqr.dll C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\kwbusawe.dll C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\gngrjpbs.dll C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\kwbusawe.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\fqmflvhi.dll C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\zhdxndze.dll C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\IME\SHARED\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\bvkfbeph.dll C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\knrubxsr.dll C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Windows Sidebar\Shared Gadgets\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\dotnet\shared\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.1_none_f42978969c79336a\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1288_none_ca3007304990b2ea\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_211cf1c632a13851\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-composable-sharepicker_31bf3856ad364e35_10.0.19041.1_none_c87e96327faffd0e\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_5b152a8d329397ec\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.1_none_fa09f84703cb02c5\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.746_none_2212358fc33cc10f\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_19d22204a1f3fcaf\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_ab42fb092bda9182\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_d8a1416ab7cccdcf\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SystemResources\Windows.ShellCommon.SharedResources\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_621728fcd3c9d5f6\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-eashared-ihds_31bf3856ad364e35_10.0.19041.1_none_e8996b7d3512363f\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\InputMethod\SHARED\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_it-it_bdb6c49fcea35732\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.964_none_1c1a193f5bfcf136\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.1_none_a80cea873b2a6772\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_7860bee9439c3ae7\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3d467c525734eb3\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_833abdc06c68d338\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_30d7585a049f5b52\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_5d54c0aac5c3c12c\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_57eddd48e7a74274\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..se-shared-datafiles_31bf3856ad364e35_10.0.19041.1_none_2f5f00d280dce9f6\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1_none_0b596e2a33be7d4c\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\SharedFileCache\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5fdc43acc1be690d\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\Total Commander 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.746_none_d01527cffa9c25bc\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_adfc5e0bfca53431\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\winamp 7.0 full_install.exe C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31137359" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0FEEAA97-8A43-11EF-ADF2-DA61A5E71E4E} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "108" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ebay.com\Total = "134" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ebay.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\DOMStorage\ebay.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\DOMStorage\signin.ebay.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "107" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3830583831" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a43d217a0cb97a4db769f976d8642e3900000000020000000000106600000001000020000000ef058772bb8bf41fa9d234eb1524fbc53f75acb54d1f649ea2e2d657859009f1000000000e8000000002000020000000957c0ecb91b2305d2397d0ec87469ebaca9c2c77284343b47c19c5242edfd4fa20000000bb9621872a4b56a0aa5e0f8b333792476ee3d3f86d7357d19c542f8e73ef631040000000e6544b2b046c694c6e84255b0f63a7a1d320c6df37d7a60fd126e4f62e300bb2a54c6ebf5c99e12c7ac961f421ed595ffef19e2be80a395b401ce31eb72ac8b3 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31137359" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "103" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a43d217a0cb97a4db769f976d8642e39000000000200000000001066000000010000200000006ce13dc6d62203939030813893218f89385af45bba35b25bcf101c39c4311206000000000e80000000020000200000007dbe52383b6e1b9076b84fd480742616e5aae293b58d876ea4d0dfe9bc5b39b3200000002660ff36cacc1b23e342b94ac58f45e0566a9556ffa94e7d6b2f02f6fe8306f3400000008f8dc7728353b4fb8283ac1825b5c0a3fd27e97ebbfc707c29e82a58eef2bb7df27c92517be20a85a56d8c8ef280cac96c340b12824a95fc35dabe49abd3c51b C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\IESettingSync C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70ec68e54f1edb01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\signin.ebay.com\ = "108" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ebay.com\Total = "108" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ebay.com\Total = "103" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\signin.ebay.com\ = "134" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ebay.com\Total = "107" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435685585" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\ebay.com\NumberOfSubdomains = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\signin.ebay.com\ = "103" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3830583831" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31137359" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 608972e54f1edb01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\signin.ebay.com\ = "107" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "134" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3833708937" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\42ec8922736e487598a628cbe2b12efb_JaffaCakes118.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://signin.ebay.com/ws/ebayisapi.dll

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4476 CREDAT:17410 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 signin.ebay.com udp
GB 104.124.161.67:443 signin.ebay.com tcp
GB 104.124.161.67:443 signin.ebay.com tcp
US 8.8.8.8:53 67.161.124.104.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 ir.ebaystatic.com udp
US 8.8.8.8:53 secureir.ebaystatic.com udp
US 8.8.8.8:53 i.ebayimg.com udp
US 8.8.8.8:53 rover.ebay.com udp
US 8.8.8.8:53 www.ebay.com udp
PL 93.184.223.214:443 ir.ebaystatic.com tcp
PL 93.184.223.214:443 ir.ebaystatic.com tcp
PL 93.184.223.214:443 ir.ebaystatic.com tcp
PL 93.184.223.214:443 ir.ebaystatic.com tcp
PL 93.184.223.214:443 ir.ebaystatic.com tcp
PL 93.184.223.214:443 ir.ebaystatic.com tcp
GB 23.44.65.9:443 www.ebay.com tcp
GB 23.44.65.9:443 www.ebay.com tcp
US 8.8.8.8:53 srv.main.ebayrtm.com udp
US 8.8.8.8:53 23.149.64.172.in-addr.arpa udp
US 8.8.8.8:53 214.223.184.93.in-addr.arpa udp
US 8.8.8.8:53 9.65.44.23.in-addr.arpa udp
US 209.140.129.54:443 srv.main.ebayrtm.com tcp
US 209.140.129.54:443 srv.main.ebayrtm.com tcp
US 8.8.8.8:53 adf0901f1861.cdn4.forter.com udp
NL 18.65.39.113:443 adf0901f1861.cdn4.forter.com tcp
NL 18.65.39.113:443 adf0901f1861.cdn4.forter.com tcp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 cdn9.forter.com udp
US 8.8.8.8:53 756e3d4f534b4ddc8a6997ea3c063064-adf0901f1861.cdn.forter.com udp
US 8.8.8.8:53 cdn3.forter.com udp
US 8.8.8.8:53 54.129.140.209.in-addr.arpa udp
US 8.8.8.8:53 113.39.65.18.in-addr.arpa udp
US 8.8.8.8:53 192.15.239.18.in-addr.arpa udp
US 8.8.8.8:53 233.38.18.104.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 80.41.65.18.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
NL 18.239.69.96:443 cdn9.forter.com tcp
NL 18.239.69.96:443 cdn9.forter.com tcp
US 54.81.184.157:443 756e3d4f534b4ddc8a6997ea3c063064-adf0901f1861.cdn.forter.com tcp
US 54.81.184.157:443 756e3d4f534b4ddc8a6997ea3c063064-adf0901f1861.cdn.forter.com tcp
CZ 65.9.95.50:443 cdn3.forter.com tcp
CZ 65.9.95.50:443 cdn3.forter.com tcp
US 8.8.8.8:53 cdn0.forter.com udp
US 8.8.8.8:53 96.69.239.18.in-addr.arpa udp
US 8.8.8.8:53 50.95.9.65.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 157.184.81.54.in-addr.arpa udp
US 34.192.191.43:443 cdn0.forter.com tcp
US 34.192.191.43:443 cdn0.forter.com tcp
US 8.8.8.8:53 43.191.192.34.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 161.19.199.152.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

