cerber | 14543e3fca12e0f56f2b88905ab0103ba4e049be8e9a12be30de38659ba8113c

Analysis

max time kernel
135s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2024 06:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe
Size

244KB
MD5

8a0c2641e45b3c5b473f69183c57cbf0
SHA1

8553f089e9d0b2eed4b7a1674ae568e4bc803db6
SHA256

14543e3fca12e0f56f2b88905ab0103ba4e049be8e9a12be30de38659ba8113c
SHA512

36dedb28aaae39019de8d45761377ae9156edece9513a4a9015f585132832049977a841ec7fee17764c0f6eda2afd2db65a369bbfa4686bc8ad09b559b5d2ae0
SSDEEP

6144:vkieBa28s1lxE2Xl9Kzh1CAyDDgHpEcHTXRnB8CteHR6+:TO8sbxE219mh1PyDDYWcRBtE

Score

10^/10

cerber discovery persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\# DECRYPT MY FILES #.txt

Family

cerber

Ransom Note

C E R B E R R A N S O M W A R E ######################################################################### Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great! You have turned to be a part of a big community "#Cerber Ransomware". ######################################################################### !!! If you are reading this message it means the software "Cerber" has !!! been removed from your computer. !!! HTML instruction ("# DECRYPT MY FILES #.html") always contains a !!! working domain of your personal page! ######################################################################### What is encryption? ------------------- Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. ######################################################################### Everything is clear for me but what should I do? ------------------------------------------------ The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !!! Any attempts to get back your files with the third-party tools can !!! be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle, but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. ######################################################################### !!! There are several plain steps to restore your files but if you do !!! not follow them we will not be able to help you, and we will not try !!! since you have read this warning already. ######################################################################### For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: 1. decrypt all your files; 2. work with your documents; 3. view your photos and other media; 4. continue your usual and comfortable work at the computer. If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. ######################################################################### There is a list of temporary addresses to go on your personal page below: _______________________________________________________________________ | | 1. http://pmenboeqhyrpvomq.0vgu64.top/B05A-9EDB-ADDA-006D-F93F | | 2. http://pmenboeqhyrpvomq.wz139z.top/B05A-9EDB-ADDA-006D-F93F | | 3. http://pmenboeqhyrpvomq.r21wmw.top/B05A-9EDB-ADDA-006D-F93F | | 4. http://pmenboeqhyrpvomq.pap44w.top/B05A-9EDB-ADDA-006D-F93F | | 5. http://pmenboeqhyrpvomq.onion.to/B05A-9EDB-ADDA-006D-F93F |_______________________________________________________________________ ######################################################################### What should you do with these addresses? ---------------------------------------- If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): 1. take a look at the first address (in this case it is http://pmenboeqhyrpvomq.0vgu64.top/B05A-9EDB-ADDA-006D-F93F); 2. select it with the mouse cursor holding the left mouse button and moving the cursor to the right; 3. release the left mouse button and press the right one; 4. select "Copy" in the appeared menu; 5. run your Internet browser (if you do not know what it is run the Internet Explorer); 6. move the mouse cursor to the address bar of the browser (this is the place where the site address is written); 7. click the right mouse button in the field where the site address is written; 8. select the button "Insert" in the appeared menu; 9. then you will see the address http://pmenboeqhyrpvomq.0vgu64.top/B05A-9EDB-ADDA-006D-F93F appeared there; 10. press ENTER; 11. the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling. If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: 1. click the left mouse button on the first address (in this case it is http://pmenboeqhyrpvomq.0vgu64.top/B05A-9EDB-ADDA-006D-F93F); 2. in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address. If for some reason the site cannot be opened check the connection to the Internet. ######################################################################### Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: 1. run your Internet browser (if you do not know what it is run the Internet Explorer); 2. enter or copy the address https://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER; 3. wait for the site loading; 4. on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed; 5. run Tor Browser; 6. connect with the button "Connect" (if you use the English version); 7. a normal Internet browser window will be opened after the initialization; 8. type or copy the address ________________________________________________________ | | | http://pmenboeqhyrpvomq.onion/B05A-9EDB-ADDA-006D-F93F | |________________________________________________________| in this browser address bar; 9. press ENTER; 10. the site should be loaded; if for some reason the site is not loading wait for a moment and try again. If you have any problems during installation or operation of Tor Browser, please, visit https://www.youtube.com/ and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. ######################################################################### Additional information: You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. ######################################################################### Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. ######################################################################### If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. ######################################################################### Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files.

URLs

http://pmenboeqhyrpvomq.0vgu64.top/B05A-9EDB-ADDA-006D-F93F

http://pmenboeqhyrpvomq.wz139z.top/B05A-9EDB-ADDA-006D-F93F

http://pmenboeqhyrpvomq.r21wmw.top/B05A-9EDB-ADDA-006D-F93F

http://pmenboeqhyrpvomq.pap44w.top/B05A-9EDB-ADDA-006D-F93F

http://pmenboeqhyrpvomq.onion.to/B05A-9EDB-ADDA-006D-F93F

http://pmenboeqhyrpvomq.onion/B05A-9EDB-ADDA-006D-F93F

Extracted

Path

C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\# DECRYPT MY FILES #.html

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Cerber Ransomware</title> <style> a { color: #47c; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #333; font-family: "Helvetica Neue", Helvetica, "Segoe UI", Arial, freesans, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; } hr { background-color: #e7e7e7; border: 0 none; border-bottom: 1px solid #c7c7c7; height: 5px; margin: 30px 0; } li { padding: 0 0 7px 7px; } ol { padding-left: 3em; } .container { background-color: #fff; border: 1px solid #c7c7c7; margin: 40px; padding: 40px 40px 20px 40px; } .info, .tor { background-color: #efe; border: 1px solid #bda; display: block; padding: 0px 20px; } .logo { font-size: 12px; font-weight: bold; line-height: 1; margin: 0; } .upd_on { color: red; display: block; } .upd_off { display: none; float: left; } .tor { padding: 10px 0; text-align: center; } .url { margin-right: 5px; } .warning { background-color: #f5e7e7; border: 1px solid #ebccd1; color: #a44; display: block; padding: 15px 10px; text-align: center; } </style> </head> <body> <div class="container"> <h3>C E R B E R   R A N S O M W A R E</h3> <hr> Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great! You have turned to be a part of a big community "#Cerber Ransomware". <hr> If you are reading this message it means the software "Cerber" has been removed from your computer. <hr> <h3>What is encryption?</h3> Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. <hr> <h3>Everything is clear for me but what should I do?</h3> The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. Any attempts to get back your files with the third-party tools can be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle, but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. <hr> There are several plain steps to restore your files but if you do not follow them we will not be able to help you, and we will not try since you have read this warning already. <hr> For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: <ol> <li>decrypt all your files;</li> <li>work with your documents;</li> <li>view your photos and other media;</li> <li>continue your usual and comfortable work at the computer.</li> </ol> If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. <hr> <div class="info"> There is a list of temporary addresses to go on your personal page below: <ol> <li>Please wait...<a class="url" href="http://pmenboeqhyrpvomq.0vgu64.top/B05A-9EDB-ADDA-006D-F93F" id="url_1" target="_blank">http://pmenboeqhyrpvomq.0vgu64.top/B05A-9EDB-ADDA-006D-F93F</a>(<a href="#updateUrl" onClick="return updateUrl();" style="color: red;">Get a NEW address!</a>)</li> <li><a href="http://pmenboeqhyrpvomq.wz139z.top/B05A-9EDB-ADDA-006D-F93F" target="_blank">http://pmenboeqhyrpvomq.wz139z.top/B05A-9EDB-ADDA-006D-F93F</a></li> <li><a href="http://pmenboeqhyrpvomq.r21wmw.top/B05A-9EDB-ADDA-006D-F93F" target="_blank">http://pmenboeqhyrpvomq.r21wmw.top/B05A-9EDB-ADDA-006D-F93F</a></li> <li><a href="http://pmenboeqhyrpvomq.pap44w.top/B05A-9EDB-ADDA-006D-F93F" target="_blank">http://pmenboeqhyrpvomq.pap44w.top/B05A-9EDB-ADDA-006D-F93F</a></li> <li><a href="http://pmenboeqhyrpvomq.onion.to/B05A-9EDB-ADDA-006D-F93F" target="_blank">http://pmenboeqhyrpvomq.onion.to/B05A-9EDB-ADDA-006D-F93F</a></li> </ol> </div> <hr> <h3>What should you do with these addresses?</h3> If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): <ol> <li>take a look at the first address (in this case it is Please wait...<a class="url" href="http://pmenboeqhyrpvomq.0vgu64.top/B05A-9EDB-ADDA-006D-F93F" id="url_2" target="_blank">http://pmenboeqhyrpvomq.0vgu64.top/B05A-9EDB-ADDA-006D-F93F</a>);</li> <li>select it with the mouse cursor holding the left mouse button and moving the cursor to the right;</li> <li>release the left mouse button and press the right one;</li> <li>select "Copy" in the appeared menu;</li> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>move the mouse cursor to the address bar of the browser (this is the place where the site address is written);</li> <li>click the right mouse button in the field where the site address is written;</li> <li>select the button "Insert" in the appeared menu;</li> <li>then you will see the address Please wait...<a class="url" href="http://pmenboeqhyrpvomq.0vgu64.top/B05A-9EDB-ADDA-006D-F93F" id="url_3" target="_blank">http://pmenboeqhyrpvomq.0vgu64.top/B05A-9EDB-ADDA-006D-F93F</a> appeared there;</li> <li>press ENTER;</li> <li>the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: <ol> <li>click the left mouse button on the first address (in this case it is Please wait...<a class="url" href="http://pmenboeqhyrpvomq.0vgu64.top/B05A-9EDB-ADDA-006D-F93F" id="url_4" target="_blank">http://pmenboeqhyrpvomq.0vgu64.top/B05A-9EDB-ADDA-006D-F93F</a>);</li> <li>in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet. <hr> Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: <ol> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>enter or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loading;</li> <li>on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>run Tor Browser;</li> <li>connect with the button "Connect" (if you use the English version);</li> <li>a normal Internet browser window will be opened after the initialization;</li> <li>type or copy the address http://pmenboeqhyrpvomq.onion/B05A-9EDB-ADDA-006D-F93F in this browser address bar;</li> <li>press ENTER;</li> <li>the site should be loaded; if for some reason the site is not loading wait for a moment and try again.</li> </ol> If you have any problems during installation or operation of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=install+tor+browser+windows" target="_blank">https://www.youtube.com/</a> and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. <hr> <h3>Additional information:</h3> You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. <hr> Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. <hr> If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. <hr> Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files. </div> <script> function getXMLHttpRequest() { if (window.XMLHttpRequest) { return new window.XMLHttpRequest; } else { try { return new ActiveXObject("MSXML2.XMLHTTP.3.0"); } catch(error) { return null; } } } function getUrlContent(url, callback) { var xhttp = getXMLHttpRequest(); if (xhttp) { xhttp.onreadystatechange = function() { if (xhttp.readyState == 4) { if (xhttp.status == 200) { return callback(xhttp.responseText.replace(/[\s ]+/gm, ""), null); } else { return callback(null, true); } } }; xhttp.open("GET", url + '?_=' + new Date().getTime(), true); xhttp.send(); } else { return callback(null, true); } } function server1(address, callback) { getUrlContent("http://btc.blockr.io/api/v1/address/txs/" + address, function(result, error) { if (!error) { var tx = /"tx":"([\w]+)","time_utc":"[\w-:]+","confirmations":[\d]+,"amount":-/.exec(result); if (tx) { getUrlContent("http://btc.blockr.io/api/v1/tx/info/" + tx[1], function(result, error) { if (!error) { var address = /"vouts":\[{"address":"([\w]+)"/.exec(result); if (address) { return callback(address[1], null); } else { return callback(null, true); } } else { return callback(null, true); } }); } else { return callback(null, true); } } else { return callback(null, true); } }); } function server2(address, callback) { getUrlContent("http://api.blockcypher.com/v1/btc/main/addrs/" + address, function(result, error) { if (!error) { var tx = /"tx_hash":"([\w]+)","block_height":[\d]+,"tx_input_n":[\d-]+,"tx_output_n":-/.exec(result); if (tx) { getUrlContent("http://api.blockcypher.com/v1/btc/main/txs/" + tx[1], function(result, error) { if (!error) { var address = /"outputs":\[{"value":[\d]+,"script":"[\w]+","spent_by":"[\w]+","addresses":\["([\w]+)"/.exec(result); if (address) { return callback(address[1], null); } else { return callback(null, true); } } else { return callback(null, true); } }); } else { return callback(null, true); } } else { return callback(null, true);

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber
Cerber family
cerber

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\\mavinject.exe\""	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\\mavinject.exe\""	mavinject.exe

Contacts a large (531) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	mavinject.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\mavinject.lnk	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe

Executes dropped EXE 4 IoCs

pid	Process
2036	mavinject.exe
704	mavinject.exe
3052	mavinject.exe
1036	mavinject.exe

Loads dropped DLL 9 IoCs

pid	Process
4712	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe
4712	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe
4712	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe
2036	mavinject.exe
2036	mavinject.exe
2036	mavinject.exe
3052	mavinject.exe
3052	mavinject.exe
3052	mavinject.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mavinject = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\\mavinject.exe\""	mavinject.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mavinject = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\\mavinject.exe\""	mavinject.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mavinject = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\\mavinject.exe\""	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mavinject = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\\mavinject.exe\""	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
27	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp7352.bmp"	mavinject.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4712 set thread context of 3136	4712	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe	87
PID 2036 set thread context of 704	2036	mavinject.exe	104
PID 3052 set thread context of 1036	3052	mavinject.exe	112

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\PLANNERS.ONE	mavinject.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\# DECRYPT MY FILES #.txt	mavinject.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-PipelineConfig.xml	mavinject.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\# DECRYPT MY FILES #.url	mavinject.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-manifest.ini	mavinject.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\# DECRYPT MY FILES #.vbs	mavinject.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\BUSINESS.ONE	mavinject.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\BLANK.ONE	mavinject.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\# DECRYPT MY FILES #.html	mavinject.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\# DECRYPT MY FILES #.txt	mavinject.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote.ini	mavinject.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\# DECRYPT MY FILES #.url	mavinject.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\# DECRYPT MY FILES #.html	mavinject.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\DESIGNER.ONE	mavinject.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\ACADEMIC.ONE	mavinject.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\# DECRYPT MY FILES #.vbs	mavinject.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\	mavinject.exe
File opened for modification	C:\Windows\forefinger	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe
File opened for modification	C:\Windows\	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe
File opened for modification	C:\Windows\forefinger	mavinject.exe
File opened for modification	C:\Windows\	mavinject.exe
File opened for modification	C:\Windows\forefinger	mavinject.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mavinject.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mavinject.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mavinject.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1288	cmd.exe
4676	PING.EXE
5788	cmd.exe
5996	PING.EXE

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x000a000000023b91-39.dat	nsis_installer_1
behavioral2/files/0x000a000000023b91-39.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
4760	taskkill.exe
5580	taskkill.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\\mavinject.exe\""	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop	mavinject.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\\mavinject.exe\""	mavinject.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	mavinject.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4676	PING.EXE
5996	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe
704	mavinject.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3136	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe
Token: SeDebugPrivilege	4760	taskkill.exe
Token: SeDebugPrivilege	704	mavinject.exe
Token: SeDebugPrivilege	1036	mavinject.exe
Token: 33	5888	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5888	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 3136	4712	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe	87
PID 4712 wrote to memory of 3136	4712	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe	87
PID 4712 wrote to memory of 3136	4712	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe	87
PID 4712 wrote to memory of 3136	4712	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe	87
PID 4712 wrote to memory of 3136	4712	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe	87
PID 4712 wrote to memory of 3136	4712	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe	87
PID 4712 wrote to memory of 3136	4712	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe	87
PID 4712 wrote to memory of 3136	4712	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe	87
PID 4712 wrote to memory of 3136	4712	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe	87
PID 4712 wrote to memory of 3136	4712	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe	87
PID 4712 wrote to memory of 3136	4712	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe	87
PID 3136 wrote to memory of 2036	3136	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe	99
PID 3136 wrote to memory of 2036	3136	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe	99
PID 3136 wrote to memory of 2036	3136	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe	99
PID 3136 wrote to memory of 1288	3136	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe	100
PID 3136 wrote to memory of 1288	3136	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe	100
PID 3136 wrote to memory of 1288	3136	8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe	100
PID 1288 wrote to memory of 4760	1288	cmd.exe	102
PID 1288 wrote to memory of 4760	1288	cmd.exe	102
PID 1288 wrote to memory of 4760	1288	cmd.exe	102
PID 1288 wrote to memory of 4676	1288	cmd.exe	103
PID 1288 wrote to memory of 4676	1288	cmd.exe	103
PID 1288 wrote to memory of 4676	1288	cmd.exe	103
PID 2036 wrote to memory of 704	2036	mavinject.exe	104
PID 2036 wrote to memory of 704	2036	mavinject.exe	104
PID 2036 wrote to memory of 704	2036	mavinject.exe	104
PID 2036 wrote to memory of 704	2036	mavinject.exe	104
PID 2036 wrote to memory of 704	2036	mavinject.exe	104
PID 2036 wrote to memory of 704	2036	mavinject.exe	104
PID 2036 wrote to memory of 704	2036	mavinject.exe	104
PID 2036 wrote to memory of 704	2036	mavinject.exe	104
PID 2036 wrote to memory of 704	2036	mavinject.exe	104
PID 2036 wrote to memory of 704	2036	mavinject.exe	104
PID 2036 wrote to memory of 704	2036	mavinject.exe	104
PID 3052 wrote to memory of 1036	3052	mavinject.exe	112
PID 3052 wrote to memory of 1036	3052	mavinject.exe	112
PID 3052 wrote to memory of 1036	3052	mavinject.exe	112
PID 3052 wrote to memory of 1036	3052	mavinject.exe	112
PID 3052 wrote to memory of 1036	3052	mavinject.exe	112
PID 3052 wrote to memory of 1036	3052	mavinject.exe	112
PID 3052 wrote to memory of 1036	3052	mavinject.exe	112
PID 3052 wrote to memory of 1036	3052	mavinject.exe	112
PID 3052 wrote to memory of 1036	3052	mavinject.exe	112
PID 3052 wrote to memory of 1036	3052	mavinject.exe	112
PID 3052 wrote to memory of 1036	3052	mavinject.exe	112
PID 704 wrote to memory of 3412	704	mavinject.exe	122
PID 704 wrote to memory of 3412	704	mavinject.exe	122
PID 3412 wrote to memory of 4588	3412	msedge.exe	123
PID 3412 wrote to memory of 4588	3412	msedge.exe	123
PID 704 wrote to memory of 2120	704	mavinject.exe	124
PID 704 wrote to memory of 2120	704	mavinject.exe	124
PID 3412 wrote to memory of 2796	3412	msedge.exe	126
PID 3412 wrote to memory of 2796	3412	msedge.exe	126
PID 3412 wrote to memory of 2796	3412	msedge.exe	126
PID 3412 wrote to memory of 2796	3412	msedge.exe	126
PID 3412 wrote to memory of 2796	3412	msedge.exe	126
PID 3412 wrote to memory of 2796	3412	msedge.exe	126
PID 3412 wrote to memory of 2796	3412	msedge.exe	126
PID 3412 wrote to memory of 2796	3412	msedge.exe	126
PID 3412 wrote to memory of 2796	3412	msedge.exe	126
PID 3412 wrote to memory of 2796	3412	msedge.exe	126
PID 3412 wrote to memory of 2796	3412	msedge.exe	126
PID 3412 wrote to memory of 2796	3412	msedge.exe	126
PID 3412 wrote to memory of 2796	3412	msedge.exe	126

C:\Users\Admin\AppData\Local\Temp\8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Users\Admin\AppData\Local\Temp\8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe"
  2⤵
  - Adds policy Run key to start application
  - Drops startup file
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3136
- - C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mavinject.exe
    "C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mavinject.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mavinject.exe
      "C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mavinject.exe"
      4⤵
      Adds policy Run key to start application
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Sets desktop wallpaper using registry
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies Control Panel
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3412
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcccbc46f8,0x7ffcccbc4708,0x7ffcccbc4718
        6⤵
        
        PID:4588
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2726390498384511929,11156293502494979652,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
        6⤵
        
        PID:2796
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,2726390498384511929,11156293502494979652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
        6⤵
        
        PID:4300
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,2726390498384511929,11156293502494979652,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
        6⤵
        
        PID:4204
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2726390498384511929,11156293502494979652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
        6⤵
        
        PID:5812
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2726390498384511929,11156293502494979652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
        6⤵
        
        PID:5320
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2726390498384511929,11156293502494979652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
        6⤵
        
        PID:1312
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2726390498384511929,11156293502494979652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
        6⤵
        
        PID:5512
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2726390498384511929,11156293502494979652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
        6⤵
        
        PID:668
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2726390498384511929,11156293502494979652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
        6⤵
        
        PID:5124
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2726390498384511929,11156293502494979652,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
        6⤵
        
        PID:5128
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,2726390498384511929,11156293502494979652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5896 /prefetch:8
        6⤵
        
        PID:5152
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,2726390498384511929,11156293502494979652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5896 /prefetch:8
        6⤵
        
        PID:4024
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2726390498384511929,11156293502494979652,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
        6⤵
        
        PID:1296
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2726390498384511929,11156293502494979652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
        6⤵
        
        PID:4792
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt
        5⤵
        
        PID:2120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pmenboeqhyrpvomq.0vgu64.top/B05A-9EDB-ADDA-006D-F93F?auto
        5⤵
        
        PID:4696
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcccbc46f8,0x7ffcccbc4708,0x7ffcccbc4718
        6⤵
        
        PID:5296
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"
        5⤵
        
        PID:1272
    - - C:\Windows\system32\cmd.exe
        
        /d /c taskkill /t /f /im "mavinject.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mavinject.exe" > NUL
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5788
      - C:\Windows\system32\taskkill.exe
        
        taskkill /t /f /im "mavinject.exe"
        6⤵
        Kills process with taskkill
        
        PID:5580
      - C:\Windows\system32\PING.EXE
        
        ping -n 1 127.0.0.1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5996
- - C:\Windows\SysWOW64\cmd.exe
    /d /c taskkill /t /f /im "8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe" > NUL
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /t /f /im "8a0c2641e45b3c5b473f69183c57cbf0_JaffaCakes118.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4760
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4676

C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mavinject.exe
C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mavinject.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mavinject.exe
  C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mavinject.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3428

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x494 0x3f0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\# DECRYPT MY FILES #.html

Filesize
19KB

MD5
b2f22a36e3648aaa5e846a9b4ee93fd8

SHA1
c17875dd9d1f7b66404409206d4342ea46abf6b9

SHA256
6bb09fd62008712483f0baded6e4ee91f3e7c7fd19eda225c91d964ed9d7e29d

SHA512
f2030bdc502b38de15e53bf77d3b25f86f43c663eddf8fa7eea53a4a0c37be8351825046b75485fa98f4cdad5deac868e13994d23bb7046a1ae071bf6cc274cc

Download Submit
C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\# DECRYPT MY FILES #.txt

Filesize
10KB

MD5
8c032868f611c04bac1d32651dc4aa6a

SHA1
cbbb483168bf848f7c293b11d2c80cf42418ce7c

SHA256
4a373dc222b26b2f44ef06237e69fcc51de042092a591e7942197d10cc1ebb2e

SHA512
6ca9950347e0dd340594aac349ddf0eec33e1d9f6f858fecb3471089cae70bfa8677195d3a72f50f95091137fce6c6105d4bd01ea1c5b4c02f5002b2b1cc403f

Download Submit
C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\# DECRYPT MY FILES #.url

Filesize
90B

MD5
faec2de58d7ce89f3d4a425e401218dc

SHA1
06bbb70f77bd84b6f47c8ccbf8aae91955b0ceb5

SHA256
b762e3a90f26c7262e15fc4f937d1ad9e35f97f65e40d5381100cdcee2e9eb16

SHA512
7ec42ba0e6ff6d8477ce9b526a0e3312e4610613025944423ffc5a2046eb93f6ffcd965f287b586dec27350a6164bceb27debb4598058ea9bd2021a5744936bf

Download Submit
C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\# DECRYPT MY FILES #.vbs

Filesize
213B

MD5
1c2a24505278e661eca32666d4311ce5

SHA1
d1deb57023bbe38a33f0894b6a9a7bbffbfdeeee

SHA256
3f0dc6126cf33e7aa725df926a1b7d434eaf62a69f42e1b8ae4c110fd3572628

SHA512
ce866f2c4b96c6c7c090f4bf1708bfebdfcd58ce65a23bdc124a13402ef4941377c7e286e6156a28bd229e422685454052382f1f532545bc2edf07be4861b36c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0c45633be518e42b54cbd81a63905475

SHA1
ed7b2d7d7fd23f8c716458ce9645f5bc538b6c50

SHA256
c8d90a0b52c4eeccbc24ffcc1bf49cab09c29bae84ccc8cb57872e42eec3d778

SHA512
6144e7ff27e1c2d7d2725d252738e2d1efab52981d690174c55c73623b61cd4f7440d84b9196ff0b1ac09f57a58e50f792f5a7d7a6dea940fcbc87cd529bdbc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9b347f7a7d577eb219a59d05e7f96e8d

SHA1
3f19b1fdf0465bd991e59fa7db1db7f31035bb3e

SHA256
b177e7cd2878e2adb9c9f609897e4d6f75f8c61600cf351552cca8eab513c267

SHA512
ea53bdf7594fb2603244f4d03bf93bad1a449cab262a3a6793feda548ecacdb6b794bba809ea52257296464b37dc3a5033565ef5df6b7cb0320a1b26975880b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3e665f1712a53bca240e38b8ff6f20ec

SHA1
a17cfbe6fcd4d704c136fb9d3d9eef88816ad040

SHA256
b18be168ba0fde8487fbc18c7a30bf1dcd272c93749b71a60fd292b535b50928

SHA512
f1e7af4c0b94c39cc953d2d66e1d6766515efb26a15ce4378b621585f5fa86bfc81a4da872c64bf9fe572937efb46938e347f343b55ba03a6c2f1626815dd239

Download Submit
C:\Users\Admin\AppData\Local\Temp\3BSYBS1-DCSA_Alerts_05242015040017.xml

Filesize
922B

MD5
b327f714f4ca746733f335129136f01e

SHA1
9e73ebaf229d43dba61da0fba7392039d99cde0b

SHA256
e1fa52366cfb7518c1269a6d52de74b567a0c352a141725a7f35abca022dee1b

SHA512
86cd7acd2e692ddd4f07073b973b4ff18cc4d31faff54d320a8421eeb265059279f7c28a22112e23cee03e1d2cb37b9a1a329a2b21df7d89acfe9a842c320d69

Download Submit
C:\Users\Admin\AppData\Local\Temp\AgendumSpontoon.B

Filesize
4KB

MD5
3a55f29d68c69ba9d51ba990c1826c00

SHA1
2ef1871466f55111c8c3e2d65e5f684b48ea30fa

SHA256
dd2792ec4cebb647c5b4b7775c78862cecc42d87d72492642183a5f4b26ece19

SHA512
6904e53751209bf12d19a04859be41fe19a7e58a88d41e24edd083a661884ff303956be9c22af94d422c8786e2dc1a624a4eace3d93c6d0ae838d2194c37c84c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bissau

Filesize
77B

MD5
4ab96999f28ba4b075188be03072b6dd

SHA1
2a1293003921b5bd6f4751f02d27090293d12245

SHA256
c9d43500b918ad58d7cc10cc98f73b0fd8de3743074b9c9b38f3f8657ab3cd3d

SHA512
1ee024ceadae616900cc460b9210bde8c799e9e10229312fccd039fbc0f9c114d3ad148e3f120d25356e9ca7c07be69cea4aad7e28fe892f69809b8bc7390f38

Download Submit
C:\Users\Admin\AppData\Local\Temp\GMT+1

Filesize
27B

MD5
17534ee83a92a2d70abce2aa260abe12

SHA1
aab0ac99816678115277832badc6ee7ffa690b43

SHA256
53141538145b0c46ed3eb1f8dbdc1d8badb1061cfe6865232fee384bcb4d0b91

SHA512
ddbb134b0d53df5c1872930cd8108a5fbaf6d1dd850987303d1a6a7faf7653a71ac0008798f0e30e360d3d82d475b24ddfd5d8e0e088528fa9580dc8ab6c032f

Download Submit
C:\Users\Admin\AppData\Local\Temp\GMT-12

Filesize
27B

MD5
aea56e4cc048a9d3ff31445372d346a1

SHA1
29ac5ffe91a926df97e1a3e04a0c76a22a6f5c8b

SHA256
500ebdba5c37298efc86410f21dda65d2c0e59771605cd647694879de03533fa

SHA512
15d93c0e845eeaa4d010077a0032c4dc765f71895089b3c04a2bd6315373e43ca473e65caefa8927a973a664093d585c58295ed7ad708cb20f9b8452de317920

Download Submit
C:\Users\Admin\AppData\Local\Temp\Intelligentsia.H

Filesize
148KB

MD5
705eb958cf1355f374f8f081ef0d63e0

SHA1
c1668f3b82647b3193c144c97b51b651a9265979

SHA256
f7279b4d4e75835d0e72a32363135f1cd5d9234eb72d15f930523b61c4bb738d

SHA512
0ea24b3bf10035dac53f7d558ce8ab8f89ce7e72fc1b078cf687734d9bc66d4b4e01718727812068e59e562fc175be50d49b9ae98266e91bc5324a9c66e09f3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pwgen.dll

Filesize
34KB

MD5
eab0c0a99549fe4fc568b20331d1db27

SHA1
4cc1a151bf4ef04be4c41278e42f11dd44f937c6

SHA256
246696d31993da811c210de7455d9158d0f4e0e3f75ef4367a1fb43c7fe27764

SHA512
094d6a63af23ae2ca54dfaf4ce59ae9c266c7de34e60828e4c5f636ab256be17da99061ce2965b99c4cce7a58f4f0c05ab09d38dcd0c2aba31d8b26d70ae7d55

Download Submit
C:\Users\Admin\AppData\Local\Temp\_.js

Filesize
1KB

MD5
70a12429f0b20c26d121a2538099aca4

SHA1
e6796ed228fa4691314bc99c2754a8d76512d1a8

SHA256
0e86911736d8eec310a61888c9a2e954d4c95814514b4256af2802a55a1df779

SHA512
f225b2cb7fd132a8437dd758f79bf8a2b5d2575798412337be9f8a9afca1cea807a769aa1a07d30fc44ba0d3208ae666ca4debfbac56328a491d50e24c866f26

Download Submit
C:\Users\Admin\AppData\Local\Temp\api-doc.xml

Filesize
3KB

MD5
122a8a2fa7fcb0dd3fc16f837feac89c

SHA1
81abf451ed1adb6951d8c0b067bf53047cf59480

SHA256
ca3cc76ac417d68ac6fc56022e5c0225a54e04ed05ee66acb01be6eaacc8de57

SHA512
aa5c44fd4f596c5233b96eb7874b3cd7a395af61479ecb5c7bd5d4a84c3a104c06754dd718d4fe3b31efa0f506789523f7278ad77e355de7001583b50f4bc0a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\blocks2dbk.dtd

Filesize
2KB

MD5
411d77c4da856563aba36bcbacc83879

SHA1
868e7e0ff63120a2dafb22e036d066dc6ade0ed3

SHA256
1e2333b01209da29895e2f51fc836996bd61f42a61c00a613d663c628e173e19

SHA512
0d10206144f681be4b5b9de9973b69752e04d8ec61c82bf19461e8076ed42e25a89c5915c92a8e6bd534fc97ac51d4382dc5327764b45e7119229afa58b438b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\bn_IN.aff

Filesize
197B

MD5
6c0fb6fd9810560e7b438cdf662c2734

SHA1
26304263ffc6724e5bd5a0dc440d74f233bc2fa2

SHA256
bff0a0f00c9adb0ac7bcc8421882b4bcd0fb5b47d278ed64cd661ec7dce51cde

SHA512
d85b9b780ef0ecac44e9af6ca0c766c04dcbc22cf3bf65efd23395806042d8cdadebbe088d21a0be75b37b2c6ddeb7aa726483c9b139d4284ef6b51101ca8c8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\clock.png

Filesize
2KB

MD5
4cb40bdad1a43c4fb89f7b4400076efc

SHA1
ab2a3689957a412dbd3cd7f83e5aa35d44055941

SHA256
1bb2e1d63f0787ad9a0e0ad8b3987c42f74d873211f440e6338f78bfa62d4ee0

SHA512
0e444c130721fa155e28af88b21c0badced98ea2f1fd0df915cf07e4cf4b6d364e24a5babff81ad3246c5839595df520dc3e4d9a13635903f0e5ab4dc795a840

Download Submit
C:\Users\Admin\AppData\Local\Temp\close_focus.png

Filesize
2KB

MD5
440ff2d813de32dce6a8eac522c6e69b

SHA1
0fc65a6d0eb99abecc95579307d0d9b35c8267a1

SHA256
4af8f0f40f8d0470bca784bf1f5401acc268f06d9c8b25650cc92f65c78826e5

SHA512
66ac4515c6a12bd8707e019da569b6edbb76b82cd48b2a4dcfbe21dcc1f9b36a7d961c6faf3c7c4737ae165fcab3fee2b947d751ff98683613c5236f1d14f502

Download Submit
C:\Users\Admin\AppData\Local\Temp\close_normal.png

Filesize
2KB

MD5
e61986880dbf11a3f9c9e73ba1a5f821

SHA1
7ba2b4bc224e0f135b165ee164783513d791ebc4

SHA256
15abed0f08ce04c57be1b84c3b76eeaa86cd4a7079896f20c652035246a23e06

SHA512
eb707225978681ab2a2c70a7ce4f47a88c743e15bad91103dc96afb8951e8355b8cffdff7b2de1c26b661a35735740891cc64ecdb98de0c9ebd797de2b102a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\dut.fca

Filesize
1KB

MD5
61bb87909569420e9d889bd076a11aef

SHA1
668909823ee96cd46b76ffb4aba97e2335dd65da

SHA256
386b26bffa39406bea409f57f8d332a590856554373b073b7b5b340d5e68eaca

SHA512
fc873eb58c1a25f830ff3571b863c0da371f751d75052d3e77d1b94bb5ccead606ca19aaa73621467bbbc86aef817cfb9c9150f04af18f1c87846fc31f81f03d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp79D5.tmp\System.dll

Filesize
11KB

MD5
6f5257c0b8c0ef4d440f4f4fce85fb1b

SHA1
b6ac111dfb0d1fc75ad09c56bde7830232395785

SHA256
b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1

SHA512
a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\mavinject.lnk

Filesize
1KB

MD5
32c817e56bc8e1007861fc2da6ff6ea3

SHA1
5b26ce23ec10108049f2b1d4df71264c7aea8123

SHA256
30ad886f3c8ff7a98ef31d67705449fa144372b46a084b0357883791f846035b

SHA512
0e9375f7246bc0372de5937b64aaf7ff1e22bee1323995794564ccfe007b516a12c55dc47928fb52ccab01b3f337edbf4fc39965992e05207746e4f647fa52ab

Download Submit
C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mavinject.exe

Filesize
244KB

MD5
8a0c2641e45b3c5b473f69183c57cbf0

SHA1
8553f089e9d0b2eed4b7a1674ae568e4bc803db6

SHA256
14543e3fca12e0f56f2b88905ab0103ba4e049be8e9a12be30de38659ba8113c

SHA512
36dedb28aaae39019de8d45761377ae9156edece9513a4a9015f585132832049977a841ec7fee17764c0f6eda2afd2db65a369bbfa4686bc8ad09b559b5d2ae0

Download Submit
memory/704-96-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/704-933-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/704-94-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/704-92-0x0000000003780000-0x0000000003781000-memory.dmp

Filesize
4KB

Download
memory/704-939-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/704-942-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/704-945-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/704-151-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/704-154-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/704-153-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/704-90-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/704-89-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/704-948-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/704-951-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/704-314-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/704-927-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/704-930-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/704-95-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/704-924-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/704-921-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/704-936-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/704-957-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/704-963-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/704-960-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/704-954-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1036-148-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1036-147-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2036-83-0x0000000002210000-0x000000000221C000-memory.dmp

Filesize
48KB

Download
memory/3052-140-0x0000000002200000-0x000000000220C000-memory.dmp

Filesize
48KB

Download
memory/3136-41-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3136-33-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3136-32-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3136-31-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3136-30-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3136-28-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4712-24-0x0000000002860000-0x000000000286C000-memory.dmp

Filesize
48KB

Download