06cce93a2695dd6f4d3ac92cbe2570ceea5d780e316c1e62f2c4786db3c72236

Analysis

max time kernel
150s
max time network
97s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 20:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43f80c13eba1c24db5b886b1ef80171f_JaffaCakes118.exe
Size

23KB
MD5

43f80c13eba1c24db5b886b1ef80171f
SHA1

628c306f413540ef61ac46ba99265743ed775c62
SHA256

06cce93a2695dd6f4d3ac92cbe2570ceea5d780e316c1e62f2c4786db3c72236
SHA512

e009479cf1328a212c009f50a575d1f3eee978443399e498dea0a313847d5ab76aca3fa2098883aa6b1264931238971145ee2f4df5675398aea0cca3408060cc
SSDEEP

384:UsyIO9nHedQMvezk0xmIGz0+/o/PaMM8u8f/axPYzzAWiw4gdbdBMD6uI6loA:kj84frG4+OCVa/axmViwFdBMOuIE

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3052	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2592	csrss.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "C:\\Windows\\csrss.exe"	csrss.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\csrss.exe	43f80c13eba1c24db5b886b1ef80171f_JaffaCakes118.exe
File opened for modification	C:\Windows\csrss.exe	43f80c13eba1c24db5b886b1ef80171f_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	43f80c13eba1c24db5b886b1ef80171f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	csrss.exe

Modifies Internet Explorer settings 1 TTPs 53 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2163FEC1-8A68-11EF-902B-EAA2AC88CDB5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435098423"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E3B49A1-8A68-11EF-902B-EAA2AC88CDB5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2148	iexplore.exe
1648	iexplore.exe
1648	iexplore.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2148	iexplore.exe
2148	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
1648	iexplore.exe
1648	iexplore.exe
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
1648	iexplore.exe
1648	iexplore.exe
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2716	2148	iexplore.exe	30
PID 2148 wrote to memory of 2716	2148	iexplore.exe	30
PID 2148 wrote to memory of 2716	2148	iexplore.exe	30
PID 2148 wrote to memory of 2716	2148	iexplore.exe	30
PID 2128 wrote to memory of 2592	2128	43f80c13eba1c24db5b886b1ef80171f_JaffaCakes118.exe	32
PID 2128 wrote to memory of 2592	2128	43f80c13eba1c24db5b886b1ef80171f_JaffaCakes118.exe	32
PID 2128 wrote to memory of 2592	2128	43f80c13eba1c24db5b886b1ef80171f_JaffaCakes118.exe	32
PID 2128 wrote to memory of 2592	2128	43f80c13eba1c24db5b886b1ef80171f_JaffaCakes118.exe	32
PID 2128 wrote to memory of 3052	2128	43f80c13eba1c24db5b886b1ef80171f_JaffaCakes118.exe	33
PID 2128 wrote to memory of 3052	2128	43f80c13eba1c24db5b886b1ef80171f_JaffaCakes118.exe	33
PID 2128 wrote to memory of 3052	2128	43f80c13eba1c24db5b886b1ef80171f_JaffaCakes118.exe	33
PID 2128 wrote to memory of 3052	2128	43f80c13eba1c24db5b886b1ef80171f_JaffaCakes118.exe	33
PID 1648 wrote to memory of 2516	1648	iexplore.exe	36
PID 1648 wrote to memory of 2516	1648	iexplore.exe	36
PID 1648 wrote to memory of 2516	1648	iexplore.exe	36
PID 1648 wrote to memory of 2516	1648	iexplore.exe	36
PID 1648 wrote to memory of 2764	1648	iexplore.exe	37
PID 1648 wrote to memory of 2764	1648	iexplore.exe	37
PID 1648 wrote to memory of 2764	1648	iexplore.exe	37
PID 1648 wrote to memory of 2764	1648	iexplore.exe	37

C:\Users\Admin\AppData\Local\Temp\43f80c13eba1c24db5b886b1ef80171f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\43f80c13eba1c24db5b886b1ef80171f_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\csrss.exe
  C:\Windows\csrss.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies Internet Explorer Protected Mode
  PID:2592
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\temp.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:3052

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1648 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2516
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1648 CREDAT:406533 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
113bc1cca54e85646534fe801b83feb8

SHA1
60cdda0629dbd6fd3dce2f03dfbcfe793ad24585

SHA256
c1132d9868a102d4c010f8e7c5667649ba470026d69ee9fd2e9b91ad893d1144

SHA512
c770aa43c16b41b79821f3bda913836a17ee6b25455e26429aa87479de002046c8b68e5ca0fd0701286907b33a99556540cf587403da3d957169d453281a0cec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1284687b1990e24fbfd0bf1f2ccbae3f

SHA1
8a37d1c9ce3f96908df5a0e303317e4a9c503ec6

SHA256
7bd66b651cf1f7179f25d4d021dab055b79ac58f450f54b27168b191abc3c6fc

SHA512
710aad70e2f9f125a72d6a15ff9936df133d0261826398b51ece67509823469987157f95d39f5979ea81f0c1d10d7f60dec18a869f7bc0a2defe47078e8af73b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e17c221ed80c9b6a383aed89ae74d39b

SHA1
8ff09fcc0f35dfba5cc8144b438dfea93a3d8fa2

SHA256
70fe616812cd6d56d1e93f516b8db9903ec65f0de1738019d68b7420ea5cc21a

SHA512
d49a31fb953de2d64b5ee1dcb5538bb40bb60b33e2d41df41d8b45ef7337d47bb3b9017ee9f607b9c7d0e2eeb55670e33799772589a649421c22c996ae5adf74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60620b57cb5d80304e84d43f08a844a2

SHA1
f23e4b1332eb79a57bd06f34dc3cfcdd2b2bfa86

SHA256
4ca456ba888ba72a39a6217fc12c3988ebd4e40d4f9503d1ed24b8d9f77916ae

SHA512
0165d70c79ed8e370a63805853149996ae866177093c94c205dce9feb90fed8c5d8a6a13bde032297f744b7aba1ad34042d82dcf51963ad880d94acce574265f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6ccdba1c6fefa1bdc4f963032c7efe8

SHA1
482b03b029fbf1fd587342fa4d5d20277fffeb67

SHA256
cc8c74cd4b741faebaa1863ae632c307705b7943df388384f425a59ac43da629

SHA512
a8a140d73ac1371ef0f7f77c43576eef6608f307a53b86ad126acae6546bdd9077441144ee0c2ae2078bc5270b9bbb48fa7d2113cfc512d656e2078fa0196aba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
113c3cfe98f437bfc78588ddd39e9a17

SHA1
14ba94e02eedebec75db014682a9bc587660805e

SHA256
bc56583f42bddb58db7865cb0bad07d3903fb75324e2b793ebfbf3fc6a8918a9

SHA512
ebe46e48d6fa19a1f71d13f602a6b9b0873a247e83857ab8e21f0a49f8d9114eba852b840692dd9ce7aefc58ef28dbcd38098c157e24a046b35baf1bd901a2c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c027074b67eeec70888b70432bc90b6c

SHA1
275d746fe3db501f5156f623716c1e65c2b22441

SHA256
92e91d88f2cfb8c3702b7a67f040d4fe2f03e0fab3caa816e3633db3ef7b73d3

SHA512
7e7e782401a71a964b4e5916d7436df250bfb8583df87693940d43245ad5695177527af8922b78c26eab069ffb83cf422f088bd04bf0de78714c8808f7c4087d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f996cece5c6858868c5aa91a6991165b

SHA1
c904526ae81fb302dc6f67bff9ef3ae58aed4d5e

SHA256
d6ac59885a87b44108be235ecab3168371782fd3c6a06db3044088041424540e

SHA512
4e090b16a72b5dbc78346a91f17e6f217c5f5de0c626a0df1b584e487221c15b9d6412c0b9ea54cce9f40f47c1d68c76dac3c3a84388658e0b3a62e9afbacc8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
326838a7c6e1307fe5ea117a7c5782d6

SHA1
0ceff3c97288d9dde888706d50ad3a357dae2829

SHA256
aa7d5ea07f6c397e7db6470fa1dd816c9b1e0a466aca822b0082813937402933

SHA512
edbc6b02ce019734d2245d62f1506a753313e488db2d537177fdbfb047bc5723f1bba9b2aeef81152a605d5767838f03343ad5a129b50dcaae51b155f3e9402b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEFDB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF04D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.bat

Filesize
260B

MD5
0e8c07b9d848d921dbced195ac9e2a29

SHA1
9af3d3994d8d9b349ad9751bf07df6a69b95b151

SHA256
f9937154dd4c95af3541c0c500a6ee9cd74e41e82bfc9fe091cf48bda166d04d

SHA512
f2dc479df6998e954cfbd6ab0ac3c33cc67953eae94085dd5dce6c0edc3de03e8e0924428cbe8d0e012193e019f024ea7b0f0ae753aedce71d2d3e8e0586975b

Download Submit
C:\Users\Admin\AppData\Local\n.ini

Filesize
65B

MD5
a0fa648a6267feaa347ea875eb6272fe

SHA1
c016ec2ccf2b239d90e11b8509fca938590c4aa1

SHA256
9892b72ef52ea23beed5f5680bf6c740278c77ada321d6e4536483769087baae

SHA512
4fa055c258cfc93b1f0523880e18120adddab06b6ad6793de5048df9c6d7ea8d74e114fa32eb6ef53d685f49538eb656e2191cfee5eca46fb0ce29827c18dbaa

Download Submit
C:\Users\Admin\AppData\Local\n.ini

Filesize
8B

MD5
540f2388060e5c2b0aaa1bec7dc559af

SHA1
abdc793f97d4ff7a6e45adc4669e9ceb2698c86d

SHA256
a4a4cbb5922047696441846a2e27ce9fc37f1084eedd50582ac595adcc54fb0f

SHA512
c7457ff4e7d20ce05ae6147f81fb78ab5b8c684b266c7db3cff1f7a93bd3ed23c16e1085dca26cab52094fde6c80848808d0e9d81d8a32d91db05e05872073ac

Download Submit
C:\Users\Admin\AppData\Local\n.ini

Filesize
37B

MD5
b1fd56a252b0cb60ed0ed2574ef49138

SHA1
3e8212792681884b3f14c92facaabbde63230689

SHA256
5f20fbcc468b63dacedfafc9d9a4c0ef5ec9f5cc6b896d10fd56fafc550a8460

SHA512
3aaa240d2127933c7ae0a9810d634a758f1cb1c7a8035bb4a91d41a5221700d1ef3b79d3962691df924bd44be0035ce5787c4c3bc515c34d73a462a4ac11003b

Download Submit
C:\Users\Admin\AppData\Local\n.ini

Filesize
65B

MD5
4a05c8040c366d8aef9fcb63f4f72735

SHA1
79bd23bcad91d820c95c2efbe31b21b0249a0296

SHA256
1e4aec11e7e2fe52e62578067867af2c6ab3b5b414095fcd35550ba89444e9c2

SHA512
13376b09f678f8d8d149b34ead6ac8f57f47a8352e2245d51a0a015b8b0a7ae3dc953c72d79ddf21cba0fbecf5bbf2d8289391dadaa3f179c77bb6738eaaa8a2

Download Submit
C:\Windows\csrss.exe

Filesize
23KB

MD5
43f80c13eba1c24db5b886b1ef80171f

SHA1
628c306f413540ef61ac46ba99265743ed775c62

SHA256
06cce93a2695dd6f4d3ac92cbe2570ceea5d780e316c1e62f2c4786db3c72236

SHA512
e009479cf1328a212c009f50a575d1f3eee978443399e498dea0a313847d5ab76aca3fa2098883aa6b1264931238971145ee2f4df5675398aea0cca3408060cc

Download Submit
memory/2128-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2128-25-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2128-8-0x00000000004E0000-0x00000000004E2000-memory.dmp

Filesize
8KB

Download
memory/2128-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2592-37-0x00000000002A0000-0x00000000002A2000-memory.dmp

Filesize
8KB

Download
memory/2592-1422-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads