cdd9667696f58e9b9d37f385f41fe88b0fbd84ec26c32ce4df3e3b74d19947d6

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/10/2024, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe
Size 563KB
Sample241019-2vb36atfra
SHA256 cdd9667696f58e9b9d37f385f41fe88b0fbd84ec26c32ce4df3e3b74d19947d6
MD5 5f14fc79c9bce3df9e91f7fa1ebe55ff
SHA1 08aa237941fc6567b4684b8bed1ca5dde45b26a6
SHA512 f61fd1e92476eb82ee24581f4d1fca10a08481aeac044dc4f5a3ed7d55b0f2282c721fb2f686437f278f555fe9cf42952b3381f5e59ba7a5fb2472f6c70f3c19
SSDEEP 12288:EiYco+gunQUBCEAWfykqVNe3U24eoz8LWyN:ENZunQU1aVNe3U24QLWyN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection discovery persistence spyware stealer upx

Malware Config

Extracted

Credentials

Protocol
smtp
Host
smtp.gmail.com
Port
587
Username
[email protected]
Password
beata1950

Signatures

Detected Nirsoft tools 11 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/3012-12-0x0000000000400000-0x0000000000418000-memory.dmp	Nirsoft
behavioral1/memory/2604-28-0x0000000000400000-0x0000000000425000-memory.dmp	Nirsoft
behavioral1/memory/2576-27-0x0000000000400000-0x0000000000419000-memory.dmp	Nirsoft
behavioral1/memory/2604-30-0x0000000000400000-0x0000000000425000-memory.dmp	Nirsoft
behavioral1/memory/1980-37-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/1980-40-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/692-51-0x0000000000400000-0x000000000043D000-memory.dmp	Nirsoft
behavioral1/memory/1524-60-0x0000000000400000-0x000000000041E000-memory.dmp	Nirsoft
behavioral1/memory/1472-72-0x0000000000400000-0x0000000000418000-memory.dmp	Nirsoft
behavioral1/memory/2380-82-0x0000000000400000-0x0000000000419000-memory.dmp	Nirsoft
behavioral1/memory/2576-87-0x0000000000400000-0x0000000000419000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/1524-60-0x0000000000400000-0x000000000041E000-memory.dmp	MailPassView

Executes dropped EXE 8 IoCs

pid	Process
3012	dialup.exe
2576	passwordfox.exe
2604	mspass.exe
1980	iepv.exe
692	ChromePass.exe
1524	mailpv.exe
1472	produkey.exe
2380	OperaPassView.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	mailpv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\My = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe"	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\svh0st.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe"	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	whatismyip.com

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3012-8-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/files/0x0035000000016334-7.dat	upx
behavioral1/memory/3012-12-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/files/0x000800000001686c-18.dat	upx
behavioral1/files/0x0007000000016ac1-24.dat	upx
behavioral1/memory/2604-28-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/2576-27-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/2604-30-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/files/0x0007000000016c95-36.dat	upx
behavioral1/memory/1980-37-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1980-40-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/files/0x0007000000016d0d-46.dat	upx
behavioral1/memory/692-47-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/692-51-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/1524-58-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/files/0x0008000000016d47-57.dat	upx
behavioral1/memory/1524-60-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/files/0x00060000000174c3-66.dat	upx
behavioral1/memory/1472-67-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/memory/1472-72-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/memory/2380-78-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/files/0x0015000000018676-77.dat	upx
behavioral1/memory/2380-82-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/2576-87-0x0000000000400000-0x0000000000419000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iepv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ChromePass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mailpv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	produkey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaPassView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dialup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	passwordfox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspass.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2604	mspass.exe
Token: SeDebugPrivilege	1980	iepv.exe
Token: SeRestorePrivilege	1980	iepv.exe
Token: SeBackupPrivilege	1980	iepv.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 3012	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	30
PID 2924 wrote to memory of 3012	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	30
PID 2924 wrote to memory of 3012	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	30
PID 2924 wrote to memory of 3012	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	30
PID 2924 wrote to memory of 2576	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	31
PID 2924 wrote to memory of 2576	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	31
PID 2924 wrote to memory of 2576	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	31
PID 2924 wrote to memory of 2576	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	31
PID 2924 wrote to memory of 2604	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	32
PID 2924 wrote to memory of 2604	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	32
PID 2924 wrote to memory of 2604	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	32
PID 2924 wrote to memory of 2604	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	32
PID 2924 wrote to memory of 1980	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	33
PID 2924 wrote to memory of 1980	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	33
PID 2924 wrote to memory of 1980	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	33
PID 2924 wrote to memory of 1980	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	33
PID 2924 wrote to memory of 692	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	34
PID 2924 wrote to memory of 692	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	34
PID 2924 wrote to memory of 692	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	34
PID 2924 wrote to memory of 692	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	34
PID 2924 wrote to memory of 1524	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	35
PID 2924 wrote to memory of 1524	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	35
PID 2924 wrote to memory of 1524	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	35
PID 2924 wrote to memory of 1524	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	35
PID 2924 wrote to memory of 1472	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	36
PID 2924 wrote to memory of 1472	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	36
PID 2924 wrote to memory of 1472	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	36
PID 2924 wrote to memory of 1472	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	36
PID 2924 wrote to memory of 2380	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	37
PID 2924 wrote to memory of 2380	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	37
PID 2924 wrote to memory of 2380	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	37
PID 2924 wrote to memory of 2380	2924	5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe	37

C:\Users\Admin\AppData\Local\Temp\5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5f14fc79c9bce3df9e91f7fa1ebe55ff_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Users\Admin\AppData\Local\Temp\dialup.exe
  C:\Users\Admin\AppData\Local\Temp\dialup.exe /stext C:\Users\Admin\AppData\Local\Temp\data.txt
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3012
- C:\Users\Admin\AppData\Local\Temp\passwordfox.exe
  C:\Users\Admin\AppData\Local\Temp\passwordfox.exe /stext C:\Users\Admin\AppData\Local\Temp\firefox.txt
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2576
- C:\Users\Admin\AppData\Local\Temp\mspass.exe
  C:\Users\Admin\AppData\Local\Temp\mspass.exe /stext C:\Users\Admin\AppData\Local\Temp\mess.txt
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2604
- C:\Users\Admin\AppData\Local\Temp\iepv.exe
  C:\Users\Admin\AppData\Local\Temp\iepv.exe /stext C:\Users\Admin\AppData\Local\Temp\iepv.txt
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1980
- C:\Users\Admin\AppData\Local\Temp\ChromePass.exe
  C:\Users\Admin\AppData\Local\Temp\ChromePass.exe /stext C:\Users\Admin\AppData\Local\Temp\ChromePass.txt
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:692
- C:\Users\Admin\AppData\Local\Temp\mailpv.exe
  C:\Users\Admin\AppData\Local\Temp\mailpv.exe /stext C:\Users\Admin\AppData\Local\Temp\mailpv.txt
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook accounts
  - System Location Discovery: System Language Discovery
  PID:1524
- C:\Users\Admin\AppData\Local\Temp\produkey.exe
  C:\Users\Admin\AppData\Local\Temp\produkey.exe /stext C:\Users\Admin\AppData\Local\Temp\produkey.txt
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1472
- C:\Users\Admin\AppData\Local\Temp\OperaPassView.exe
  C:\Users\Admin\AppData\Local\Temp\OperaPassView.exe /stext C:\Users\Admin\AppData\Local\Temp\OperaPassView.txt
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ChromePass.exe

Path C:\Users\Admin\AppData\Local\Temp\ChromePass.exe
Size 125KB
SHA256 dbfa10a7deeb6d1ac8fd95ffeb23b87adc58e6388e522812fabe7f710e3cdd89
MD5 9b3b1c0db965166319469b2afa6c4f0c
SHA1 9f1e65a3056dff872949329c4e5e70c007cc5621
SHA512 c11512599b83fa1875a67915a7e7454512ed8300a0a47c16692ebc1f526755c39c795fe9721dd97d417bfcb29f9e4c1f3283cf4c426af6571b3996005f7e4f5e
SSDEEP 3072:exjUcaPXQMR7j6gh2eG8ICpUMmere/8TyiG:IjUca5+gfpUOi
MD5 SHA1 SHA512 SSDEEP

