cerber | b592240b55c4c0fcf3733ba808523025ec245302d7ebc897bbc6824596de90a7

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
31-10-2024 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe
Size

258KB
MD5

8283c1cc0db9501e05206c0542fe9447
SHA1

fa800fdf2fc3bc8c015d7f20e04a54b9f95f39f5
SHA256

b592240b55c4c0fcf3733ba808523025ec245302d7ebc897bbc6824596de90a7
SHA512

133edc6a33503896adcc86381f1bed32646b734e246b22843a524c489bd6a63c38e696aa14b814c744d817385146ad214a78963a80c6cb3d9a7783099ae6791a
SSDEEP

6144:BwHysO+NnMZ2INVorOnii05dapobD/OLJoMyk6zk:qO+NFYRYQyGNTykIk

Score

10^/10

cerber defense_evasion discovery evasion execution impact persistence ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.txt

Ransom Note

C_E_R_B_E_R R_A_N_S_O_M_W_A_R_E ######################################################################### Cannot you find the files you need? Is the content of the files that you looked for not readable??? It is normal because the files' names, as well as the data in your files have been encrypted. Great! You have turned to be a part of a big community "#Cerb3r Ransomware". ######################################################################### !!! If you are reading this message it means the software "Cerber" has !!! been removed from your computer. !!! HTML instruction ("# DECRYPT MY FILES #.html") always contains a !!! working domain of your personal page! ######################################################################### What is encryption? ------------------- Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. ######################################################################### Everything is clear for me but what should I do? ------------------------------------------------ The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !!! Any attempts to return your files with the third-party tools can !!! be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle, but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. ######################################################################### !!! There are several plain steps to restore your files but if you do !!! not follow them we will not be able to help you, and we will not try !!! since you have read this warning already. ######################################################################### For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: 1. decrypt all your files; 2. work with your documents; 3. view your photos and other media; 4. continue your usual and comfortable work at the computer. If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. ######################################################################### There is a list of temporary addresses to go on your personal page below: _______________________________________________________________________ | | 1. http://52uo5k3t73ypjije.5tb8hy.bid/AF42-033B-F98E-0046-154C | | 2. http://52uo5k3t73ypjije.y12acl.bid/AF42-033B-F98E-0046-154C | | 3. http://52uo5k3t73ypjije.hhc366.top/AF42-033B-F98E-0046-154C | | 4. http://52uo5k3t73ypjije.gg4dgp.bid/AF42-033B-F98E-0046-154C | | 5. http://52uo5k3t73ypjije.onion.to/AF42-033B-F98E-0046-154C |_______________________________________________________________________ ######################################################################### What should you do with these addresses? ---------------------------------------- If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): 1. take a look at the first address (in this case it is http://52uo5k3t73ypjije.5tb8hy.bid/AF42-033B-F98E-0046-154C); 2. select it with the mouse cursor holding the left mouse button and moving the cursor to the right; 3. release the left mouse button and press the right one; 4. select "Copy" in the appeared menu; 5. run your Internet browser (if you do not know what it is run the Internet Explorer); 6. move the mouse cursor to the address bar of the browser (this is the place where the site address is written); 7. click the right mouse button in the field where the site address is written; 8. select the button "Insert" in the appeared menu; 9. then you will see the address http://52uo5k3t73ypjije.5tb8hy.bid/AF42-033B-F98E-0046-154C appeared there; 10. press ENTER; 11. the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling. If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: 1. click the left mouse button on the first address (in this case it is http://52uo5k3t73ypjije.5tb8hy.bid/AF42-033B-F98E-0046-154C); 2. in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address. If for some reason the site cannot be opened check the connection to the Internet. ######################################################################### Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: 1. run your Internet browser (if you do not know what it is run the Internet Explorer); 2. enter or copy the address https://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER; 3. wait for the site loading; 4. on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed; 5. run Tor Browser; 6. connect with the button "Connect" (if you use the English version); 7. a normal Internet browser window will be opened after the initialization; 8. type or copy the address ________________________________________________________ | | | http://52uo5k3t73ypjije.onion/AF42-033B-F98E-0046-154C | |________________________________________________________| in this browser address bar; 9. press ENTER; 10. the site should be loaded; if for some reason the site is not loading wait for a moment and try again. If you have any problems during installation or operation of Tor Browser, please, visit https://www.youtube.com/ and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. ######################################################################### Additional information: You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. ######################################################################### Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. ######################################################################### If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. ######################################################################### Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files.

URLs

http://52uo5k3t73ypjije.5tb8hy.bid/AF42-033B-F98E-0046-154C

http://52uo5k3t73ypjije.y12acl.bid/AF42-033B-F98E-0046-154C

http://52uo5k3t73ypjije.hhc366.top/AF42-033B-F98E-0046-154C

http://52uo5k3t73ypjije.gg4dgp.bid/AF42-033B-F98E-0046-154C

http://52uo5k3t73ypjije.onion.to/AF42-033B-F98E-0046-154C

http://52uo5k3t73ypjije.onion/AF42-033B-F98E-0046-154C

Extracted

Path

C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.html

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Cerber Ransomware</title> <style> a { color: #47c; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #333; font-family: "Helvetica Neue", Helvetica, "Segoe UI", Arial, freesans, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; } hr { background-color: #e7e7e7; border: 0 none; border-bottom: 1px solid #c7c7c7; height: 5px; margin: 30px 0; } li { padding: 0 0 7px 7px; } ol { padding-left: 3em; } .container { background-color: #fff; border: 1px solid #c7c7c7; margin: 40px; padding: 40px 40px 20px 40px; } .info, .tor { background-color: #efe; border: 1px solid #bda; display: block; padding: 0px 20px; } .logo { font-size: 12px; font-weight: bold; line-height: 1; margin: 0; } .upd_on { color: red; display: block; } .upd_off { display: none; float: left; } .tor { padding: 10px 0; text-align: center; } .url { margin-right: 5px; } .warning { background-color: #f5e7e7; border: 1px solid #ebccd1; color: #a44; display: block; padding: 15px 10px; text-align: center; } </style> </head> <body> <div class="container"> <h3>C E R B E R   R A N S O M W A R E</h3> <hr> Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great! You have turned to be a part of a big community "#C3rber Ransomware". <hr> If you are reading this message it means the software "Cerber" has been removed from your computer. <hr> <h3>What is encryption?</h3> Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. <hr> <h3>Everything is clear for me but what should I do?</h3> The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !Any attempts to get back your files with the third-party tools can be fatal for your encrypted files! The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files! When you make a puzzle, but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. <hr> There are several plain steps to restore your files but if you do not follow them we will not be able to help you, and we will not try since you have read this warning already. <hr> For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: <ol> <li>decrypt all your files;</li> <li>work with your documents;</li> <li>view your photos and other media;</li> <li>continue your usual and comfortable work at the computer.</li> </ol> If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. <hr> <div class="info"> There is a list of temporary addresses to go on your personal page below: <ol> <li>Please wait...<a class="url" href="http://52uo5k3t73ypjije.5tb8hy.bid/AF42-033B-F98E-0046-154C" id="url_1" target="_blank">http://52uo5k3t73ypjije.5tb8hy.bid/AF42-033B-F98E-0046-154C</a>(<a href="#updateUrl" onClick="return updateUrl();" style="color: red;">Get a NEW address!</a>)</li> <li><a href="http://52uo5k3t73ypjije.y12acl.bid/AF42-033B-F98E-0046-154C" target="_blank">http://52uo5k3t73ypjije.y12acl.bid/AF42-033B-F98E-0046-154C</a></li> <li><a href="http://52uo5k3t73ypjije.hhc366.top/AF42-033B-F98E-0046-154C" target="_blank">http://52uo5k3t73ypjije.hhc366.top/AF42-033B-F98E-0046-154C</a></li> <li><a href="http://52uo5k3t73ypjije.gg4dgp.bid/AF42-033B-F98E-0046-154C" target="_blank">http://52uo5k3t73ypjije.gg4dgp.bid/AF42-033B-F98E-0046-154C</a></li> <li><a href="http://52uo5k3t73ypjije.onion.to/AF42-033B-F98E-0046-154C" target="_blank">http://52uo5k3t73ypjije.onion.to/AF42-033B-F98E-0046-154C</a></li> </ol> </div> <hr> <h3>What should you do with these addresses?</h3> If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): <ol> <li>take a look at the first address (in this case it is Please wait...<a class="url" href="http://52uo5k3t73ypjije.5tb8hy.bid/AF42-033B-F98E-0046-154C" id="url_2" target="_blank">http://52uo5k3t73ypjije.5tb8hy.bid/AF42-033B-F98E-0046-154C</a>);</li> <li>select it with the mouse cursor holding the left mouse button and moving the cursor to the right;</li> <li>release the left mouse button and press the right one;</li> <li>select "Copy" in the appeared menu;</li> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>move the mouse cursor to the address bar of the browser (this is the place where the site address is written);</li> <li>click the right mouse button in the field where the site address is written;</li> <li>select the button "Insert" in the appeared menu;</li> <li>then you will see the address Please wait...<a class="url" href="http://52uo5k3t73ypjije.5tb8hy.bid/AF42-033B-F98E-0046-154C" id="url_3" target="_blank">http://52uo5k3t73ypjije.5tb8hy.bid/AF42-033B-F98E-0046-154C</a> appeared there;</li> <li>press ENTER;</li> <li>the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: <ol> <li>click the left mouse button on the first address (in this case it is Please wait...<a class="url" href="http://52uo5k3t73ypjije.5tb8hy.bid/AF42-033B-F98E-0046-154C" id="url_4" target="_blank">http://52uo5k3t73ypjije.5tb8hy.bid/AF42-033B-F98E-0046-154C</a>);</li> <li>in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet. <hr> Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: <ol> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>enter or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loading;</li> <li>on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>run Tor Browser;</li> <li>connect with the button "Connect" (if you use the English version);</li> <li>a normal Internet browser window will be opened after the initialization;</li> <li>type or copy the address http://52uo5k3t73ypjije.onion/AF42-033B-F98E-0046-154C in this browser address bar;</li> <li>press ENTER;</li> <li>the site should be loaded; if for some reason the site is not loading wait for a moment and try again.</li> </ol> If you have any problems during installation or operation of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=install+tor+browser+windows" target="_blank">https://www.youtube.com/</a> and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. <hr> <h3>Additional information:</h3> You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. <hr> Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. <hr> If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. <hr> Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files. </div> <script> function getXMLHttpRequest() { if (window.XMLHttpRequest) { return new window.XMLHttpRequest; } else { try { return new ActiveXObject("MSXML2.XMLHTTP.3.0"); } catch(error) { return null; } } } function getUrlContent(url, callback) { var xhttp = getXMLHttpRequest(); if (xhttp) { xhttp.onreadystatechange = function() { if (xhttp.readyState == 4) { if (xhttp.status == 200) { return callback(xhttp.responseText.replace(/[\s ]+/gm, ""), null); } else { return callback(null, true); } } }; xhttp.open("GET", url + '?_=' + new Date().getTime(), true); xhttp.send(); } else { return callback(null, true); } } function server1(address, callback) { getUrlContent("http://btc.blockr.io/api/v1/address/txs/" + address, function(result, error) { if (!error) { var tx = /"tx":"([\w]+)","time_utc":"[\w-:]+","confirmations":[\d]+,"amount":-/.exec(result); if (tx) { getUrlContent("http://btc.blockr.io/api/v1/tx/info/" + tx[1], function(result, error) { if (!error) { var address = /"vouts":\[{"address":"([\w]+)"/.exec(result); if (address) { return callback(address[1], null); } else { return callback(null, true); } } else { return callback(null, true); } }); } else { return callback(null, true); } } else { return callback(null, true); } }); } function server2(address, callback) { getUrlContent("http://api.blockcypher.com/v1/btc/main/addrs/" + address, function(result, error) { if (!error) { var tx = /"tx_hash":"([\w]+)","block_height":[\d]+,"tx_input_n":[\d-]+,"tx_output_n":-/.exec(result); if (tx) { getUrlContent("http://api.blockcypher.com/v1/btc/main/txs/" + tx[1], function(result, error) { if (!error) { var address = /"outputs":\[{"value":[\d]+,"script":"[\w]+","spent_by":"[\w]+","addresses":\["([\w]+)"/.exec(result); if (address) { return callback(address[1], null); } else { return callback(null, true); } } else { return callback(null, true); } }); } else { return callback(null, true); } } else { return callback(null, true);

