cerber | 0d2598069781ff01982d4e4c3cd7e15320be92cf0607e24af73d55d64ffa60f6

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
05-12-2024 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe
Size

222KB
MD5

c7e77a8a2bddb15c701032fd3d2a9e4b
SHA1

c2a4dc1f7ac018da4c364799209d9c6fea17d994
SHA256

0d2598069781ff01982d4e4c3cd7e15320be92cf0607e24af73d55d64ffa60f6
SHA512

3991e20ea1cf9c14a7ce148ef1efad558cb89228c324a32eb016687b9eb661eb39b551e1a4dbb1f65fc28be7b7ad845b020b173e269a4091bc399464430b8142
SSDEEP

3072:YM+9i7SFCIXJZb45x9c/Tui1CRvtbp6tTzYoy1khbgEN5oA+6BMlTH+vckm+PDJg:YMTCPbKOui1ivcTEoTtBXm+Pc0Cpj

Score

10^/10

cerber defense_evasion discovery evasion execution impact ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\Users\Admin\Music\# HELP DECRYPT #.txt

Ransom Note

C_E_R_B_E_R R_A_N_S_O_M_W_A_R_E ######################################################################### Cannot you find the files you need? Is the content of the files that you looked for not readable??? It is normal because the files' names, as well as the data in your files have been encrypted. Great! You have turned to be a part of a big community "#Cerb3r Ransomware". ######################################################################### !!! If you are reading this message it means the software "Cerber" has !!! been removed from your computer. !!! HTML instruction ("# DECRYPT MY FILES #.html") always contains a !!! working domain of your personal page! ######################################################################### What is encryption? ------------------- Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. ######################################################################### Everything is clear for me but what should I do? ------------------------------------------------ The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !!! Any attempts to return your files with the third-party tools can !!! be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle, but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. ######################################################################### !!! There are several plain steps to restore your files but if you do !!! not follow them we will not be able to help you, and we will not try !!! since you have read this warning already. ######################################################################### For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: 1. decrypt all your files; 2. work with your documents; 3. view your photos and other media; 4. continue your usual and comfortable work at the computer. If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. ######################################################################### There is a list of temporary addresses to go on your personal page below: _______________________________________________________________________ | | 1. http://wjtqjleommc4z46i.nxmu0x.bid/7660-2DE6-2204-0046-1540 | | 2. http://wjtqjleommc4z46i.whmykv.bid/7660-2DE6-2204-0046-1540 | | 3. http://wjtqjleommc4z46i.cm5ohx.bid/7660-2DE6-2204-0046-1540 | | 4. http://wjtqjleommc4z46i.gg4dgp.bid/7660-2DE6-2204-0046-1540 | | 5. http://wjtqjleommc4z46i.onion.to/7660-2DE6-2204-0046-1540 |_______________________________________________________________________ ######################################################################### What should you do with these addresses? ---------------------------------------- If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): 1. take a look at the first address (in this case it is http://wjtqjleommc4z46i.nxmu0x.bid/7660-2DE6-2204-0046-1540); 2. select it with the mouse cursor holding the left mouse button and moving the cursor to the right; 3. release the left mouse button and press the right one; 4. select "Copy" in the appeared menu; 5. run your Internet browser (if you do not know what it is run the Internet Explorer); 6. move the mouse cursor to the address bar of the browser (this is the place where the site address is written); 7. click the right mouse button in the field where the site address is written; 8. select the button "Insert" in the appeared menu; 9. then you will see the address http://wjtqjleommc4z46i.nxmu0x.bid/7660-2DE6-2204-0046-1540 appeared there; 10. press ENTER; 11. the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling. If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: 1. click the left mouse button on the first address (in this case it is http://wjtqjleommc4z46i.nxmu0x.bid/7660-2DE6-2204-0046-1540); 2. in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address. If for some reason the site cannot be opened check the connection to the Internet. ######################################################################### Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: 1. run your Internet browser (if you do not know what it is run the Internet Explorer); 2. enter or copy the address https://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER; 3. wait for the site loading; 4. on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed; 5. run Tor Browser; 6. connect with the button "Connect" (if you use the English version); 7. a normal Internet browser window will be opened after the initialization; 8. type or copy the address ________________________________________________________ | | | http://wjtqjleommc4z46i.onion/7660-2DE6-2204-0046-1540 | |________________________________________________________| in this browser address bar; 9. press ENTER; 10. the site should be loaded; if for some reason the site is not loading wait for a moment and try again. If you have any problems during installation or operation of Tor Browser, please, visit https://www.youtube.com/ and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. ######################################################################### Additional information: You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. ######################################################################### Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. ######################################################################### If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. ######################################################################### Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files.

URLs

http://wjtqjleommc4z46i.nxmu0x.bid/7660-2DE6-2204-0046-1540

http://wjtqjleommc4z46i.whmykv.bid/7660-2DE6-2204-0046-1540

http://wjtqjleommc4z46i.cm5ohx.bid/7660-2DE6-2204-0046-1540

http://wjtqjleommc4z46i.gg4dgp.bid/7660-2DE6-2204-0046-1540

http://wjtqjleommc4z46i.onion.to/7660-2DE6-2204-0046-1540

http://wjtqjleommc4z46i.onion/7660-2DE6-2204-0046-1540

Extracted

Path

C:\Users\Admin\Music\# HELP DECRYPT #.html

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Cerber Ransomware</title> <style> a { color: #47c; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #333; font-family: "Helvetica Neue", Helvetica, "Segoe UI", Arial, freesans, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; } hr { background-color: #e7e7e7; border: 0 none; border-bottom: 1px solid #c7c7c7; height: 5px; margin: 30px 0; } li { padding: 0 0 7px 7px; } ol { padding-left: 3em; } .container { background-color: #fff; border: 1px solid #c7c7c7; margin: 40px; padding: 40px 40px 20px 40px; } .info, .tor { background-color: #efe; border: 1px solid #bda; display: block; padding: 0px 20px; } .logo { font-size: 12px; font-weight: bold; line-height: 1; margin: 0; } .upd_on { color: red; display: block; } .upd_off { display: none; float: left; } .tor { padding: 10px 0; text-align: center; } .url { margin-right: 5px; } .warning { background-color: #f5e7e7; border: 1px solid #ebccd1; color: #a44; display: block; padding: 15px 10px; text-align: center; } </style> </head> <body> <div class="container"> <h3>C E R B E R   R A N S O M W A R E</h3> <hr> Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great! You have turned to be a part of a big community "#C3rber Ransomware". <hr> If you are reading this message it means the software "Cerber" has been removed from your computer. <hr> <h3>What is encryption?</h3> Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. <hr> <h3>Everything is clear for me but what should I do?</h3> The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !Any attempts to get back your files with the third-party tools can be fatal for your encrypted files! The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files! When you make a puzzle, but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. <hr> There are several plain steps to restore your files but if you do not follow them we will not be able to help you, and we will not try since you have read this warning already. <hr> For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: <ol> <li>decrypt all your files;</li> <li>work with your documents;</li> <li>view your photos and other media;</li> <li>continue your usual and comfortable work at the computer.</li> </ol> If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. <hr> <div class="info"> There is a list of temporary addresses to go on your personal page below: <ol> <li>Please wait...<a class="url" href="http://wjtqjleommc4z46i.nxmu0x.bid/7660-2DE6-2204-0046-1540" id="url_1" target="_blank">http://wjtqjleommc4z46i.nxmu0x.bid/7660-2DE6-2204-0046-1540</a>(<a href="#updateUrl" onClick="return updateUrl();" style="color: red;">Get a NEW address!</a>)</li> <li><a href="http://wjtqjleommc4z46i.whmykv.bid/7660-2DE6-2204-0046-1540" target="_blank">http://wjtqjleommc4z46i.whmykv.bid/7660-2DE6-2204-0046-1540</a></li> <li><a href="http://wjtqjleommc4z46i.cm5ohx.bid/7660-2DE6-2204-0046-1540" target="_blank">http://wjtqjleommc4z46i.cm5ohx.bid/7660-2DE6-2204-0046-1540</a></li> <li><a href="http://wjtqjleommc4z46i.gg4dgp.bid/7660-2DE6-2204-0046-1540" target="_blank">http://wjtqjleommc4z46i.gg4dgp.bid/7660-2DE6-2204-0046-1540</a></li> <li><a href="http://wjtqjleommc4z46i.onion.to/7660-2DE6-2204-0046-1540" target="_blank">http://wjtqjleommc4z46i.onion.to/7660-2DE6-2204-0046-1540</a></li> </ol> </div> <hr> <h3>What should you do with these addresses?</h3> If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): <ol> <li>take a look at the first address (in this case it is Please wait...<a class="url" href="http://wjtqjleommc4z46i.nxmu0x.bid/7660-2DE6-2204-0046-1540" id="url_2" target="_blank">http://wjtqjleommc4z46i.nxmu0x.bid/7660-2DE6-2204-0046-1540</a>);</li> <li>select it with the mouse cursor holding the left mouse button and moving the cursor to the right;</li> <li>release the left mouse button and press the right one;</li> <li>select "Copy" in the appeared menu;</li> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>move the mouse cursor to the address bar of the browser (this is the place where the site address is written);</li> <li>click the right mouse button in the field where the site address is written;</li> <li>select the button "Insert" in the appeared menu;</li> <li>then you will see the address Please wait...<a class="url" href="http://wjtqjleommc4z46i.nxmu0x.bid/7660-2DE6-2204-0046-1540" id="url_3" target="_blank">http://wjtqjleommc4z46i.nxmu0x.bid/7660-2DE6-2204-0046-1540</a> appeared there;</li> <li>press ENTER;</li> <li>the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: <ol> <li>click the left mouse button on the first address (in this case it is Please wait...<a class="url" href="http://wjtqjleommc4z46i.nxmu0x.bid/7660-2DE6-2204-0046-1540" id="url_4" target="_blank">http://wjtqjleommc4z46i.nxmu0x.bid/7660-2DE6-2204-0046-1540</a>);</li> <li>in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet. <hr> Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: <ol> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>enter or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loading;</li> <li>on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>run Tor Browser;</li> <li>connect with the button "Connect" (if you use the English version);</li> <li>a normal Internet browser window will be opened after the initialization;</li> <li>type or copy the address http://wjtqjleommc4z46i.onion/7660-2DE6-2204-0046-1540 in this browser address bar;</li> <li>press ENTER;</li> <li>the site should be loaded; if for some reason the site is not loading wait for a moment and try again.</li> </ol> If you have any problems during installation or operation of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=install+tor+browser+windows" target="_blank">https://www.youtube.com/</a> and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. <hr> <h3>Additional information:</h3> You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. <hr> Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. <hr> If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. <hr> Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files. </div> <script> function getXMLHttpRequest() { if (window.XMLHttpRequest) { return new window.XMLHttpRequest; } else { try { return new ActiveXObject("MSXML2.XMLHTTP.3.0"); } catch(error) { return null; } } } function getUrlContent(url, callback) { var xhttp = getXMLHttpRequest(); if (xhttp) { xhttp.onreadystatechange = function() { if (xhttp.readyState == 4) { if (xhttp.status == 200) { return callback(xhttp.responseText.replace(/[\s ]+/gm, ""), null); } else { return callback(null, true); } } }; xhttp.open("GET", url + '?_=' + new Date().getTime(), true); xhttp.send(); } else { return callback(null, true); } } function server1(address, callback) { getUrlContent("http://btc.blockr.io/api/v1/address/txs/" + address, function(result, error) { if (!error) { var tx = /"tx":"([\w]+)","time_utc":"[\w-:]+","confirmations":[\d]+,"amount":-/.exec(result); if (tx) { getUrlContent("http://btc.blockr.io/api/v1/tx/info/" + tx[1], function(result, error) { if (!error) { var address = /"vouts":\[{"address":"([\w]+)"/.exec(result); if (address) { return callback(address[1], null); } else { return callback(null, true); } } else { return callback(null, true); } }); } else { return callback(null, true); } } else { return callback(null, true); } }); } function server2(address, callback) { getUrlContent("http://api.blockcypher.com/v1/btc/main/addrs/" + address, function(result, error) { if (!error) { var tx = /"tx_hash":"([\w]+)","block_height":[\d]+,"tx_input_n":[\d-]+,"tx_output_n":-/.exec(result); if (tx) { getUrlContent("http://api.blockcypher.com/v1/btc/main/txs/" + tx[1], function(result, error) { if (!error) { var address = /"outputs":\[{"value":[\d]+,"script":"[\w]+","spent_by":"[\w]+","addresses":\["([\w]+)"/.exec(result); if (address) { return callback(address[1], null); } else { return callback(null, true); } } else { return callback(null, true); } }); } else { return callback(null, true); } } else { return callback(null, true);

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber
Cerber family
cerber
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Contacts a large (522) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Deletes itself 1 IoCs

pid	Process
2864	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
2096	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe
2096	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp7214.bmp"	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2096 set thread context of 1920	2096	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe	30

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BUSINESS.ONE	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\PLANNERS.ONE	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ACADEMIC.ONE	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# HELP DECRYPT #.html	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# HELP DECRYPT #.txt	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# HELP DECRYPT #.url	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BLANK.ONE	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\emasculations	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2404	PING.EXE

Kills process with taskkill 1 IoCs

evasion

pid	Process
2364	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 61 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "439566968"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{53B60D11-B30C-11EF-8B3C-EA879B6441F2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 701115181947db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{53A7C4D1-B30C-11EF-8B3C-EA879B6441F2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a907cc1344750743988d8bab481dbfbf000000000200000000001066000000010000200000006b2403cba412e808a4658842dbaf7c6c732cfdc0bf6dc63a87e9f505149fa345000000000e80000000020000200000003fb0152d6c7a0aff6fa67972e20699aa614702537c28918eab68da956e5e9440900000002a35f0c2a680b96c899b19e3b04d82417398a71b26c8ee73ed13972b416c89f3bdf1c77773fb7895ecc7376ef555173301a5c759a1c035de1b72bc9465144bec4b3fed7f79403d33ad8c832a1897a73fae6c90bd500c031f897b50d10a4d44d80df4ab97f11c93805bd0cb12a037864b1f9e13f37952317bacae15bb420b1d084998055e6f07774e061ebbcbd1d5c73e400000000b18520206513cef1b11780641d384796408eb16b8a902e67aa7c0c661d589e670f08cd75ccd9ac9a55879a15bd3fe1a148c5e9b431ce51a65a706acc4daed23	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a907cc1344750743988d8bab481dbfbf00000000020000000000106600000001000020000000c672c85c4d3c31d985b4386fea2b1becab5b12d7fbf8d0736dc2e235eacd2a44000000000e8000000002000020000000dbaea5ce7bccbd20f190e6a56692fca361accebc2ebe58896d600dcf303be200200000006386f244dfba1140db729b7e5c83b339b93ec2b9fda7c30e659f895fcd282b704000000080218d6d2aa72acbba941caaa6e2bb75c4c1b9a2aabb749e4dcf3e07fdba624691e3b871eff1648d2df2fa0b7b815ced29e6c4db7f1cc3f7c76c2896d634d20e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2404	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1920	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe
1920	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe
1920	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe
1920	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	1920	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	3008	WMIC.exe
Token: SeSecurityPrivilege	3008	WMIC.exe
Token: SeTakeOwnershipPrivilege	3008	WMIC.exe
Token: SeLoadDriverPrivilege	3008	WMIC.exe
Token: SeSystemProfilePrivilege	3008	WMIC.exe
Token: SeSystemtimePrivilege	3008	WMIC.exe
Token: SeProfSingleProcessPrivilege	3008	WMIC.exe
Token: SeIncBasePriorityPrivilege	3008	WMIC.exe
Token: SeCreatePagefilePrivilege	3008	WMIC.exe
Token: SeBackupPrivilege	3008	WMIC.exe
Token: SeRestorePrivilege	3008	WMIC.exe
Token: SeShutdownPrivilege	3008	WMIC.exe
Token: SeDebugPrivilege	3008	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3008	WMIC.exe
Token: SeRemoteShutdownPrivilege	3008	WMIC.exe
Token: SeUndockPrivilege	3008	WMIC.exe
Token: SeManageVolumePrivilege	3008	WMIC.exe
Token: 33	3008	WMIC.exe
Token: 34	3008	WMIC.exe
Token: 35	3008	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3008	WMIC.exe
Token: SeSecurityPrivilege	3008	WMIC.exe
Token: SeTakeOwnershipPrivilege	3008	WMIC.exe
Token: SeLoadDriverPrivilege	3008	WMIC.exe
Token: SeSystemProfilePrivilege	3008	WMIC.exe
Token: SeSystemtimePrivilege	3008	WMIC.exe
Token: SeProfSingleProcessPrivilege	3008	WMIC.exe
Token: SeIncBasePriorityPrivilege	3008	WMIC.exe
Token: SeCreatePagefilePrivilege	3008	WMIC.exe
Token: SeBackupPrivilege	3008	WMIC.exe
Token: SeRestorePrivilege	3008	WMIC.exe
Token: SeShutdownPrivilege	3008	WMIC.exe
Token: SeDebugPrivilege	3008	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3008	WMIC.exe
Token: SeRemoteShutdownPrivilege	3008	WMIC.exe
Token: SeUndockPrivilege	3008	WMIC.exe
Token: SeManageVolumePrivilege	3008	WMIC.exe
Token: 33	3008	WMIC.exe
Token: 34	3008	WMIC.exe
Token: 35	3008	WMIC.exe
Token: SeBackupPrivilege	2992	vssvc.exe
Token: SeRestorePrivilege	2992	vssvc.exe
Token: SeAuditPrivilege	2992	vssvc.exe
Token: SeDebugPrivilege	2364	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
984	iexplore.exe
984	iexplore.exe
2100	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
984	iexplore.exe
984	iexplore.exe
984	iexplore.exe
984	iexplore.exe
756	IEXPLORE.EXE
756	IEXPLORE.EXE
2100	iexplore.exe
2100	iexplore.exe
528	IEXPLORE.EXE
528	IEXPLORE.EXE
1348	IEXPLORE.EXE
1348	IEXPLORE.EXE
528	IEXPLORE.EXE
528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 1920	2096	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe	30
PID 2096 wrote to memory of 1920	2096	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe	30
PID 2096 wrote to memory of 1920	2096	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe	30
PID 2096 wrote to memory of 1920	2096	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe	30
PID 2096 wrote to memory of 1920	2096	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe	30
PID 2096 wrote to memory of 1920	2096	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe	30
PID 2096 wrote to memory of 1920	2096	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe	30
PID 2096 wrote to memory of 1920	2096	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe	30
PID 2096 wrote to memory of 1920	2096	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe	30
PID 2096 wrote to memory of 1920	2096	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe	30
PID 2096 wrote to memory of 1920	2096	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe	30
PID 1920 wrote to memory of 2856	1920	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe	32
PID 1920 wrote to memory of 2856	1920	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe	32
PID 1920 wrote to memory of 2856	1920	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe	32
PID 1920 wrote to memory of 2856	1920	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe	32
PID 2856 wrote to memory of 3008	2856	cmd.exe	34
PID 2856 wrote to memory of 3008	2856	cmd.exe	34
PID 2856 wrote to memory of 3008	2856	cmd.exe	34
PID 1920 wrote to memory of 984	1920	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe	40
PID 1920 wrote to memory of 984	1920	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe	40
PID 1920 wrote to memory of 984	1920	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe	40
PID 1920 wrote to memory of 984	1920	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe	40
PID 1920 wrote to memory of 1668	1920	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe	41
PID 1920 wrote to memory of 1668	1920	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe	41
PID 1920 wrote to memory of 1668	1920	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe	41
PID 1920 wrote to memory of 1668	1920	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe	41
PID 984 wrote to memory of 756	984	iexplore.exe	42
PID 984 wrote to memory of 756	984	iexplore.exe	42
PID 984 wrote to memory of 756	984	iexplore.exe	42
PID 984 wrote to memory of 756	984	iexplore.exe	42
PID 984 wrote to memory of 528	984	iexplore.exe	44
PID 984 wrote to memory of 528	984	iexplore.exe	44
PID 984 wrote to memory of 528	984	iexplore.exe	44
PID 984 wrote to memory of 528	984	iexplore.exe	44
PID 2100 wrote to memory of 1348	2100	iexplore.exe	45
PID 2100 wrote to memory of 1348	2100	iexplore.exe	45
PID 2100 wrote to memory of 1348	2100	iexplore.exe	45
PID 2100 wrote to memory of 1348	2100	iexplore.exe	45
PID 1920 wrote to memory of 2864	1920	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe	47
PID 1920 wrote to memory of 2864	1920	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe	47
PID 1920 wrote to memory of 2864	1920	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe	47
PID 1920 wrote to memory of 2864	1920	c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe	47
PID 2864 wrote to memory of 2364	2864	cmd.exe	49
PID 2864 wrote to memory of 2364	2864	cmd.exe	49
PID 2864 wrote to memory of 2364	2864	cmd.exe	49
PID 2864 wrote to memory of 2404	2864	cmd.exe	51
PID 2864 wrote to memory of 2404	2864	cmd.exe	51
PID 2864 wrote to memory of 2404	2864	cmd.exe	51

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Users\Admin\AppData\Local\Temp\c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe"
  2⤵
  - Checks whether UAC is enabled
  - Sets desktop wallpaper using registry
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2856
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic.exe shadowcopy delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3008
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# HELP DECRYPT #.html
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:984
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:984 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:756
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:984 CREDAT:537601 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:528
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# HELP DECRYPT #.txt
    3⤵
    PID:1668
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "c7e77a8a2bddb15c701032fd3d2a9e4b_JaffaCakes118.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2364
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2404

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2992

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
1⤵
- System Location Discovery: System Language Discovery
PID:2188

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
b14c5865342984255e889edd22b4b7a5

SHA1
f4e4ceab55e32658cea49014fca1e22a400249b3

SHA256
66c258be554213685464b935edb7f804b2c734c830c1d9805aa5af1d3ae01795

SHA512
9a7b2cb0fff8d707e7b091b68f02700f47752ede7227e40c1c177693646a1e0d7c3e0251312c1f460d4bda48479ce9761907bdd0430747eefeb37408e22bc129

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5eeeb82684e7058e1dcd79dcf33c4a16

SHA1
c0e734f957d8090cce41bf825ab67321fa1deff8

SHA256
9465ac8a1719c028379b577c23f29e94b9f6b953df996d15869af3eb07c628bf

SHA512
6b72655644cc486efcc6fd9c0562bf5e841da5380fb32f2aec802625f2cb8315ad3382ae3f3949fce8d7c8a8fed19e1a2fecd9c43198fef5a6e2ee38af7e5ad7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c42f0f774589d4e68335a774cd13514c

SHA1
63977cb130e770ed875bb9f8d9ad6db3d4e2eb53

SHA256
ae2005d5c4ee622ac38fbc9a7740b6bb3f718135d8b6486c2f4b52e02b185101

SHA512
3d4fe03c43d416795b00d3cd8336a6a2fdc700d9965b2a249ed63ec6032db58084592d6fd8be3598e103d659ea4a570dcd925cc9c4c8d18102ca4c3e824446dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ed219b25cba7b2ddf8fedc8e05ad086

SHA1
fe713166b2e117a61f3929c6b1902a57570a4744

SHA256
659d74c793d6441f38d412c6196e8ec8dc6aec95b78b26d75f7e4103c1000462

SHA512
e9dadc37bd46e3112702fd2ca769966731453d860ae3f00e9aa0774515ae3c48b71add3591c081cc1c5e0cc6866306f0a0b50c5344eab93799126cd35a16acdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26a68f0fcdde06beebabdc3bc255454a

SHA1
78abea1bb06cb1b20961820e4d2e4e7c1f3a4064

SHA256
fb1dcfdc31195091a50816753d6c487291c1623e99fd83367a7c77155639ee0d

SHA512
8c9568f4c1b07839db2eed8770d5d9358ad63851ac605909bfedbf51ce7c197e247d9c5c0d7af9f4b8c2c42d7b4d5d753be8dbffc54ada79aef340fd2b77b166

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad6b9fddca4bc2530e0e657e640337da

SHA1
72da5247f560128e125dd039bae60bf32bf2776a

SHA256
e2978ab2cb5e3bf42681021677a3531815b2bdc6fadd92c8fa110f1faab17175

SHA512
f885b749eccd41702d902331e0db95685fa72b3e1a4ce0fd5791918682807aa00e1b2aa1b45e3114af8682a01c2abf451e377eff7f780b22fad45c482dc4a6ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31932c1ca365e956fe76a123a3f569a3

SHA1
6104209d0dfd45929a9cdf0fc2f62650c1980e7f

SHA256
903e506296d6fb6e2dad3cf4fa8d8ac1576e43dba0ffbf4c440bc8431227d98d

SHA512
d4096bc4a5d41f7e716fc92746e6fa738ed6104cc2b6c373c45bf88244876349e6a26fd4092c1c7d82e33322f555ca47b4e37101fc93be791428bca1be2af5b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e7ef00f673a7087427483a6f090d75f

SHA1
f848c0fe96fc8f4e9aa144d6cccad121492a3941

SHA256
9b22784460b07b08d25f375981ca40c4eb1396d718867d4055baff1fbc9777ec

SHA512
df6eb0c127f90bf43cf239f5a2a6e4430ec5fc1031c17d8df31c0bcdc046895849adac6ad7281ba69f12930a11ada1f16c9265b3e5ae27bff025b52d0b64132f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2b20c689c6dd38907e40eabf5e880a3

SHA1
94dabbf7e224d5a562618b832a7cdf1a557e49ce

SHA256
1f0b89640ab2f81f2d1ed322e6ef3903f72d8f401586f6fc65832e11690e52d8

SHA512
1dc534a418825c9b6e79f3f1949a2d8e1839ae941db4782bb3340911eaf54b62feba13fc3931b1bc4a7c22b54725cc814a78219071f7ccec38e31d18cd546b59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6226aeb22abcf3680fc6b0a26aef0449

SHA1
b936560deaefb6c0872b491de263411a30e5dca6

SHA256
5bef3ad664300935900f56ebd06e971133d8dfaf0ef3ee81ed28886d70772d5e

SHA512
ba1a4daf177938c25b4ccbedf7c8a71903e02e360fadf8f12b9997317ee3e016595a1a5bf886f35f684f3d863877a45a7fb1f7a25876658a21fb91130265335d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23e6df64144fc76dce55b0355f813bec

SHA1
2f529e58eb867dea8a5bbe4fdcac5c98eeab4fb6

SHA256
2759deeae753d3c74d20f1222475de1882ec533de8c2b9045a5937470f3db685

SHA512
0f2780c35a9ddbcc9250e74c4e967c6c0ae9e8a3b4d7e6dcab619e01587bbffcdae8422f106bccd8be9570b21bd617ee135a994c66eaabfc85dd4162a9f292ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09340839d003dd74a5010e292812844f

SHA1
b930728ee5f52611d6c1bea21b5cd063fa7c216b

SHA256
9d195705a6acdd38e08fd6e26701f797784e2a37b5b55b12535685714c2d3001

SHA512
fd0792381802f92351caaeeededf633db7e143d3e494a518d4a123bfa429b88f13aa04afa2de5a3883dc100c5830ed614e789e3ce919a14b279da7f1430d7b6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a25f2640d3996a55fb8a887aa373454

SHA1
3abe736d11ae8a37c9d93c2216b96667aba09be4

SHA256
89ea7342c8157d1380a9dbfc9102418a6823c40dd41281c3e677c396b02575b0

SHA512
b7b2aebcaf49c392b89524475b3c55d9d46b58aab5a368b2e72f44c464d33ba7444642c015f2087c293263d6f8c8f6335a52c7ad04bb947f895e6c646a252d75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
036e243b25d1414228231fbb4cd909da

SHA1
5cf800fb8f31b6645802a93a3b9acbc52750a22b

SHA256
af62698f7ce60b90f636e8a3bf09b7bf874356525ab413d0c48e4e77ea9993de

SHA512
90ce6882e388c5cacdd654a6359da78abf3906abe62b837ec53a1f35fa00220a437b5b8e8449ad91bde19c17125ee8a319fbca6eb3142fb0e3c403dd6b0785ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e48cc5435b7f3500f1a8751167e42b4

SHA1
a95186ce824a40b21ede08edf7a0f00cdc13bcac

SHA256
04bf2fdb91117746bf74aaaa0bb725cca1bf6085a263fde8b200684440934ad4

SHA512
dd42a5748f6e9ff1a10ae34c83a94015976d00f1adb1df1b4502f846251a2aa821679dee186033cd4221416c1a1d0cfa62884be2fc8fd1d36b1d14b2fa3fa659

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4ffccb00b08388cb871f94d13bc7fc2

SHA1
49bfb00e93aa0dc762f31ccd6e2b1ae5a35784bd

SHA256
9315e5d95f6ff9db23566d4d783a44da920752ccc38608f6831bf20d9f5beae0

SHA512
b25e632c62b78daeab8af20b6ee50879412acee0f1b37dacdad22ad36cca9f22635fdafdee137e864fdfba709a4b3cb0750ae487780104ac6dd64fb2c452ad22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5404e72a84a936f0a1c004aaee9a8e62

SHA1
555a653be2c078e6920e412922a24c338be5b35d

SHA256
a6a2fb7351353a5dcc6350dcddc502f228b3aab2d4e893a1eae24e71cdab6552

SHA512
13ca7c7844851ac737c94318f50234c5f7d4673dd737f7942e766494a7d1779c78776747434a9bd357bd72218b58c01f792807293aec44672ff78ef29f9746b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37980c189ec2cb583ff89094ea127aa9

SHA1
5488e1df7dec0e8941db48e980a8eb54022a2f99

SHA256
6af53b77ccbbbbef552df9c2b1f8ad7be7089a7f325b19f355743fb6967055f6

SHA512
8b189fbcdc4c22f38a194cd8e9d792987f261c0da9f65c088f31b8a2c659d6fcfe177a6f75d29bdb8f10434f15529fec4f1f505c70ba197afbc03815811d7454

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33ef158507577ef5fc7bc9794275c117

SHA1
d4267a6c4737cd288527c5fbe4430c53b634de44

SHA256
fa2957fafda8ac933b068f8faeddced81d4ecf591d476e71e1b083f8524bed79

SHA512
aa21787f54e39cfd501c5d85eb1fecd00ce315d8a74deb64d7f1e701badbcea4bd6536e37df2120d83df9927c4206fba223654bac24e230185181da35f90911c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62152de688ac040b0fd6ad09a0f3f570

SHA1
d433fb1cbfc0de53f88277962e729295f9dea34e

SHA256
23471aab496461a505d60b8aca1473023bad1093842fde18c65aa734c035a712

SHA512
8443bb93f3440e622e105a5a0789d27e40e64476f96ace3bacdfdaa21c11aab57ab1150e5ad287b795de5b1074575d44db34d15fc114f8ae69c121cc7eec15fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a7119e198ad514592f4f37bbb960724

SHA1
7d0961b961c5810290d3506c66b7507d3fdbf526

SHA256
a9dab4ee046e07165a1a80e9c23292f5f7cb3b9cf0bd9aad4038f5ddd01fb5f8

SHA512
bafe3d5cbf30abf1237500c7871ce1efb424357b7a6965aa0d33f3b02caedbe6dd1afa832c749279f83052eb3a34660f36e000d219370536c1a3820c778e2020

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
7e2230ebbdf5559222284d1e0286ae48

SHA1
c0d57599e65409957460766340c182cb3615735a

SHA256
dcd1e0fd28f24d1f9e114f8c2e0aeb28f9676a49e4fb732db433ceeb2b715cdd

SHA512
b730d77ceb5cb98650d81424e04ad2c9b739b436f97cab227477bc57faa3cf79bba8fe9c291634831cdcaca6107da0b0710efbcc102e5341c34341d34f0910a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{53A7C4D1-B30C-11EF-8B3C-EA879B6441F2}.dat

Filesize
6KB

MD5
881f381e1f81cedc2d4a175bccc82a38

SHA1
3b81c82c3f72d26df0240924dd54630e25c01bcc

SHA256
7f4c33f204c0e46e0989e658a93e84c9a64d300da49abcf213b75a7f16befa77

SHA512
f248fd803393c28e04148a7298a92e234e45327965ab11eb3417aac26598b4772e7a75e1c254f8fc642e4df82568c343822c860ea423311dd1630a5255decb63

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9B4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA53.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\generate.section.toc.level.xml

Filesize
1KB

MD5
53d3ecb0cd2596cd97a49d498225b9eb

SHA1
bdb84142b64b2ef9454a08ffb8207b2d2098234c

SHA256
aebbf7076b60c077fdca77deb28a6ffb8524b8fedcae93d3b155f54dee9289d2

SHA512
9904015f0c9bf8e38294eb4a8c40e9ff867bfdd28980c95e164fb179b69a326dc6378d9a5cdd5efc6e58b966db7263775a31cac64f93979c71aca8c912fffe50

Download Submit
C:\Users\Admin\Music\# HELP DECRYPT #.html

Filesize
19KB

MD5
be06333f7d787a15dfd72351142bb0b3

SHA1
6b5b90a18c39ff3fdf19d682a13db9a1f2591dec

SHA256
ad698985b17f65a7c53e5878ec117cca15cfeb6b11d309ba9209bc6801f7a27b

SHA512
e44e5cb10662cf8a7704e7fcea6c9e9dcfdd13838e64c0fbde9a0c0c9734ca029bd29018a79e6a82a9ae91f4a2e085a503f39bb5abd5f5f79f9bddb78cca52d4

Download Submit
C:\Users\Admin\Music\# HELP DECRYPT #.txt

Filesize
10KB

MD5
00e709cf8dba669880aa131686cce277

SHA1
fc0a85856b47788b7c75a3674af9dc29d3fb6c28

SHA256
51bf76670a64eeafd44c8cacaba65a047f6cdc711d0de3c7c4d1fabd778e38ba

SHA512
a88b26c6c109ea9850b2067d4ed348d809fca63f4fe3e94d4c8292e7b56d8c0153b8eb36899a64d8784e0bd71b3310def0236e4d2703b238f8f0a836545b14ca

Download Submit
C:\Users\Admin\Music\# HELP DECRYPT #.url

Filesize
90B

MD5
78a9d38d83ade4f5ae059e99cda42b8d

SHA1
a1cd160360e62a504e1f5a55a0d6b28dbd9b23d5

SHA256
19a98e2a8a78f8f128e982ab646e70b69795c9e832d5156ce5b08d71c3927d31

SHA512
97a5d2adffff8c1b8dbe8d918b6d3c2a74eadeaf9e492aae0f30adf1397765d327cc60e76a8b0dc94b90b97fa3868ac2b26391d32ecab78a17d6734dbc359462

Download Submit
\Users\Admin\AppData\Local\Temp\nsoB6B3.tmp\System.dll

Filesize
11KB

MD5
6f5257c0b8c0ef4d440f4f4fce85fb1b

SHA1
b6ac111dfb0d1fc75ad09c56bde7830232395785

SHA256
b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1

SHA512
a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8

Download Submit
\Users\Admin\AppData\Roaming\SetCursor.dll

Filesize
32KB

MD5
52f270f15e2183d4393754eaa0aa5a53

SHA1
54a7671f255752849f9b232b1151803998c97db2

SHA256
036f25a8894f77aef1e7dae6d33897c2e740c3b2510836c05c0845f34da0880e

SHA512
1b7ec95ab03009992f75642880b3eaa49b3d5ded0835878f0f8a0c011f1ace1d4aeecdb8e1d003dba90d5d4dc608673adc0dce5095c313721f3fb99c7b45c00d

Download Submit
memory/1920-386-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-428-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-425-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-383-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-434-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-419-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-410-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-449-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-452-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-407-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-404-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-401-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-398-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-395-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-392-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-389-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-416-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-422-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-446-0x00000000040D0000-0x00000000040D2000-memory.dmp

Filesize
8KB

Download
memory/1920-50-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-36-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-33-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-31-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-30-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-28-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1920-12-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-14-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-16-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-19-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-20-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-22-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-26-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1920-413-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2096-10-0x0000000000900000-0x000000000090B000-memory.dmp

Filesize
44KB

Download