Submit Download

OperaPassView.exe

Path C:\Users\Admin\AppData\Local\Temp\OperaPassView.exe
Size 38KB
SHA256 2cb9a3d9587f79a6b1cfa95020b81d7d0d3cf9aa6ebf992f3b5e4ecf19bca8a8
MD5 37a89021ab1fbe5668c3974abc794bd4
SHA1 8ccaa4406f907a5a938fbb2db9d5af27092b811d
SHA512 6eaef2c2c29eb5363a0193489dc989527e4087c61fe926efbbd8a0e3cc8b9675285a94d392ee0a906dfc109566cc144ab07166fd5b3defbfc8afd66d3fe8d1b8
SSDEEP 768:CijzmGpuVhCQyI7N/Tz3/SZAb9umVqYkMJaMlD4C0YU6y4:CijzmHCQyIRr2ZAb9umVTtaMlD4C0p61
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Temp\data.txt
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

dialup.exe

Path C:\Users\Admin\AppData\Local\Temp\dialup.exe
Size 37KB
SHA256 8f576d5191721f8fdb47bb22950f43fc8f2c9cc880fe067090ed96e6fcb07a97
MD5 9c8872c879d0a9d82988920488370864
SHA1 87ff4231547462e6474c832e28831dd691d83fd4
SHA512 3c413427c46ef92a412840479896841ffd5c6eb9215b8ecc416cdbd4f8e0f2eb643ed3b7f2e18eb5710ba7c55e1cd82af6637285ee364e069503c5ecc187cb2e
SSDEEP 768:rIEOx3r3Ksy5o6OEoPtYL2bzxPJdMY4fVWs7DrUH11M3MbxMpPwSR:rIEWDK6b7PtYL2bz9JdT4dBPrGM3MUP3
MD5 SHA1 SHA512 SSDEEP

Submit Download

iepv.exe

Path C:\Users\Admin\AppData\Local\Temp\iepv.exe
Size 42KB
SHA256 dbc2216d5f31f5218e940e3d802998dee90eeb69af69cbeb063c69c6a5a3f1e1
MD5 28c110b8d0ad095131c8d06043678086
SHA1 c684cf321e890e0e766a97609a4cde866156d6c5
SHA512 065e043b76b0e1163e73f4a1c257bae793ae9b46bff1951956c2174ef91deb2528730da77aab76b9e7246d705c3b8c1d23f05dc3b161cacabf3e52d0f563c922
SSDEEP 768:u1GUD7VM5WEdVTKmV5zVC4g1XOj53JEP31/2Y23/inPZMvFJK:yGwKdVem5zQ4g1XOjlJA3Jp2vqUFY
MD5 SHA1 SHA512 SSDEEP

Submit Download

mailpv.exe

Path C:\Users\Admin\AppData\Local\Temp\mailpv.exe
Size 49KB
SHA256 dc64825cf0d635320d4f72e70695084faf548ded12e5daf7ebc335cad64bc1fd
MD5 29beed02d9e57505cf5f34edf24dba1c
SHA1 12f3cb339c182bcc62a369a92db2da45aab64f5e
SHA512 957a8b6cbd20e62fcef513b8a5078fb9944aa5f79d517ffa23334198d718ec0db8a33f3c2763898124f88b582a4018537fbdb35650c0f040897a328ba5b919be
SSDEEP 1536:Lgc2bNEdFydXdWvmznFWhj45camKZAX9:L6XNognFWhj45oOAX
MD5 SHA1 SHA512 SSDEEP