Signatures

Cerber 2 IoCs

Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

ransomware cerber

description	ioc	Process
Mutant opened	shell.{46ACF05D-0D58-2BE0-F338-E81C4F4AB811}	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe
Mutant created	shell.{46ACF05D-0D58-2BE0-F338-E81C4F4AB811}	ReAgentc.exe

Cerber family
cerber

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ReAgentc.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2532	bcdedit.exe
1536	bcdedit.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{C7CD5A05-A6B9-B06B-3FDB-EB4CCFC45048}\\ReAgentc.exe\""	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{C7CD5A05-A6B9-B06B-3FDB-EB4CCFC45048}\\ReAgentc.exe\""	ReAgentc.exe

Contacts a large (522) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Deletes itself 1 IoCs

pid	Process
2824	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ReAgentc.lnk	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ReAgentc.lnk	ReAgentc.exe

Executes dropped EXE 2 IoCs

pid	Process
2716	ReAgentc.exe
2328	ReAgentc.exe

Loads dropped DLL 5 IoCs

pid	Process
2440	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe
2440	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe
2540	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe
2716	ReAgentc.exe
2716	ReAgentc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\ReAgentc = "\"C:\\Users\\Admin\\AppData\\Roaming\\{C7CD5A05-A6B9-B06B-3FDB-EB4CCFC45048}\\ReAgentc.exe\""	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ReAgentc = "\"C:\\Users\\Admin\\AppData\\Roaming\\{C7CD5A05-A6B9-B06B-3FDB-EB4CCFC45048}\\ReAgentc.exe\""	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\ReAgentc = "\"C:\\Users\\Admin\\AppData\\Roaming\\{C7CD5A05-A6B9-B06B-3FDB-EB4CCFC45048}\\ReAgentc.exe\""	ReAgentc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ReAgentc = "\"C:\\Users\\Admin\\AppData\\Roaming\\{C7CD5A05-A6B9-B06B-3FDB-EB4CCFC45048}\\ReAgentc.exe\""	ReAgentc.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ReAgentc.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpCCA2.bmp"	ReAgentc.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2440 set thread context of 2540	2440	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe	30
PID 2716 set thread context of 2328	2716	ReAgentc.exe	39

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ACADEMIC.ONE	ReAgentc.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.html	ReAgentc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\PLANNERS.ONE	ReAgentc.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.txt	ReAgentc.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.vbs	ReAgentc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNote.ini	ReAgentc.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.url	ReAgentc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE	ReAgentc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNote-PipelineConfig.xml	ReAgentc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BUSINESS.ONE	ReAgentc.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.html	ReAgentc.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.txt	ReAgentc.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.vbs	ReAgentc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BLANK.ONE	ReAgentc.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\# DECRYPT MY FILES #.url	ReAgentc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe
File opened for modification	C:\Windows\	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2824	cmd.exe
2764	PING.EXE
1020	cmd.exe
2304	PING.EXE

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x000500000001a41f-37.dat	nsis_installer_1
behavioral1/files/0x000500000001a41f-37.dat	nsis_installer_2

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2596	vssadmin.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
1368	taskkill.exe
1824	taskkill.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\Desktop	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{C7CD5A05-A6B9-B06B-3FDB-EB4CCFC45048}\\ReAgentc.exe\""	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\Desktop	ReAgentc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{C7CD5A05-A6B9-B06B-3FDB-EB4CCFC45048}\\ReAgentc.exe\""	ReAgentc.exe

Modifies Internet Explorer settings 1 TTPs 61 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b96000000000200000000001066000000010000200000002c0f77edd79e206f8c9d3bbaba9089ca426eb06299bd21a9f904e0646fb38f24000000000e80000000020000200000000b2b7b2dd37997c2bc39445e7c6694a4abc85d8fd0a05be82c64f16f0dc07f6890000000003edb61e86e8c9ee9ed225282fbc4392b0ec2055443a79d93f944c3c50ec66c3db9e88e88782d1e464e78be23b40a223625d83d5694dffbeb5750a96c3cfe8c02012e234bec3e37fab703cdb02b53102a199e5dc3a7d1011f08f75e2adcd8663518a4ec263247b96cf0848f0fe721d779682d28126ec047db67a92260f2259e2c374b6c427d28e6733c28e8016b4fa340000000a91ba0b77962465b8fe1a792e71f089bf5bcc38d7579499d840f0ed61a8e2c708bc220df2dae41e4835fbf01cad862a855e029d04fd0c3ebb042fc8334a5a818	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b05b5119722bdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5665A601-9765-11EF-B42B-C23FE47451C3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b960000000002000000000010660000000100002000000010ce90f77ad4ca99d4fc186fb48be2d2ce281758eb4b94210dd16814b680abb1000000000e8000000002000020000000195a82c23a26da38d1d9af2889acaaa69585dfdabfd1614e13c5e10dc9000d89200000001e4764974ea152d9b2969250250792e6a3ea0a80d926dbe053975e309d3e2daa40000000f48a328ff2e782b95e65cd5db633f364c005833835f38b18ae20814f4d89a3acee8e321d643a3ee485d6d07b1d8ebdca8c5145f9da985061c2a0bbd69e66703d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "436526565"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{56575DC1-9765-11EF-B42B-C23FE47451C3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2764	PING.EXE
2304	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe
2328	ReAgentc.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeDebugPrivilege	2540	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe
Token: SeDebugPrivilege	1824	taskkill.exe
Token: SeDebugPrivilege	2328	ReAgentc.exe
Token: SeBackupPrivilege	2084	vssvc.exe
Token: SeRestorePrivilege	2084	vssvc.exe
Token: SeAuditPrivilege	2084	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1664	wmic.exe
Token: SeSecurityPrivilege	1664	wmic.exe
Token: SeTakeOwnershipPrivilege	1664	wmic.exe
Token: SeLoadDriverPrivilege	1664	wmic.exe
Token: SeSystemProfilePrivilege	1664	wmic.exe
Token: SeSystemtimePrivilege	1664	wmic.exe
Token: SeProfSingleProcessPrivilege	1664	wmic.exe
Token: SeIncBasePriorityPrivilege	1664	wmic.exe
Token: SeCreatePagefilePrivilege	1664	wmic.exe
Token: SeBackupPrivilege	1664	wmic.exe
Token: SeRestorePrivilege	1664	wmic.exe
Token: SeShutdownPrivilege	1664	wmic.exe
Token: SeDebugPrivilege	1664	wmic.exe
Token: SeSystemEnvironmentPrivilege	1664	wmic.exe
Token: SeRemoteShutdownPrivilege	1664	wmic.exe
Token: SeUndockPrivilege	1664	wmic.exe
Token: SeManageVolumePrivilege	1664	wmic.exe
Token: 33	1664	wmic.exe
Token: 34	1664	wmic.exe
Token: 35	1664	wmic.exe
Token: SeIncreaseQuotaPrivilege	1664	wmic.exe
Token: SeSecurityPrivilege	1664	wmic.exe
Token: SeTakeOwnershipPrivilege	1664	wmic.exe
Token: SeLoadDriverPrivilege	1664	wmic.exe
Token: SeSystemProfilePrivilege	1664	wmic.exe
Token: SeSystemtimePrivilege	1664	wmic.exe
Token: SeProfSingleProcessPrivilege	1664	wmic.exe
Token: SeIncBasePriorityPrivilege	1664	wmic.exe
Token: SeCreatePagefilePrivilege	1664	wmic.exe
Token: SeBackupPrivilege	1664	wmic.exe
Token: SeRestorePrivilege	1664	wmic.exe
Token: SeShutdownPrivilege	1664	wmic.exe
Token: SeDebugPrivilege	1664	wmic.exe
Token: SeSystemEnvironmentPrivilege	1664	wmic.exe
Token: SeRemoteShutdownPrivilege	1664	wmic.exe
Token: SeUndockPrivilege	1664	wmic.exe
Token: SeManageVolumePrivilege	1664	wmic.exe
Token: 33	1664	wmic.exe
Token: 34	1664	wmic.exe
Token: 35	1664	wmic.exe
Token: SeDebugPrivilege	1368	taskkill.exe
Token: 33	1932	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1932	AUDIODG.EXE
Token: 33	1932	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1932	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1884	iexplore.exe
796	iexplore.exe
796	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
796	iexplore.exe
796	iexplore.exe
1884	iexplore.exe
1884	iexplore.exe
444	IEXPLORE.EXE
444	IEXPLORE.EXE
796	iexplore.exe
796	iexplore.exe
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE
1836	IEXPLORE.EXE
1836	IEXPLORE.EXE
1836	IEXPLORE.EXE
1836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2540	2440	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe	30
PID 2440 wrote to memory of 2540	2440	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe	30
PID 2440 wrote to memory of 2540	2440	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe	30
PID 2440 wrote to memory of 2540	2440	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe	30
PID 2440 wrote to memory of 2540	2440	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe	30
PID 2440 wrote to memory of 2540	2440	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe	30
PID 2440 wrote to memory of 2540	2440	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe	30
PID 2440 wrote to memory of 2540	2440	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe	30
PID 2440 wrote to memory of 2540	2440	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe	30
PID 2440 wrote to memory of 2540	2440	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe	30
PID 2440 wrote to memory of 2540	2440	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe	30
PID 2540 wrote to memory of 2716	2540	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe	33
PID 2540 wrote to memory of 2716	2540	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe	33
PID 2540 wrote to memory of 2716	2540	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe	33
PID 2540 wrote to memory of 2716	2540	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe	33
PID 2540 wrote to memory of 2824	2540	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe	34
PID 2540 wrote to memory of 2824	2540	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe	34
PID 2540 wrote to memory of 2824	2540	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe	34
PID 2540 wrote to memory of 2824	2540	8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe	34
PID 2824 wrote to memory of 1824	2824	cmd.exe	36
PID 2824 wrote to memory of 1824	2824	cmd.exe	36
PID 2824 wrote to memory of 1824	2824	cmd.exe	36
PID 2824 wrote to memory of 1824	2824	cmd.exe	36
PID 2824 wrote to memory of 2764	2824	cmd.exe	38
PID 2824 wrote to memory of 2764	2824	cmd.exe	38
PID 2824 wrote to memory of 2764	2824	cmd.exe	38
PID 2824 wrote to memory of 2764	2824	cmd.exe	38
PID 2716 wrote to memory of 2328	2716	ReAgentc.exe	39
PID 2716 wrote to memory of 2328	2716	ReAgentc.exe	39
PID 2716 wrote to memory of 2328	2716	ReAgentc.exe	39
PID 2716 wrote to memory of 2328	2716	ReAgentc.exe	39
PID 2716 wrote to memory of 2328	2716	ReAgentc.exe	39
PID 2716 wrote to memory of 2328	2716	ReAgentc.exe	39
PID 2716 wrote to memory of 2328	2716	ReAgentc.exe	39
PID 2716 wrote to memory of 2328	2716	ReAgentc.exe	39
PID 2716 wrote to memory of 2328	2716	ReAgentc.exe	39
PID 2716 wrote to memory of 2328	2716	ReAgentc.exe	39
PID 2716 wrote to memory of 2328	2716	ReAgentc.exe	39
PID 2328 wrote to memory of 2596	2328	ReAgentc.exe	40
PID 2328 wrote to memory of 2596	2328	ReAgentc.exe	40
PID 2328 wrote to memory of 2596	2328	ReAgentc.exe	40
PID 2328 wrote to memory of 2596	2328	ReAgentc.exe	40
PID 2328 wrote to memory of 1664	2328	ReAgentc.exe	45
PID 2328 wrote to memory of 1664	2328	ReAgentc.exe	45
PID 2328 wrote to memory of 1664	2328	ReAgentc.exe	45
PID 2328 wrote to memory of 1664	2328	ReAgentc.exe	45
PID 2328 wrote to memory of 2532	2328	ReAgentc.exe	47
PID 2328 wrote to memory of 2532	2328	ReAgentc.exe	47
PID 2328 wrote to memory of 2532	2328	ReAgentc.exe	47
PID 2328 wrote to memory of 2532	2328	ReAgentc.exe	47
PID 2328 wrote to memory of 1536	2328	ReAgentc.exe	49
PID 2328 wrote to memory of 1536	2328	ReAgentc.exe	49
PID 2328 wrote to memory of 1536	2328	ReAgentc.exe	49
PID 2328 wrote to memory of 1536	2328	ReAgentc.exe	49
PID 2328 wrote to memory of 796	2328	ReAgentc.exe	52
PID 2328 wrote to memory of 796	2328	ReAgentc.exe	52
PID 2328 wrote to memory of 796	2328	ReAgentc.exe	52
PID 2328 wrote to memory of 796	2328	ReAgentc.exe	52
PID 2328 wrote to memory of 2932	2328	ReAgentc.exe	53
PID 2328 wrote to memory of 2932	2328	ReAgentc.exe	53
PID 2328 wrote to memory of 2932	2328	ReAgentc.exe	53
PID 2328 wrote to memory of 2932	2328	ReAgentc.exe	53
PID 796 wrote to memory of 444	796	iexplore.exe	55
PID 796 wrote to memory of 444	796	iexplore.exe	55