memory/2104-0-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Program Files\Common Files\microsoft shared\winamp 7.0 full_install.exe

MD5 a780c4737528290dc49d84a87ff285c7
SHA1 6c78a9478f32e5db959889cf985582fe15cf839b
SHA256 ca0a1bf8b100013f2c0cbc9c9dc7ef200be63a1034885102646e2dd3db24fc7b
SHA512 d76afa18b032744566306d5166cb148dd1e42ecf3efec2b72de234e7dea17bcc8e2e5e3681620add754103492df688fd31238cf970bf6734213939378179c034

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\08ZTJJXR\favicon[2].ico

MD5 36c2d67c675484f68c6d700a90960b59
SHA1 d896fd5043503492f1e6516723554fd3995cf00e
SHA256 9e0e5f9d7cf84a7d53c16a802722c9bf90048fa142b272cb39d79313c2fbf4a8
SHA512 3986de7e3ec62bd8a62f65b772326279aaf6b9d43f10a43014fe46421567fe053058e4d465c8e0f810ac39d900de2fed26a2618f6ee3abb91d6ab18b75eed342

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\mket3jq\imagestore.dat

MD5 dc8950ce6d223c4e1533e38dcdc89c0b
SHA1 49a1d219f9eaa34f71f77cd46aad0d8774b3f39b
SHA256 8a3918d5fcd5b57c09d16205dac08797d9f6e7e4b1b36015bdbfcd4434987d6b
SHA512 a8486da04746d4f66040c29564fbe295dd7c3a2836f400a356b333018edea43ae9ccfda1883ea66ac8446cf7e2d64fbf98bfbfe1d3fc76f7f58a97ea69b9720a

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\D1HXE5RA\signin.ebay[1].xml

MD5 e0f3360c1b17cad956a69f850ef45196
SHA1 6db30e9c70b93a01f257963f39c4ab64a0470c15
SHA256 19589bb3f9da987d8d2c0c161b4a7136e84af5915d7bbca1fdce1917f3e36611
SHA512 d645a15f23d87ce604c5c584c39b6190ff5da9494e4868250efedaefbaa6671a97d8efb87d63e0386bb4f9fae9ec4b4e0d31b0480ab4411d1f6a595929769ee7

memory/2104-115-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2104-116-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2104-126-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2104-134-0x0000000000400000-0x000000000040C000-memory.dmp

C:\sys.txt

MD5 e0b86a8c83d3296452026644afb42008
SHA1 478686dbdc9f8b0bfb5a87bd4105a97916f10997
SHA256 122de771cb02a63345d8e01f5e482d913c282f115f1cf56cc8977fb191edf1ae
SHA512 da6b841bb437716b90674a41957833626bc85666781cbcb61743c292394efed7ff1cf73c89df5aae635a76fdc25c4bf58bc2ba8a0765f6237bcf91e508dbd1a5

memory/2104-177-0x0000000000400000-0x000000000040C000-memory.dmp

C:\sys.txt

MD5 87dbd0b00dd674807cc8cd4444ab0917
SHA1 ab1c6fd4ddecffaaecfc721ac3876fd18792a2c7
SHA256 a32265b873a56cdb15e15a969129316317cb2009cadcaa7b602e386b38c31d03
SHA512 5f48ab0adfbbde50ccf011d7af07c313c312c6b43a07c86cef7f455f49b407246d167146e7cd4ac9068650434de4d77ce6966006441036a242af0e33c7bfcc9f

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PGH3GSHW\ebayisapi[1].htm

MD5 18426bec6a355afa275f5c8bed7c11a3
SHA1 d4f02e13797137712e1b5a91142b4443358d472a
SHA256 35510702c39786b2cfdcd35ece8bfba2ba54c723464c505f01a1f374de281e47
SHA512 9dff46aad69dd84dfb16ae51d3b4fe06dcd1d41f0a5f23a8df7c4e9e0e152926f6466af4c58c3a07108cf819e07a98353e9c3b49a2c35b5e87c51c7cbbf05a32

memory/2104-202-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2104-203-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PGH3GSHW\suggestions[1].en-US

MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

memory/2104-214-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2104-215-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2104-216-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2104-217-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2104-218-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2104-219-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2104-220-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2104-221-0x0000000000400000-0x000000000040C000-memory.dmp