Malware Analysis Report

2025-06-15 22:32

Sample ID 241102-hc2rbaylaw
Target 84e02b7e01c3cf953b300905a9865d81_JaffaCakes118
SHA256 156ea726a0ad6c8d77a5bdd4c7ed8581ea72bc77e3b3e011307e7fb706237c51
Tags
collection credential_access defense_evasion discovery persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

156ea726a0ad6c8d77a5bdd4c7ed8581ea72bc77e3b3e011307e7fb706237c51

Threat Level: Known bad

The file 84e02b7e01c3cf953b300905a9865d81_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

collection credential_access defense_evasion discovery persistence spyware stealer

Modifies WinLogon for persistence

Unsecured Credentials: Credentials In Files

Reads user/profile data of web browsers

Loads dropped DLL

Reads user/profile data of local email clients

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Checks installed software on the system

Accesses Microsoft Outlook profiles

Indicator Removal: File Deletion

Suspicious use of SetThreadContext

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Program crash

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

outlook_win_path

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-02 06:36

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-02 06:36

Reported

2024-11-02 06:38

Platform

win7-20241010-en

Max time kernel

146s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\4_pinnew.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\lsass = "C:\\Windows\\lsass.exe" C:\Users\Admin\AppData\Local\Temp\teste1_p.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\netc = "C:\\Windows\\svc.exe" C:\Users\Admin\AppData\Local\Temp\avto.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\odnexy = "C:\\Windows\\odbnsy.exe" C:\Users\Admin\AppData\Local\Temp\5_odbnsy.exe N/A

Checks installed software on the system

discovery

Indicator Removal: File Deletion

defense_evasion

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1480 set thread context of 0 N/A C:\Users\Admin\AppData\Local\Temp\1269190981.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\lsass.exe C:\Users\Admin\AppData\Local\Temp\teste1_p.exe N/A
File opened for modification C:\Windows\lsass.exe C:\Users\Admin\AppData\Local\Temp\teste1_p.exe N/A
File created C:\Windows\svc.exe C:\Users\Admin\AppData\Local\Temp\avto.exe N/A
File opened for modification C:\Windows\svc.exe C:\Users\Admin\AppData\Local\Temp\avto.exe N/A
File created C:\Windows\odbnsy.exe C:\Users\Admin\AppData\Local\Temp\5_odbnsy.exe N/A
File opened for modification C:\Windows\odbnsy.exe C:\Users\Admin\AppData\Local\Temp\5_odbnsy.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\avto.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2_load.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1_barac.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\teste1_p.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\q1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\5_odbnsy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4_pinnew.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1your_exe.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\q1.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\5_odbnsy.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Users\Admin\AppData\Local\Temp\5_odbnsy.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Users\Admin\AppData\Local\Temp\5_odbnsy.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\teste1_p.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4_pinnew.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4_pinnew.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5_odbnsy.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4_pinnew.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1your_exe.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 324 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\teste1_p.exe
PID 324 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\teste1_p.exe
PID 324 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\teste1_p.exe
PID 324 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\teste1_p.exe
PID 324 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\q1.exe
PID 324 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\q1.exe
PID 324 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\q1.exe
PID 324 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\q1.exe
PID 324 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\avto.exe
PID 324 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\avto.exe
PID 324 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\avto.exe
PID 324 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\avto.exe
PID 324 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe
PID 324 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe
PID 324 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe
PID 324 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe
PID 324 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\5_odbnsy.exe
PID 324 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\5_odbnsy.exe
PID 324 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\5_odbnsy.exe
PID 324 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\5_odbnsy.exe
PID 2872 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\SysWOW64\WerFault.exe
PID 2872 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\SysWOW64\WerFault.exe
PID 2872 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\SysWOW64\WerFault.exe
PID 2872 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\SysWOW64\WerFault.exe
PID 324 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4_pinnew.exe
PID 324 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4_pinnew.exe
PID 324 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4_pinnew.exe
PID 324 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4_pinnew.exe
PID 324 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2_load.exe
PID 324 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2_load.exe
PID 324 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2_load.exe
PID 324 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2_load.exe
PID 324 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1your_exe.exe
PID 324 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1your_exe.exe
PID 324 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1your_exe.exe
PID 324 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1your_exe.exe
PID 324 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1269190981.exe
PID 324 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1269190981.exe
PID 324 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1269190981.exe
PID 324 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1269190981.exe
PID 324 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1_barac.exe
PID 324 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1_barac.exe
PID 324 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1_barac.exe
PID 324 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1_barac.exe
PID 1104 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\2_load.exe C:\Windows\SysWOW64\cmd.exe
PID 1104 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\2_load.exe C:\Windows\SysWOW64\cmd.exe
PID 1104 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\2_load.exe C:\Windows\SysWOW64\cmd.exe
PID 1104 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\2_load.exe C:\Windows\SysWOW64\cmd.exe
PID 2076 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\1your_exe.exe C:\Windows\SysWOW64\cmd.exe
PID 2076 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\1your_exe.exe C:\Windows\SysWOW64\cmd.exe
PID 2076 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\1your_exe.exe C:\Windows\SysWOW64\cmd.exe
PID 2076 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\1your_exe.exe C:\Windows\SysWOW64\cmd.exe

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\4_pinnew.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\teste1_p.exe

"C:\Users\Admin\AppData\Local\Temp\teste1_p.exe"

C:\Users\Admin\AppData\Local\Temp\q1.exe

"C:\Users\Admin\AppData\Local\Temp\q1.exe"

C:\Users\Admin\AppData\Local\Temp\avto.exe

"C:\Users\Admin\AppData\Local\Temp\avto.exe"

C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe

"C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe"

C:\Users\Admin\AppData\Local\Temp\5_odbnsy.exe

"C:\Users\Admin\AppData\Local\Temp\5_odbnsy.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 160

C:\Users\Admin\AppData\Local\Temp\4_pinnew.exe

"C:\Users\Admin\AppData\Local\Temp\4_pinnew.exe"

C:\Users\Admin\AppData\Local\Temp\2_load.exe

"C:\Users\Admin\AppData\Local\Temp\2_load.exe"

C:\Users\Admin\AppData\Local\Temp\1your_exe.exe

"C:\Users\Admin\AppData\Local\Temp\1your_exe.exe"

C:\Users\Admin\AppData\Local\Temp\1269190981.exe

"C:\Users\Admin\AppData\Local\Temp\1269190981.exe"

C:\Users\Admin\AppData\Local\Temp\1_barac.exe

"C:\Users\Admin\AppData\Local\Temp\1_barac.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c del "C:\Users\Admin\AppData\Local\Temp\2_load.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1YOUR_~1.EXE > nul

Network

Country Destination Domain Proto
US 8.8.8.8:53 aahydrogen.com udp
US 8.8.8.8:53 zz87jhfda88.com udp
US 8.8.8.8:53 sibjazz.ru udp
US 8.8.8.8:53 bastocks.com udp
US 15.197.204.56:80 bastocks.com tcp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 ginsdirect.com udp
US 13.248.169.48:80 ginsdirect.com tcp
US 13.248.169.48:443 ginsdirect.com tcp
US 8.8.8.8:53 settopworld.net udp
US 8.8.8.8:53 autouploaders.net udp
DE 185.53.177.53:80 autouploaders.net tcp
US 8.8.8.8:53 d38psrni17bvxu.cloudfront.net udp
GB 18.165.158.46:80 d38psrni17bvxu.cloudfront.net tcp
US 8.8.8.8:53 ifdnzact.com udp
US 208.91.196.46:80 ifdnzact.com tcp
US 8.8.8.8:53 greatinstant.net udp
US 8.8.8.8:53 trenublo.com udp
US 8.8.8.8:53 bestwebtop.net udp
US 8.8.8.8:53 greattaby.com udp
US 8.8.8.8:53 cafebarplaza.cn udp

Files

memory/324-176-0x0000000000401000-0x000000000048E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1_barac.exe

MD5 69b74e9361667f788cf0f1af62e0ea75
SHA1 313c0f205615de074111851c2cb1ea5bc38a2be8
SHA256 5d6446096db3fe70e9e7f098b6bbf5bd0d1cdffbb8e487a91228ea0d9ced1c1a
SHA512 a05bff03eea90379d02a07bd3dc77a7482ce5dc1cd609744c3559c4a75d361d87ad4a979f302d27c8ca94b47bf50ea72098115c1ac3860511219e3df1369b78a

C:\Users\Admin\AppData\Local\Temp\1269190981.exe

MD5 a81cba51a8e0a4a46d2da44caeff63cd
SHA1 fbcc341075298d95e9f4685556686380b621989c
SHA256 3b671780d55eb7a8f7c3e57be194d23bc2946e39c4884296e14c5b6c81ac3ed3
SHA512 eac61ab0d9d7a6b090e03b836c3ff4dc3e11578e08791ff41c1896345b156355c8cd59ee02af63c173eaf3473f6f735f3347da209bfd50fb790e381c689d8776

C:\Users\Admin\AppData\Local\Temp\1your_exe.exe

MD5 f11699c753aa3b403ee810d14aaa8907
SHA1 4d7c6f7564b4aa20310499c8a9cf46aa3c65560c
SHA256 7a2633419743680bc2f30216580effd93583b4f180538411aa8103e37c5dd533
SHA512 1c97cf9f98bf1e8c0cfdc62a4f140e854dfccb8655a8a8ea6592ae42141f9b70da79ae27028eb05fc41617b10fac56ef4cc3bde0574de8dbb4cd6f4be784639e

memory/2076-146-0x0000000000400000-0x000000000040B000-memory.dmp

memory/324-143-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/324-142-0x00000000026F0000-0x00000000026FB000-memory.dmp

memory/324-141-0x00000000026F0000-0x00000000026FB000-memory.dmp

memory/324-140-0x00000000026F0000-0x00000000026FB000-memory.dmp

memory/324-139-0x00000000026E0000-0x00000000026EB000-memory.dmp

memory/324-138-0x00000000026E0000-0x00000000026EB000-memory.dmp

memory/324-137-0x0000000000401000-0x000000000048E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5_odbnsy.exe

MD5 46399ada349010e0945d6a8ba69137d3
SHA1 468efa26f445d54ba703501109159f7d85a2df51
SHA256 4b1f59a3c47e015ef50f5092539e40ffa92b5ccae88dbfec828d0d9414c33af0
SHA512 ecc847376426d21b6f610e2427578edc9e5a8e0082579a6e7b8b2b493b6904661236b47533533064020e2aca63ecc2d1e35539a5b252f7e3cfce19c2ff3a2383

C:\Users\Admin\AppData\Local\Temp\avto.exe

MD5 99dae998144126e8774b6e57497e1930
SHA1 34aed0238c911e5e9475822aec31d545ae1961e1
SHA256 81bff218030142ace3a8f4dcf9ff14f96fddccd6c821aff45798e1701b69e991
SHA512 33f3cd28ca48a0466093ce44b137097a86fe5eb499424a244db0504cad1ee95196a56c40281d2c960fa6cd4f2d65cbd4f92411ef0c582ed8d1c210726b213a56

C:\Users\Admin\AppData\Local\Temp\2_load.exe

MD5 eab0da403a9f596485b4c231f24e41ab
SHA1 384c06c067e7b66935c2dba44d77ab5b2ce4b2e5
SHA256 00fdc28881dae4748fbc7f0daecf8907128deb351d1d28950b66f7ad4fa83837
SHA512 6fae3390e77303f4318778d95105e06b98b5a910a38fb85db937129947f1b98f01ed9d9156b88a18e01ca1eec0a7ac6232aadfeb8f7ff4044bac55d64f588884

C:\Users\Admin\AppData\Local\Temp\teste1_p.exe

MD5 8d9e5086a4aace8642feecff39a5eeb0
SHA1 7ab655ded632b658847666666464fc337ff5deb2
SHA256 7eb7190ff9c33ce5db5b7df8dba33571c1347e865e66c7212c661c4b3e4af3f3
SHA512 ec60672593e7e05c51cc4fca258250eeaaba789c42fdbc5a948642e1776434f18badc0cc650fc7e62f60cf89e00d3134c302316425e20e41b3252352b43ff9fd

\Users\Admin\AppData\Local\Temp\6_ldry3no.exe

MD5 bfc08d0dcdf0b6af01079c736be73b5e
SHA1 967c84e54168256e2ad7bb78cc35c8e7e9d5767b
SHA256 d57cff8fd945721b53c59cee9f97a69d5f6d3fb346ca0fb7066e5a740b252a3a
SHA512 cb46c1e52f8b13c416c52e41b1f26a29cb48bce461675916c109d1f43043c9dc082431644bab94b4d0f0203b88062d06baaa7c016785a5586132bc4264f9b0ee

C:\Users\Admin\AppData\Local\Temp\4_pinnew.exe

MD5 254363c5bc75c63a6f9fdae5aec17aa1
SHA1 2e3e3d74212fe3c91407bf059794a65417018a8c
SHA256 061908d8a76056698270a0f47089cfd5a246bec8494ebd2ca0a2d278fd790a20
SHA512 0f2b5d5ca694c2d768f43ae68adb515cdb06382282c2bea08fd2bd1cafe924f0ef4e4f20800ef5e413292b1bc29a3e5c1316c64503ee23beb2e54ded4e4b8d5e

memory/324-177-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2104-68-0x0000000000400000-0x00000000004D0000-memory.dmp

memory/2872-67-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1080-66-0x0000000000400000-0x0000000000479000-memory.dmp

memory/1080-35-0x0000000000400000-0x0000000000479000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\q1.exe

MD5 406b63d114199ce9930bfc4a1a6b60dc
SHA1 babf4ee8226b7625cdf19a04c05ad4460bc3bd14
SHA256 a00aea2e9ada85124b140d294d87c1ae326eec4527f7fa65861d1b468a5c02da
SHA512 c1297a85b9b8afd2058486a7df0683a104f1087bedb6c3b67f1f33a7c2395dbe9f35b01a1a6684f50db675f6555fd391b172cfbc641373e563d2ca04a0ee50b4

memory/2104-19-0x0000000000400000-0x00000000004D0000-memory.dmp

memory/324-3-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/324-1-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/324-0-0x0000000000401000-0x000000000048E000-memory.dmp

memory/2104-178-0x0000000000400000-0x00000000004D0000-memory.dmp

memory/2104-179-0x0000000000400000-0x00000000004D0000-memory.dmp

memory/1080-181-0x0000000000400000-0x0000000000479000-memory.dmp

memory/2880-182-0x0000000000400000-0x000000000047B000-memory.dmp

memory/1480-184-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2872-188-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1080-187-0x0000000000400000-0x0000000000479000-memory.dmp

memory/2696-191-0x0000000013140000-0x0000000013181000-memory.dmp

memory/2076-194-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2768-190-0x0000000000400000-0x000000000047C000-memory.dmp

memory/1104-192-0x0000000000400000-0x0000000000910000-memory.dmp

memory/2196-195-0x0000000013140000-0x0000000013156000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab2676.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar26D7.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DUME8XYE\yekhhiijfg[1].htm

MD5 45a9a2084a44d18bd0f446d6855908e4
SHA1 2b00aab2d6fd2e8fe429facce198d7093559adf1
SHA256 2ef87fbd5f3ec904bc116f3654421f4c53dc5438bbf36fa029dc8af8813f9646
SHA512 5e5d0c962cfa6faffafd32e10d1e38d90e12c184ab77d72907108b98bf73bdee685300c44ffae937203c7f74ecb8110794b542a4c3ba4831c9b3bafc77dc4d84

memory/1104-309-0x0000000000400000-0x0000000000910000-memory.dmp

memory/2768-315-0x0000000000400000-0x000000000047C000-memory.dmp

memory/2104-339-0x0000000000400000-0x00000000004D0000-memory.dmp

memory/1080-340-0x0000000000400000-0x0000000000479000-memory.dmp

memory/2104-357-0x0000000000400000-0x00000000004D0000-memory.dmp

memory/1080-358-0x0000000000400000-0x0000000000479000-memory.dmp

memory/2104-372-0x0000000000400000-0x00000000004D0000-memory.dmp

memory/2104-395-0x0000000000400000-0x00000000004D0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NT668XG4\errorPageStrings[1]

MD5 e3e4a98353f119b80b323302f26b78fa
SHA1 20ee35a370cdd3a8a7d04b506410300fd0a6a864
SHA256 9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66
SHA512 d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7BCOPU31\ErrorPageTemplate[1]

MD5 f4fe1cb77e758e1ba56b8a8ec20417c5
SHA1 f4eda06901edb98633a686b11d02f4925f827bf0
SHA256 8d018639281b33da8eb3ce0b21d11e1d414e59024c3689f92be8904eb5779b5f
SHA512 62514ab345b6648c5442200a8e9530dfb88a0355e262069e0a694289c39a4a1c06c6143e5961074bfac219949102a416c09733f24e8468984b96843dc222b436

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8P9TO0C6\httpErrorPagesScripts[1]

MD5 3f57b781cb3ef114dd0b665151571b7b
SHA1 ce6a63f996df3a1cccb81720e21204b825e0238c
SHA256 46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad
SHA512 8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DUME8XYE\navcancl[1]

MD5 4bcfe9f8db04948cddb5e31fe6a7f984
SHA1 42464c70fc16f3f361c2419751acd57d51613cdf
SHA256 bee0439fcf31de76d6e2d7fd377a24a34ac8763d5bf4114da5e1663009e24228
SHA512 bb0ef3d32310644285f4062ad5f27f30649c04c5a442361a5dbe3672bd8cb585160187070872a31d9f30b70397d81449623510365a371e73bda580e00eef0e4e

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DUME8XYE\info_48[1]

MD5 5565250fcc163aa3a79f0b746416ce69
SHA1 b97cc66471fcdee07d0ee36c7fb03f342c231f8f
SHA256 51129c6c98a82ea491f89857c31146ecec14c4af184517450a7a20c699c84859
SHA512 e60ea153b0fece4d311769391d3b763b14b9a140105a36a13dad23c2906735eaab9092236deb8c68ef078e8864d6e288bef7ef1731c1e9f1ad9b0170b95ac134

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NT668XG4\bullet[1]

MD5 26f971d87ca00e23bd2d064524aef838
SHA1 7440beff2f4f8fabc9315608a13bf26cabad27d9
SHA256 1d8e5fd3c1fd384c0a7507e7283c7fe8f65015e521b84569132a7eabedc9d41d
SHA512 c62eb51be301bb96c80539d66a73cd17ca2021d5d816233853a37db72e04050271e581cc99652f3d8469b390003ca6c62dad2a9d57164c620b7777ae99aa1b15

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7BCOPU31\background_gradient[1]

MD5 20f0110ed5e4e0d5384a496e4880139b
SHA1 51f5fc61d8bf19100df0f8aadaa57fcd9c086255
SHA256 1471693be91e53c2640fe7baeecbc624530b088444222d93f2815dfce1865d5b
SHA512 5f52c117e346111d99d3b642926139178a80b9ec03147c00e27f07aab47fe38e9319fe983444f3e0e36def1e86dd7c56c25e44b14efdc3f13b45ededa064db5a

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-02 06:36

Reported

2024-11-02 06:38

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

148s

Command Line

winlogon.exe

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\sdra64.exe," C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1your_exe.exe N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\4_pinnew.exe N/A

Checks installed software on the system

discovery

Indicator Removal: File Deletion

defense_evasion

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\sdra64.exe C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe N/A
File created C:\Windows\SysWOW64\sdra64.exe C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 744 set thread context of 0 N/A C:\Users\Admin\AppData\Local\Temp\1269190981.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\teste1_p.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\avto.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4_pinnew.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2_load.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1your_exe.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1269190981.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\q1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\5_odbnsy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1_barac.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4_pinnew.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1your_exe.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1269190981.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3652 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\teste1_p.exe
PID 3652 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\teste1_p.exe
PID 3652 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\teste1_p.exe
PID 3652 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\q1.exe
PID 3652 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\q1.exe
PID 3652 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\q1.exe
PID 3652 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\avto.exe
PID 3652 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\avto.exe
PID 3652 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\avto.exe
PID 3652 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe
PID 3652 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe
PID 3652 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe
PID 3652 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\5_odbnsy.exe
PID 3652 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\5_odbnsy.exe
PID 3652 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\5_odbnsy.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3652 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4_pinnew.exe
PID 3652 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4_pinnew.exe
PID 3652 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\4_pinnew.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3652 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2_load.exe
PID 3652 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2_load.exe
PID 3652 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\2_load.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3652 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1your_exe.exe
PID 3652 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1your_exe.exe
PID 3652 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1your_exe.exe
PID 3652 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1269190981.exe
PID 3652 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1269190981.exe
PID 3652 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1269190981.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3280 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe C:\Windows\system32\winlogon.exe
PID 3652 wrote to memory of 3520 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1_barac.exe
PID 3652 wrote to memory of 3520 N/A C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1_barac.exe

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\4_pinnew.exe N/A

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\84e02b7e01c3cf953b300905a9865d81_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\teste1_p.exe

"C:\Users\Admin\AppData\Local\Temp\teste1_p.exe"

C:\Users\Admin\AppData\Local\Temp\q1.exe

"C:\Users\Admin\AppData\Local\Temp\q1.exe"

C:\Users\Admin\AppData\Local\Temp\avto.exe

"C:\Users\Admin\AppData\Local\Temp\avto.exe"

C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe

"C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe"

C:\Users\Admin\AppData\Local\Temp\5_odbnsy.exe

"C:\Users\Admin\AppData\Local\Temp\5_odbnsy.exe"

C:\Users\Admin\AppData\Local\Temp\4_pinnew.exe

"C:\Users\Admin\AppData\Local\Temp\4_pinnew.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3136 -ip 3136

C:\Users\Admin\AppData\Local\Temp\2_load.exe

"C:\Users\Admin\AppData\Local\Temp\2_load.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2344 -ip 2344

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 948 -ip 948

C:\Users\Admin\AppData\Local\Temp\1your_exe.exe

"C:\Users\Admin\AppData\Local\Temp\1your_exe.exe"

C:\Users\Admin\AppData\Local\Temp\1269190981.exe

"C:\Users\Admin\AppData\Local\Temp\1269190981.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 588

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1648 -ip 1648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3488 -ip 3488

C:\Users\Admin\AppData\Local\Temp\1_barac.exe

"C:\Users\Admin\AppData\Local\Temp\1_barac.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 576

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 500

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 588

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1YOUR_~1.EXE > nul

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 aahydrogen.com udp
US 8.8.8.8:53 zz87jhfda88.com udp
US 8.8.8.8:53 bastocks.com udp
US 15.197.204.56:80 bastocks.com tcp
US 15.197.204.56:80 bastocks.com tcp
US 8.8.8.8:53 56.204.197.15.in-addr.arpa udp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 moretds.org udp
US 8.8.8.8:53 moretds.org udp

Files

memory/3652-1-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/3652-0-0x0000000000401000-0x000000000048E000-memory.dmp

memory/3652-3-0x0000000000400000-0x00000000005E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\teste1_p.exe

MD5 8d9e5086a4aace8642feecff39a5eeb0
SHA1 7ab655ded632b658847666666464fc337ff5deb2
SHA256 7eb7190ff9c33ce5db5b7df8dba33571c1347e865e66c7212c661c4b3e4af3f3
SHA512 ec60672593e7e05c51cc4fca258250eeaaba789c42fdbc5a948642e1776434f18badc0cc650fc7e62f60cf89e00d3134c302316425e20e41b3252352b43ff9fd

memory/2344-18-0x0000000000400000-0x00000000004D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\q1.exe

MD5 406b63d114199ce9930bfc4a1a6b60dc
SHA1 babf4ee8226b7625cdf19a04c05ad4460bc3bd14
SHA256 a00aea2e9ada85124b140d294d87c1ae326eec4527f7fa65861d1b468a5c02da
SHA512 c1297a85b9b8afd2058486a7df0683a104f1087bedb6c3b67f1f33a7c2395dbe9f35b01a1a6684f50db675f6555fd391b172cfbc641373e563d2ca04a0ee50b4

C:\Users\Admin\AppData\Local\Temp\avto.exe

MD5 99dae998144126e8774b6e57497e1930
SHA1 34aed0238c911e5e9475822aec31d545ae1961e1
SHA256 81bff218030142ace3a8f4dcf9ff14f96fddccd6c821aff45798e1701b69e991
SHA512 33f3cd28ca48a0466093ce44b137097a86fe5eb499424a244db0504cad1ee95196a56c40281d2c960fa6cd4f2d65cbd4f92411ef0c582ed8d1c210726b213a56

memory/948-27-0x0000000000400000-0x0000000000479000-memory.dmp

memory/3136-31-0x0000000000400000-0x000000000047B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6_ldry3no.exe

MD5 bfc08d0dcdf0b6af01079c736be73b5e
SHA1 967c84e54168256e2ad7bb78cc35c8e7e9d5767b
SHA256 d57cff8fd945721b53c59cee9f97a69d5f6d3fb346ca0fb7066e5a740b252a3a
SHA512 cb46c1e52f8b13c416c52e41b1f26a29cb48bce461675916c109d1f43043c9dc082431644bab94b4d0f0203b88062d06baaa7c016785a5586132bc4264f9b0ee

memory/612-63-0x0000000000400000-0x0000000000417000-memory.dmp

memory/612-76-0x0000000016390000-0x00000000163A7000-memory.dmp

memory/612-92-0x00000000163B0000-0x00000000163C7000-memory.dmp

memory/2344-105-0x0000000000400000-0x00000000004D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1269190981.exe

MD5 a81cba51a8e0a4a46d2da44caeff63cd
SHA1 fbcc341075298d95e9f4685556686380b621989c
SHA256 3b671780d55eb7a8f7c3e57be194d23bc2946e39c4884296e14c5b6c81ac3ed3
SHA512 eac61ab0d9d7a6b090e03b836c3ff4dc3e11578e08791ff41c1896345b156355c8cd59ee02af63c173eaf3473f6f735f3347da209bfd50fb790e381c689d8776

memory/2400-112-0x0000000000400000-0x000000000040B000-memory.dmp

memory/612-113-0x00000000163F0000-0x0000000016407000-memory.dmp

memory/612-121-0x0000000016410000-0x0000000016427000-memory.dmp

memory/612-107-0x00000000163D0000-0x00000000163E7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1_barac.exe

MD5 69b74e9361667f788cf0f1af62e0ea75
SHA1 313c0f205615de074111851c2cb1ea5bc38a2be8
SHA256 5d6446096db3fe70e9e7f098b6bbf5bd0d1cdffbb8e487a91228ea0d9ced1c1a
SHA512 a05bff03eea90379d02a07bd3dc77a7482ce5dc1cd609744c3559c4a75d361d87ad4a979f302d27c8ca94b47bf50ea72098115c1ac3860511219e3df1369b78a

memory/612-133-0x0000000016430000-0x0000000016447000-memory.dmp

memory/3652-148-0x0000000000401000-0x000000000048E000-memory.dmp

memory/612-149-0x0000000016470000-0x0000000016487000-memory.dmp

memory/3652-147-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/612-141-0x0000000016450000-0x0000000016467000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1your_exe.exe

MD5 f11699c753aa3b403ee810d14aaa8907
SHA1 4d7c6f7564b4aa20310499c8a9cf46aa3c65560c
SHA256 7a2633419743680bc2f30216580effd93583b4f180538411aa8103e37c5dd533
SHA512 1c97cf9f98bf1e8c0cfdc62a4f140e854dfccb8655a8a8ea6592ae42141f9b70da79ae27028eb05fc41617b10fac56ef4cc3bde0574de8dbb4cd6f4be784639e

C:\Users\Admin\AppData\Local\Temp\2_load.exe

MD5 eab0da403a9f596485b4c231f24e41ab
SHA1 384c06c067e7b66935c2dba44d77ab5b2ce4b2e5
SHA256 00fdc28881dae4748fbc7f0daecf8907128deb351d1d28950b66f7ad4fa83837
SHA512 6fae3390e77303f4318778d95105e06b98b5a910a38fb85db937129947f1b98f01ed9d9156b88a18e01ca1eec0a7ac6232aadfeb8f7ff4044bac55d64f588884

C:\Users\Admin\AppData\Local\Temp\4_pinnew.exe

MD5 254363c5bc75c63a6f9fdae5aec17aa1
SHA1 2e3e3d74212fe3c91407bf059794a65417018a8c
SHA256 061908d8a76056698270a0f47089cfd5a246bec8494ebd2ca0a2d278fd790a20
SHA512 0f2b5d5ca694c2d768f43ae68adb515cdb06382282c2bea08fd2bd1cafe924f0ef4e4f20800ef5e413292b1bc29a3e5c1316c64503ee23beb2e54ded4e4b8d5e

memory/3136-58-0x0000000000400000-0x000000000047B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5_odbnsy.exe

MD5 46399ada349010e0945d6a8ba69137d3
SHA1 468efa26f445d54ba703501109159f7d85a2df51
SHA256 4b1f59a3c47e015ef50f5092539e40ffa92b5ccae88dbfec828d0d9414c33af0
SHA512 ecc847376426d21b6f610e2427578edc9e5a8e0082579a6e7b8b2b493b6904661236b47533533064020e2aca63ecc2d1e35539a5b252f7e3cfce19c2ff3a2383

memory/2344-48-0x0000000000400000-0x00000000004D0000-memory.dmp

memory/948-47-0x0000000000400000-0x0000000000479000-memory.dmp

memory/3280-46-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3652-45-0x0000000000400000-0x00000000005E0000-memory.dmp

memory/2344-38-0x0000000000400000-0x00000000004D0000-memory.dmp

memory/3652-37-0x0000000000401000-0x000000000048E000-memory.dmp

memory/612-154-0x0000000016490000-0x00000000164A7000-memory.dmp

memory/612-159-0x00000000164B0000-0x00000000164C7000-memory.dmp

memory/612-170-0x00000000164F0000-0x0000000016507000-memory.dmp

memory/744-169-0x0000000000400000-0x000000000042D000-memory.dmp

memory/612-164-0x00000000164D0000-0x00000000164E7000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HA5FC889\iolylzjjg[1].htm

MD5 45a9a2084a44d18bd0f446d6855908e4
SHA1 2b00aab2d6fd2e8fe429facce198d7093559adf1
SHA256 2ef87fbd5f3ec904bc116f3654421f4c53dc5438bbf36fa029dc8af8813f9646
SHA512 5e5d0c962cfa6faffafd32e10d1e38d90e12c184ab77d72907108b98bf73bdee685300c44ffae937203c7f74ecb8110794b542a4c3ba4831c9b3bafc77dc4d84

memory/948-337-0x0000000000400000-0x0000000000479000-memory.dmp

memory/3136-615-0x0000000000400000-0x000000000047B000-memory.dmp

memory/2344-922-0x0000000000400000-0x00000000004D0000-memory.dmp

memory/948-1079-0x0000000000400000-0x0000000000479000-memory.dmp

memory/3280-1078-0x0000000000400000-0x000000000041B000-memory.dmp