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Temp\8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe"
  2⤵
  - Cerber
  - Modifies visiblity of hidden/system files in Explorer
  - Adds policy Run key to start application
  - Drops startup file
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Users\Admin\AppData\Roaming\{C7CD5A05-A6B9-B06B-3FDB-EB4CCFC45048}\ReAgentc.exe
    "C:\Users\Admin\AppData\Roaming\{C7CD5A05-A6B9-B06B-3FDB-EB4CCFC45048}\ReAgentc.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Users\Admin\AppData\Roaming\{C7CD5A05-A6B9-B06B-3FDB-EB4CCFC45048}\ReAgentc.exe
      "C:\Users\Admin\AppData\Roaming\{C7CD5A05-A6B9-B06B-3FDB-EB4CCFC45048}\ReAgentc.exe"
      4⤵
      Cerber
      Modifies visiblity of hidden/system files in Explorer
      Adds policy Run key to start application
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Checks whether UAC is enabled
      Sets desktop wallpaper using registry
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies Control Panel
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2328
    - - C:\Windows\system32\vssadmin.exe
        
        "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:2596
    - - C:\Windows\system32\wbem\wmic.exe
        
        "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1664
    - - C:\Windows\System32\bcdedit.exe
        
        "C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2532
    - - C:\Windows\System32\bcdedit.exe
        
        "C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1536
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:796
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:796 CREDAT:275457 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:444
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:796 CREDAT:472065 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1836
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt
        5⤵
        
        PID:2932
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"
        5⤵
        
        PID:1764
    - - C:\Windows\system32\cmd.exe
        
        /d /c taskkill /f /im "ReAgentc.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{C7CD5A05-A6B9-B06B-3FDB-EB4CCFC45048}\ReAgentc.exe" > NUL
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1020
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "ReAgentc.exe"
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1368
      - C:\Windows\system32\PING.EXE
        
        ping -n 1 127.0.0.1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2304
- - C:\Windows\SysWOW64\cmd.exe
    /d /c taskkill /f /im "8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe" > NUL
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "8283c1cc0db9501e05206c0542fe9447_JaffaCakes118.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1824
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2764

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2084

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1884
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1884 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2068

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
1⤵
- System Location Discovery: System Language Discovery
PID:1076

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4cc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.html

Filesize
19KB

MD5
dc30d27d489c851bfe7366b7d8dd25b9

SHA1
d892794c6a1f0422190ef29817290e26a3f458cc

SHA256
a8caa7ee9601b09cf3753a7cbe781b019b2565f60cdbb5cdb7e76b111426dfea

SHA512
543a6fc221448a77000ea53f83c4f29406f6e2b46ba28c0e153d270b0040494b6d496bb3bbffb054b0a9ae521fc2beed6fff023d554948b6fcc99698016814f3

Download Submit
C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.txt

Filesize
10KB

MD5
6d29679e6b4d8bd35b86350bcefc57fe

SHA1
1204c9e0bc7741d9d20d4abe2b1dc2a6203411d8

SHA256
dcd6ba61ff8dcc9950bde5d1f485b2ce28e021b360d869317f929b8f0484f06d

SHA512
63bf52c5d6ceb126cd41a0c7d533f7b139eb28af3631ee3cefada779dda438911752a0c265cabe64e4784ecd67e1fcd828186b1b0861210a14f34729778610f8

Download Submit
C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.url

Filesize
90B

MD5
37cb30c69c997d6709bd912c65c071bc

SHA1
2ef5eb1e415ec49a9baa44c6d9f04238047d1fde

SHA256
8d6f0b5ef79130a4299923c4ccb09df0fd975cd7eae84dc95386b852a19dca93

SHA512
f32fa079bdff591e0600f22a4bef69e8851a257dcf8704809f7f936274949b4db701cc8d7546a106065416beddaf1e5a30603f53eda6f29c5d973db4ad77825a

Download Submit
C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# DECRYPT MY FILES #.vbs

Filesize
252B

MD5
18d46f5d8ebd3c7d6df0c7a8fd1bd64d

SHA1
aeb8407457434aabce2a4c2f95fe305c5303f929

SHA256
ceb35b75d397b07c84dfab3a28189e9431bdf80ec99ab65f9ccf01986bd4a8e9

SHA512
35fc759be0dee77eb9e39350873c24d9693cf6f370f171814e2ce6250ea814fea8a0887442ebae9077d6e9ff81ae7034faa0afcb080401a7d4ac384d2ba42d65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b54da91a38454f07da1e2f1067676ab3

SHA1
67f93e416b07cadc3e2d73b81f4b87b7c3141983

SHA256
16898f490f6e8f7fd696e3cc546ae81e84758115a605ee6f4395fe539daf8c18

SHA512
030f0687d0e3ecc96186faf4832b0153ccedd4079c0af47eb4a863aec32b04dd6ee85fd3dccf01e8f2bcae81360cfe16f1dadaf6ffdbd14b9e7c7f267f53d860

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2c36a8f2c1add37744d0666451f046c

SHA1
2a0c0415ed0a1dfe50d25d8d65fbe1913ea00f58

SHA256
1a96ddc6007dc1601507eab1967a97d338e67e963e963001579f96c632bb29de

SHA512
accb89eb0ebc44957e154357e0075acf24f98d452fc6dee85f0a545e0434768e3c2d00a50fcec598fd56e6e025a5dd75986a48e98d0c9d3149cb2f4804c954d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ff2a2e987f55c8725fd49a09b665ec1

SHA1
8cbed01f2aed96b579e2da7755de4dece875752c

SHA256
68c1f4bac60e21e59524ad633e3b4cfad95948b63b225e606a934b101514b415

SHA512
bc84710b44e387b2d6be68cf110d01be59643ddc366f70d35c86782fdb6724cd74222f9e06337cf83c38f7b9bf607d322a727c210ccd9ae3d527582fc2e04596

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1240c54a8f46e89574b57ff84d68560a

SHA1
c51dad8a9c84192d57689c2b7d61e31b6d4145a1

SHA256
96f66540f8b65be1d9170db6cd55b4a1296f2cdd161db9fe5bb62bae2feb01e7

SHA512
4e0c64eea9a497a4bbaee208a6c9ca8f2daa85af01eaadc6023831c38c2b41e94c68dc856e0005005bb5d1b3c2f9672ca15a863b1f853082c4d9dc9552414667

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de09b2eef8830fc1d79e03a984f90556

SHA1
14b5bfc2d0a7e9a75a81ac39822f5a06f37cee09

SHA256
e15073a764f7a11d5f6a43a248b9534339e2f0d0d8415d4e55dcd7d08c94747d

SHA512
982ec57c5df805ae9ede3bbb627806b451a3173ed310402325e24e944af835736ad077d49fdea3e06a44f575d906cd0357c6c4ce0a612eac3ba2c915590a7f39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b575c98afe60103beb8a52a1ebe5ba37

SHA1
88ce11f261cc18d0a30413a8b2e3929181343c86

SHA256
92fc214e592559c3347d8bdb0b5265c6b28e1f9b24de016c26fd079d055c37e1

SHA512
838eafbd02eb31c157a41c2393a5e4565d43cc8ca73e8faecb9e3e061831bd5df3d73f6e6ca42f7f508eabcf68f512da359ed0865641d5730e70cacd8e46ecbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c07ed043090190f2554ae3d338ef599

SHA1
4b45528ff7beafd01fcbfe57a88f32fed986d1a5

SHA256
797319661759a29111c1bcbabfd384a809d11425adeb9d5e1ab2c6d7de059143

SHA512
c4c7c952eaad3eaf6ee1f5955e1c2ceb406e33165a22d827e0dc05c892693dea980c07c3f48dec0f01bfde861b463fb88ad87e5d2cd7adf755765c76e556bfd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f068458446186746b1436c78eeca9345

SHA1
5c090f07e5795b66e885f5c9e3e485509586083b

SHA256
af7c4107443b923add50aeb54c05cd098a92b17721a1effb75a2aae1516e603a

SHA512
fca721d2c5b797f70b237daa4c83c0b6fddf47e250bf59f1c17f497a22578fcdcc9fdb3beadb5854902af3d2b7467e6492ecab7923938718880f4024ca9219e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d94a2291f51f18aa735c648ea9c8512c

SHA1
22ea1612394449bc5330f9b92d21c9c55e770300

SHA256
a852943bd2a26fdb8724de44a8764c0597c3b96632772bcd36cc2d51d8e286d7

SHA512
54ea61aa77049926c1312ceb86c6a652619aa6c755db99eedff4725b29c248b60f3e4e036e158f5ec41a955442011c14596f5cec4130ce1e1f52107991eec143

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17d85047e15a3d23d0233a994c847c65

SHA1
b6063d328f4fc3cc9fa4edd86117a3fd2579832a

SHA256
512ca0ed3f4e9ae3fc4b7590aaf4e20a3e119c4f65c6d41195eaa77b3a1ce651

SHA512
e27a6e367183dd3952fd8ab9ef138531b613971486821eef86e98b7929b1698dade0553747285e9f3674f385a32459fbe350c4a00334a2c76a29cf3f99dd6dc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f464186bc4e09c41f0591fbdf41605d

SHA1
a15320703f18d9fb3a82b123024949b7ba9087ff

SHA256
afe6c54c62108f97398ab95322bb5fc5e8b7c226befe144f42529737a3a6a0f2

SHA512
d8a94ba52842e548fe4f761cb55c223c3f36e0ff4312515ac2c0eb8da84fc68cb45daaca19aa96c8875fd7b8408553fc036be0d04b32610d6830c813cfb7c568

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14b9fc91cf04a61563987abe071cedf0

SHA1
26df1da1421bf0306bd6a0b906e9272765e6403e

SHA256
bb594b73581f15d2a54f377fac1ab30751a27eef3a3e373ce8e745367476513e

SHA512
e2bcd0f987ffd7293833f3cace5cd7b403dd5e9092aa1a67274d8906f1faf5a872ea295d7aa45f672ec9fa3f2995a4b9b67e6e3e13d478aab0a83e0f47a08a42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e536d83244def90107a0bf39b0942bf

SHA1
8332a286bd6208f80f457f3dece91bf812affe20

SHA256
5cbc4394c88110ead140c6d802695bd8085bf920d01aa3667e71c197444f833a

SHA512
15c3a8b8b58a22cc6f09537b0b5c5beeba74fd69da23d4e972c84a22444645e1deafb56cc9599dc7daf74c61a8c98599f392a3831c7a434c6fc3029302e7170c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
115a1857f659246165a9bb18593cbeff

SHA1
02fb3e3a059166ba06326993d61c121467b3d59b

SHA256
c4738244ba564319c9d65ec0e84a3cc0e85f19120f14937b6f9294e8acfd49be

SHA512
dca84c5c742d6a154c8701b88026f41f0d08b64f7cf962570d8faf09434034f0ee71474abbb3e3e187b6d5e4597ed11adaa4b093c26d7524b2791d1f9d0c761f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79f9b7de53707ca536e55d8c4c893faa

SHA1
33be8bb4eddf92624d2eb3b9a54a330236a9718b

SHA256
c9f5359d544c6aa77626cba243610a92be53862a44ff8d3534d889cde1fea082

SHA512
6e4dd4eeed995190214e79ecbd680a023e4122225bd3b3829e3b5fec7a55c0101115a3abff9bb4b91e09eacf36c7a83f8a757aeca2da219b1cf34a97e08c949f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59769683ef11edfdf9d547032c60e9d7

SHA1
a50bba26357bc56a99354dd0fe6caecbae271328

SHA256
5b0ad22a67000badf08ea36494d48032ec849e1b38977f6af39e33066b51e0eb

SHA512
844f7817a7835eeb9e05eb37d22f1006d0379a78fa241124d4d5940f2ef1b8411d94c5803c73517f947c9307de6bd353903f5a198b3119ed9b454aa38b7904dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
649fce74770e77fc89e1b6c4ff71408e

SHA1
1744f48c9edb0a1209756c4fe13546e67bf1e81e

SHA256
d88dfa0f8e83c175595f8870e08b0ab75dff4bfb18e701e1f67f45a1bfadc2f8

SHA512
46e4ac48987fb8b095157e32fca798f9f7740bcf326a32b06ba65639755354472ea2c634e2e80496b0cd9fb2b2b449b981cc65b5976633f8ec1a538f72c95b7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ee633e706dc6204670e89247390b6ea

SHA1
0da2d01ac5cc873a5f8ecee2679ec91c6b6f71f7

SHA256
9e21b58fa94806a81c0e106de2e7cd8592a3ee271119b6e779b3eb34a1248eb6

SHA512
dfaec909d0d881985bcf7008c10aaca5737b01cb246570a35185bc4ef806b5a9995193ebbf7857b45674cb04752e1bd89b732d250af87b1806e3802894d309d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80a1b86713a34feda0a7f1aac5734451

SHA1
fb3120bc0eaa138b67f8993670ffe4d6dd4f3f52

SHA256
a3878b657461f9f6f075b104d57febaf2bf992eb5ec69c2744780bd5482fc5cb

SHA512
b9fbdb101ab3daa181405baf4cf2723197e5207a6cdd1a628390ca9c9f27bf084a64938c231301f42397367389e8f6037fee3e02e439836af36e3d81dbbd6482

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12f179870d13261362b92d1487dd2360

SHA1
4a476a2d8451fa2742b671de63b8fc91fd5f0df3

SHA256
9cc4702bf86168466d2acb92998905fedf8f9495b6f97c0895ee2fc701618389

SHA512
8e139c2437272213812528d023dd1e33b5f9adeb7714203f282d98f2b11b53a0d2fe2d182d57fed2380437f525c0ff19b176fb85e5dca0eee2172501c7023b07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e34e73eaa99076bb67f42a80b49715c

SHA1
6b807c8177fe599bee16f0f1692a11c533d44ed7

SHA256
80308673f5f5e9190ecab5855a4c322837f9843964b6d35b60f67dc1388cc94c

SHA512
eb64c7781f69f958e451b52bb5d4a9aa251a0eda25eaacb80ddf91a1ae93989cff99ab1b3216bded142ea9447e11067f33a96d1a60e3fb0a315c3450a6bc3b47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{56575DC1-9765-11EF-B42B-C23FE47451C3}.dat

Filesize
3KB

MD5
1b97cc7f61c551f4d952fe363f273162

SHA1
ad4c10400fb5a01c8bda2c1baf48bb35b6b01714

SHA256
f82895c3265eedab26be9e001e070d23065a893f1ac9d461ccbb5ba510097cf0

SHA512
134cdf058703d5b994a6dedffd30841a55cfe8a0e93a7a56c2001fbc6a6262bd66301cc64e7efe6d59fd2ccd07d7ecf81e4863abbaaf0a3770e856bb77e141f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5665A601-9765-11EF-B42B-C23FE47451C3}.dat

Filesize
5KB

MD5
b4725c4b7f2aec43fd69f1f72f726e9b

SHA1
4e1d0d49326f0ec08cb56fa294d4e1d986a33799

SHA256
01ba7db9c21814b791fd2d1e66d2fdf58d23cdbe5569a1b3ec4e35c9c7d6265f

SHA512
f3c3c958c610fe9d3ae228dea85fba371b767e17398fc154b3e38cc199f89ccc1e6d1480974623d4b5dfcccd2dde73c33347958b536939fe65349fb4a639b869

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5GWW47WY\json[1].json

Filesize
289B

MD5
59386c53f2570f0e370e2ece30ccce7a

SHA1
b2fe2bc41bc2c07a33ebbc2e3ec6e30229215d69

SHA256
3b845724fd74dd2034ec56d4a2ecacc2dd49e0b388bf68f2e9546b9f8fa8065f

SHA512
3dd155da349193d5b1c185c52b2bd5b66edcff318d4fb051799523c490f6a95c9da85ab8dc203334b4630c978b0cb6fa70fcc54497e33ea1b9c91f4497541569

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFCC9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFD58.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Dunnakin.Xtw

Filesize
3KB

MD5
6b6888981cf28ad6060bf74a6310d40c

SHA1
5eab9777cfcf3be44dd621eb3a7abf482df3e7f3

SHA256
d429f4b6cda0bc7014c10f05cb4d9a520cbabc6b297c4e8cd792b2b5e854d987

SHA512
64c6d6ea608e1c5d0c3a952caf5816a16d31212e1bb9e62b76710b4e9dd751023f3d8c58333c73cf79c7aff0fafb1143290b0666a7e20b798c3e52a563a61655

Download Submit
C:\Users\Admin\AppData\Roaming\Errlog.txt

Filesize
3KB

MD5
efbc169b88295e057788c9c1014063b9

SHA1
0de91b944381992ed591813211882486813a0f9c

SHA256
8ab689b3789c7310d96855311e9af3c59ea7a0c40318c2ab5ea262f13f4be084

SHA512
49e1dacb0b67d4d9257b9be6a48fabd15b8c91394a02fe9abedff76e9e794ae6db95a2b6ef222d028bd0dbaf4ac32c56511380d26a5ccd78dbec58ae7f3fd4df

Download Submit
C:\Users\Admin\AppData\Roaming\Errlog.txt

Filesize
2KB

MD5
1b5c9ac81d0db16bdef65bb8ed4401a1

SHA1
b45a09049cdabcdaa104e284bb457aabf9e02909

SHA256
79f8f465d0ad808a0c2bc0bd79cad80d1f2ec0e92df2a7b9d79d764bb0308535

SHA512
c2d6146fad4289a9f6b502872f102dbe7678bab74f744810845ed80d137620b3ea45b8141f2600cc557df27f3e79523df6ce8bc9fc2947798f2171034149076c

Download Submit
C:\Users\Admin\AppData\Roaming\Fighter4 Flight Path.mesh

Filesize
3KB

MD5
c22dce2c95e3fbc8ac2f569b7fb8474a

SHA1
9e5b1c407424004fa5c0c1d96af96a9b0e10353e

SHA256
423cad4eca8206b5b3ef851278a749e5246042e32759abe6b2026d14ed2ba6d6

SHA512
f516531af2f75cb949ef6fbd2bd18e12aa07f94e2b7cb1398d0b13033f84c91f32ca28dc76c6e8caa8191c7b115a3cf59fddc241bfb3e244ae50247c6eee69f1

Download Submit
C:\Users\Admin\AppData\Roaming\Latency.aS9

Filesize
207KB

MD5
2fcb0be151595ca64a870aa356c0db8c

SHA1
e9ecdf81188a5fc3800fbe4b2856c04cbb838def

SHA256
58c63bb36f82c489fee50f4f460fb0467abf158200d512c0b007b8111a53b00d

SHA512
bbaa13b73a94c1c4c421e99e148aaadc2f01e2b2e5fe49f1bd8c36ddca7592b31660a3e6daac045dc6d92a93028b4b21ea87f7290ee353adb28d43188ad01690

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ReAgentc.lnk

Filesize
1KB

MD5
f41ad6881c29ac0ac84c3021799efae4

SHA1
70c3ad1f6ed6052b5711d3f1e434f44175ea8943

SHA256
da3eca46f51755a095fd975b153081239be3c0a8b7df39170c5505d30bf4cc48

SHA512
e5ab82556c737fa9a84bbd8fb1d4d95386b611b8702b7f8003a8912b6573501048eaa2c542141002229b8f3d6e2905af2fc0b6d92cc3b4fd8aca5baed30e1b39

Download Submit
\Users\Admin\AppData\Local\Temp\nsoB491.tmp\System.dll

Filesize
11KB

MD5
6f5257c0b8c0ef4d440f4f4fce85fb1b

SHA1
b6ac111dfb0d1fc75ad09c56bde7830232395785

SHA256
b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1

SHA512
a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8

Download Submit
\Users\Admin\AppData\Roaming\Perl.dll

Filesize
72KB

MD5
9b35870798ea01e8e943091ec7a0bb80

SHA1
66650be447dceabd4ba938ccf1a9663f2eb99a91

SHA256
663aa24d2ef5cc3a0f0b8e8e575643c59a37b4c0fd7d7b2cf5217f14c9eb7309

SHA512
b9f297a2cc255a7aac51ff2b1e45f6985359968bfe88b8e7201f7ecb5b16bfd97323042a29ad87e149c7994d9e16b034ebe1b044bffc6e2a98ebef2997656279

Download Submit
\Users\Admin\AppData\Roaming\{C7CD5A05-A6B9-B06B-3FDB-EB4CCFC45048}\ReAgentc.exe

Filesize
258KB

MD5
8283c1cc0db9501e05206c0542fe9447

SHA1
fa800fdf2fc3bc8c015d7f20e04a54b9f95f39f5

SHA256
b592240b55c4c0fcf3733ba808523025ec245302d7ebc897bbc6824596de90a7

SHA512
133edc6a33503896adcc86381f1bed32646b734e246b22843a524c489bd6a63c38e696aa14b814c744d817385146ad214a78963a80c6cb3d9a7783099ae6791a

Download Submit
memory/2328-557-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2328-80-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2328-90-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2328-548-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2328-91-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2328-81-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2328-554-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2328-89-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2328-86-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2328-551-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2440-11-0x0000000001E00000-0x0000000001E13000-memory.dmp

Filesize
76KB

Download
memory/2540-20-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2540-32-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2540-15-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2540-18-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2540-28-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2540-22-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2540-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2540-26-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2540-16-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2540-13-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2540-29-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2540-46-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2716-63-0x0000000002840000-0x0000000002853000-memory.dmp

Filesize
76KB

Download