Submit Download

mspass.exe

Path C:\Users\Admin\AppData\Local\Temp\mspass.exe
Size 63KB
SHA256 8898b138a3f238fa985992a9d0e48f6b5865dd2cc35e08b83fa326260c510ffe
MD5 fbb93d4c91453b06414d6973152d904e
SHA1 4624232c5450e7e9e7ba1f2113a07f8800dc5b5f
SHA512 4ed926d230af576a945bdd4d9b2d4001e8036abbcf1ef9a35669823d9420b6d95b426d80384a6fd022165c1fc2485fda0e28193b99b301927236928ddfcac6f7
SSDEEP 1536:ldUbC/pymYTT0oEiQzJF6Kx8thTJWFsH4Ezpy:dHYootXWczo
MD5 SHA1 SHA512 SSDEEP

Submit Download

passwordfox.exe

Path C:\Users\Admin\AppData\Local\Temp\passwordfox.exe
Size 37KB
SHA256 8a06acd1158060a54d67098f07c1ff7895f799bc5834179b8aae04d28fb60e17
MD5 a1d6a37917dcf4471486bc5a0e725cc6
SHA1 5b09f10dc215078ae44f535de12630c38f3b86e3
SHA512 5798a5d85052d5c2f6b781b91a400c85bc96c0127cc4e18079bff1f17bd302dc07c0f015ddf1105621a841680057322eb0172ba06063f55d795b7b079f1d26d2
SSDEEP 768:fI/jGMPs+LR2cVLuifYFn2GaGartb9u/Yd1MVWye:fI/jGos+d2c9YF2GaHsYLMVWye
MD5 SHA1 SHA512 SSDEEP

Submit Download

produkey.exe

Path C:\Users\Admin\AppData\Local\Temp\produkey.exe
Size 35KB
SHA256 8e2373e94bff10ecb08e9e0cdeaa65ed57aec89f99312d3bbd90ab72de4f98f3
MD5 279c6d1ff7c0dc77d68b6013288b40a8
SHA1 21e3620bfab7fa8c9c8ff0414b52a8e3f23d1fc2
SHA512 a7ab94cac449b9494419d1e6fb9ea3cdd58a1c455fb003b3376b5717655aa15669eebdcfefffd18958326f15526afdac9b8978b47769e901f06ac2c782fc7ecd
SSDEEP 768:WCjVC0+NKbQWwXQX+hrWZfRobEjf7Xn1I+1UDamTac:Wm8KEDXYMCZZoYL51Ue/c
MD5 SHA1 SHA512 SSDEEP

Submit Download

produkey.txt

Path C:\Users\Admin\AppData\Local\Temp\produkey.txt
Size 1KB
SHA256 1a44df299137ddb18020654c49b736ecafc5bced42559f4580e3d9e100cc00b9
MD5 3254ebd552347996f2d874ac6fea1aef
SHA1 4c0385ca315f8400638490d7b6d95ae3940c036b
SHA512 9fc46c47b538921ad1de161af8aa5dc281f44e453aeb8b2d63cea17c274ae4ddd8394580aaf299af26d3549f790b0e92dee94f6d0c202ed0a03d69f49d43d8a0
MD5 SHA1 SHA512

Submit Download

memory/692-51-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/692-47-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1472-67-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/1472-72-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/1524-60-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/1524-58-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/1980-37-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1980-40-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2380-78-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/2380-82-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/2576-87-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/2576-27-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/2604-28-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/2604-30-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/2924-1-0x000007FEF61B0000-0x000007FEF6B4D000-memory.dmp

Download

memory/2924-3-0x000007FEF61B0000-0x000007FEF6B4D000-memory.dmp

Download

memory/2924-2-0x000007FEF61B0000-0x000007FEF6B4D000-memory.dmp

Download

memory/2924-0-0x000007FEF646E000-0x000007FEF646F000-memory.dmp

Download

memory/2924-19-0x000007FEF646E000-0x000007FEF646F000-memory.dmp

Download

memory/2924-26-0x000007FEF61B0000-0x000007FEF6B4D000-memory.dmp

Download

memory/2924-83-0x000007FEF61B0000-0x000007FEF6B4D000-memory.dmp

Download

memory/2924-85-0x000007FEF61B0000-0x000007FEF6B4D000-memory.dmp

Download

memory/2924-38-0x000007FEF61B0000-0x000007FEF6B4D000-memory.dmp

Download

memory/3012-12-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/3012-8-0x0000000000400000-0x0000000000418000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads